skilldrop-cli 0.16.31 → 0.16.33

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/pr.diff

@@ -0,0 +1,42 @@
+diff --git a/go.mod b/go.mod
+index 4be19a2..d07c3e1 100644
+--- a/go.mod
++++ b/go.mod
+@@ -3,14 +3,15 @@ module example.internal/payments-gateway
+ go 1.23
+
+ require (
+-	github.com/fernwire/httpkit v1.8.1
++	github.com/fernwire/httpkit v1.8.4
+ 	github.com/quillstack/zlogx v0.11.2
+ 	github.com/stretchr/testify v1.9.0
+ )
+
+ require (
+ 	github.com/davecgh/go-spew v1.1.1 // indirect
+-	github.com/fernwire/backoff v0.3.0 // indirect
++	github.com/fernwire/backoff v0.4.0 // indirect
++	github.com/fernwire/otelshim v0.1.0 // indirect
+ 	github.com/pmezard/go-difflib v1.0.0 // indirect
+ 	gopkg.in/yaml.v3 v3.0.1 // indirect
+ )
+diff --git a/go.sum b/go.sum
+index 7a10c3f..e41b9d8 100644
+--- a/go.sum
++++ b/go.sum
+@@ -1,10 +1,12 @@
+ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+ github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+-github.com/fernwire/backoff v0.3.0 h1:Qm3kT0n1Zr8vYx2LdP4eWc7sHf9aJbN6uE5tGiKoR1s=
+-github.com/fernwire/backoff v0.3.0/go.mod h1:Hc2pW8yTn5sLq0FvB3xJdM7eKa4rZu9gYiN1oPtE6Xw=
+-github.com/fernwire/httpkit v1.8.1 h1:Tz4xR9cWm1bPq7Ls2nVe8KdJ3hYf0aGu6oNiE5rBtXk=
+-github.com/fernwire/httpkit v1.8.1/go.mod h1:Lw6pD2sNx9bRe4Ty1qZa7HmKc3jUf8vGo0iEnB5tYsQ=
++github.com/fernwire/backoff v0.4.0 h1:Bv7nQ2xKp4cLz9Ws1mTe6RdH0yJa3fGu8oNiE5rCtWk=
++github.com/fernwire/backoff v0.4.0/go.mod h1:Hc2pW8yTn5sLq0FvB3xJdM7eKa4rZu9gYiN1oPtE6Xw=
++github.com/fernwire/httpkit v1.8.4 h1:Kp9sT3vWn2cRq6Lx1mBe7JdH4yGf0aZu5oNiE8rAtYk=
++github.com/fernwire/httpkit v1.8.4/go.mod h1:Rm3dF8sNx1bWe6Ty2qZa9HkKc4jUf7vGo0iEnB5tXsP=
++github.com/fernwire/otelshim v0.1.0 h1:Wd2mR7xKq5cLp8Vs3nTe1RfH6yJb0aGu4oNiE9rDtUk=
++github.com/fernwire/otelshim v0.1.0/go.mod h1:Ty5nB3sMx7bQe2Rw8qZa4HjKc1jUf6vGo9iEnC0tWsL=
+ github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+ github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+ github.com/quillstack/zlogx v0.11.2 h1:Jn8cV4xTq1bLm7Rs2pWe5KdF3hYg0aHu9oNiE6rBtZk=

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/6/vendor-notes/httpkit-CHANGELOG.md

@@ -0,0 +1,43 @@
+# Changelog — github.com/fernwire/httpkit
+
+Excerpt copied from the upstream repository's CHANGELOG.md at tag v1.8.4.
+
+## v1.8.4 — 2026-10-02
+
+### Added
+- `WithTracer(t otelshim.Tracer)` option for OpenTelemetry spans. Pulls in
+  `github.com/fernwire/otelshim` as a dependency. No behaviour change unless
+  the option is passed. (#238)
+
+### Fixed
+- Data race in connection-pool metrics when `Stats()` is called concurrently
+  with in-flight requests. (#240)
+
+## v1.8.3 — 2026-09-18
+
+### Changed
+- `NewClient` no longer applies a default 30-second `Timeout`. The zero value
+  now means **no client-level timeout**, matching `net/http.Client`. Callers
+  that relied on the old default should pass `WithTimeout(30 * time.Second)`
+  explicitly. Deadlines carried by the request `context.Context` are still
+  honoured. (#231)
+
+  We are shipping this in a patch release because the old default silently
+  cut off long-polling and streaming callers, which we consider a bug.
+
+### Fixed
+- `Response.Body` is now always closed when `Do` returns an error after
+  reading headers. (#229)
+
+## v1.8.2 — 2026-08-30
+
+### Changed
+- Retry backoff is now computed by `github.com/fernwire/backoff` v0.4.0
+  (previously v0.3.0). Jitter is full-jitter instead of equal-jitter; the
+  maximum delay per attempt is unchanged at 2s. `WithRetries(n)` semantics
+  are unchanged. (#224)
+
+## v1.8.1 — 2026-08-04
+
+### Fixed
+- `WithBaseURL` now tolerates a trailing slash. (#219)

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/.github/workflows/ci.yml

@@ -0,0 +1,67 @@
+name: ci
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run lint
+
+  format:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run format:check
+
+  typecheck:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run typecheck
+
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm test
+
+  build-and-smoke:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d1f0a9c7e5b2846f0c1a7d9e3b5f8c2a6d4e017 # v4.2.2
+      - uses: actions/setup-node@6b2e8d0f4a1c3957e2a8c4f6b0d9a1c3e5f7b8d2 # v4.1.0
+        with:
+          node-version-file: .nvmrc
+          cache: npm
+      - run: npm ci
+      - run: npm run build
+      # Runs the test suite against the built dist/ bundle, not src/.
+      - run: npm run test:dist

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/.lintwright.json

@@ -0,0 +1,7 @@
+{
+  "extends": ["lintwright:recommended"],
+  "ignore": ["dist/", "coverage/"],
+  "rules": {
+    "no-console": "error"
+  }
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/.nvmrc

@@ -0,0 +1 @@
+20.11.1

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/PR.md

@@ -0,0 +1,110 @@
+# chore(deps): update dev dependencies (non-major) #88
+
+**renovate** wants to merge 1 commit into `main` from `renovate/dev-dependencies-non-major`
+
+This PR contains the following updates:
+
+| Package | Type | Update | Change |
+|---|---|---|---|
+| bundlecrate | devDependencies | minor | `6.0.1` -> `6.1.0` |
+| lintwright | devDependencies | minor | `4.2.0` -> `4.3.1` |
+| prettyquill | devDependencies | patch | `3.1.2` -> `3.1.4` |
+| tsforge-types | devDependencies | patch | `1.4.0` -> `1.4.2` |
+| vellum-test | devDependencies | minor | `2.7.3` -> `2.8.0` |
+
+---
+
+### Release Notes
+
+<details>
+<summary>bundlecrate/bundlecrate (bundlecrate)</summary>
+
+#### v6.1.0
+
+- **Node.js support:** minimum supported Node.js is now 18.18. Node 16 is no longer tested. (#1502)
+- The module resolver has been extracted into its own package, `@bundlecrate/resolver-core`, which `bundlecrate` now depends on. The previous internal fallback package `bundlecrate-legacy-resolver` is no longer needed and has been dropped. No change to resolution behaviour; output is byte-identical on our fixture suite. (#1497)
+- Incremental rebuilds are ~20% faster in watch mode. (#1489)
+
+#### v6.0.2
+
+- Fix source-map `sources` paths on Windows. (#1481)
+
+</details>
+
+<details>
+<summary>lintwright/lintwright (lintwright)</summary>
+
+#### v4.3.1
+
+- Fix false positive in `no-unused-vars` for destructured catch parameters. (#902)
+
+#### v4.3.0
+
+- New rule `no-floating-promise`, enabled as an error in the `lintwright:strict` preset. It is **not** added to `lintwright:recommended`. (#888)
+- `picolabel` updated to 0.9.2 for terminal colour detection fixes.
+
+#### v4.2.1
+
+- Docs-only release.
+
+</details>
+
+<details>
+<summary>prettyquill/prettyquill (prettyquill)</summary>
+
+#### v3.1.4
+
+- Fix idempotency bug when formatting long ternaries inside JSX attributes. (#611)
+
+#### v3.1.3
+
+- Performance: cache parsed config across files. (#604)
+
+</details>
+
+<details>
+<summary>tsforge/types (tsforge-types)</summary>
+
+#### v1.4.2
+
+- Correct return type of `DeepReadonly<T>` for tuple types. (#77)
+
+#### v1.4.1
+
+- Add JSDoc to `Brand<T, K>`. (#74)
+
+</details>
+
+<details>
+<summary>vellum/vellum-test (vellum-test)</summary>
+
+#### v2.8.0
+
+- `vt.legacyTimers()` is deprecated and now prints a warning when called. It still works and will be removed in 3.0. Use `vt.fakeTimers()`. (#455)
+- New `expect.toSatisfyAll()` matcher. (#450)
+
+#### v2.7.4
+
+- Fix watch mode ignoring `.mts` files. (#447)
+
+</details>
+
+---
+
+### Configuration
+
+📅 **Schedule**: Branch creation - "before 6am on monday" (UTC), Automerge - Disabled by config.
+
+🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.
+
+---
+
+### Checks
+
+- ci / lint — passed
+- ci / format — passed
+- ci / typecheck — passed
+- ci / test — passed
+- ci / build-and-smoke — passed
+
+All checks have passed.

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/package.json

@@ -0,0 +1,25 @@
+{
+  "name": "@ledgerly/invoice-widgets",
+  "version": "3.12.0",
+  "private": true,
+  "type": "module",
+  "main": "dist/index.js",
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "lint": "lintwright . --max-warnings 0",
+    "format:check": "prettyquill --check .",
+    "typecheck": "tsc --noEmit",
+    "test": "vellum run",
+    "build": "bundlecrate src/index.ts --out dist",
+    "test:dist": "vellum run --config vellum.dist.config.js"
+  },
+  "devDependencies": {
+    "bundlecrate": "6.1.0",
+    "lintwright": "4.3.1",
+    "prettyquill": "3.1.4",
+    "tsforge-types": "1.4.2",
+    "vellum-test": "2.8.0"
+  }
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/pr.diff

@@ -0,0 +1,146 @@
+diff --git a/package.json b/package.json
+index 1c2e8f0..5ad91b3 100644
+--- a/package.json
++++ b/package.json
+@@ -17,11 +17,11 @@
+   "devDependencies": {
+-    "bundlecrate": "6.0.1",
+-    "lintwright": "4.2.0",
+-    "prettyquill": "3.1.2",
+-    "tsforge-types": "1.4.0",
+-    "vellum-test": "2.7.3"
++    "bundlecrate": "6.1.0",
++    "lintwright": "4.3.1",
++    "prettyquill": "3.1.4",
++    "tsforge-types": "1.4.2",
++    "vellum-test": "2.8.0"
+   }
+ }
+diff --git a/package-lock.json b/package-lock.json
+index 9e04a1d..c3b7f52 100644
+--- a/package-lock.json
++++ b/package-lock.json
+@@ -12,11 +12,11 @@
+       "devDependencies": {
+-        "bundlecrate": "6.0.1",
+-        "lintwright": "4.2.0",
+-        "prettyquill": "3.1.2",
+-        "tsforge-types": "1.4.0",
+-        "vellum-test": "2.7.3"
++        "bundlecrate": "6.1.0",
++        "lintwright": "4.3.1",
++        "prettyquill": "3.1.4",
++        "tsforge-types": "1.4.2",
++        "vellum-test": "2.8.0"
+       },
+       "engines": {
+         "node": ">=20"
+       }
+     },
++    "node_modules/@bundlecrate/resolver-core": {
++      "version": "1.0.0",
++      "resolved": "https://registry.npmjs.org/@bundlecrate/resolver-core/-/resolver-core-1.0.0.tgz",
++      "integrity": "sha512-Xk3bP9vQm2LrT7wZ1sNc4HfJ8eYd0GaU6oKiE5rBtWqV2nM7xL1pR9sT3vW8cZ4yH6jF0dK2gA5eN1bQ7uI3oP==",
++      "dev": true,
++      "license": "MIT",
++      "engines": {
++        "node": ">=18.18"
++      }
++    },
+     "node_modules/bundlecrate": {
+-      "version": "6.0.1",
+-      "resolved": "https://registry.npmjs.org/bundlecrate/-/bundlecrate-6.0.1.tgz",
+-      "integrity": "sha512-Lm7nQ2vKp9cRz4Wt1bXe8JdH3yGa0fUu6oNiE5rCtYqW2sM7xP1kR9tT3vV8bZ4yJ6hF0dL2gA5eN1cQ7uO3iP==",
++      "version": "6.1.0",
++      "resolved": "https://registry.npmjs.org/bundlecrate/-/bundlecrate-6.1.0.tgz",
++      "integrity": "sha512-Pq4rT8wXn1cLz6Vs2mBe9KdJ7hYf3aGu0oNiE5rDtUqX2nL7wM1pS9vT4bW8cZ3yK6jG0eH2fA5dN1aQ7iU3oR==",
+       "dev": true,
+       "license": "MIT",
+       "dependencies": {
+-        "bundlecrate-legacy-resolver": "^2.3.0",
++        "@bundlecrate/resolver-core": "^1.0.0",
+         "picolabel": "^0.9.0"
+       },
+       "bin": {
+         "bundlecrate": "bin/bundlecrate.js"
+       },
+       "engines": {
+-        "node": ">=16"
++        "node": ">=18.18"
+       }
+     },
+-    "node_modules/bundlecrate-legacy-resolver": {
+-      "version": "2.3.4",
+-      "resolved": "https://registry.npmjs.org/bundlecrate-legacy-resolver/-/bundlecrate-legacy-resolver-2.3.4.tgz",
+-      "integrity": "sha512-Ab2cD4eF6gH8iJ0kL2mN4oP6qR8sT0uV2wX4yZ6aB8cD0eF2gH4iJ6kL8mN0oP2qR4sT6uV8wX0yZ2aB4cD6eF8==",
+-      "dev": true,
+-      "license": "MIT"
+-    },
+     "node_modules/lintwright": {
+-      "version": "4.2.0",
+-      "resolved": "https://registry.npmjs.org/lintwright/-/lintwright-4.2.0.tgz",
+-      "integrity": "sha512-Hn5mR2xLq8cTz3Wv1bYe7KdF4hJa9gUu0oNiE6rBtWpX3sM2wL1kQ8vT5cV9bZ7yG4hF0dJ2eA6nN1aR3uI7oS==",
++      "version": "4.3.1",
++      "resolved": "https://registry.npmjs.org/lintwright/-/lintwright-4.3.1.tgz",
++      "integrity": "sha512-Ty8kW3vNp2cQz5Ls1mXe6RdJ9hGa4fUu7oNiE0rBtVqY2sK3wM1pL8vS5cT9bZ6yH4jF0eG2dA7nN1bR3iU5oQ==",
+       "dev": true,
+       "license": "MIT",
+       "dependencies": {
+-        "picolabel": "0.9.1"
++        "picolabel": "0.9.2"
+       },
+       "bin": {
+         "lintwright": "bin/lintwright.js"
+       }
+     },
+     "node_modules/picolabel": {
+-      "version": "0.9.1",
+-      "resolved": "https://registry.npmjs.org/picolabel/-/picolabel-0.9.1.tgz",
+-      "integrity": "sha512-Cd3eF5gH7iJ9kL1mN3oP5qR7sT9uV1wX3yZ5aB7cD9eF1gH3iJ5kL7mN9oP1qR3sT5uV7wX9yZ1aB3cD5eF7gH==",
++      "version": "0.9.2",
++      "resolved": "https://registry.npmjs.org/picolabel/-/picolabel-0.9.2.tgz",
++      "integrity": "sha512-Ef4gH6iJ8kL0mN2oP4qR6sT8uV0wX2yZ4aB6cD8eF0gH2iJ4kL6mN8oP0qR2sT4uV6wX8yZ0aB2cD4eF6gH8iJ==",
+       "dev": true,
+       "license": "MIT"
+     },
+     "node_modules/prettyquill": {
+-      "version": "3.1.2",
+-      "resolved": "https://registry.npmjs.org/prettyquill/-/prettyquill-3.1.2.tgz",
+-      "integrity": "sha512-Gh6iJ8kL0mN2oP4qR6sT8uV0wX2yZ4aB6cD8eF0gH2iJ4kL6mN8oP0qR2sT4uV6wX8yZ0aB2cD4eF6gH8iJ0kL==",
++      "version": "3.1.4",
++      "resolved": "https://registry.npmjs.org/prettyquill/-/prettyquill-3.1.4.tgz",
++      "integrity": "sha512-Ij7kL9mN1oP3qR5sT7uV9wX1yZ3aB5cD7eF9gH1iJ3kL5mN7oP9qR1sT3uV5wX7yZ9aB1cD3eF5gH7iJ9kL1mN==",
+       "dev": true,
+       "license": "MIT",
+       "bin": {
+         "prettyquill": "bin/prettyquill.js"
+       }
+     },
+     "node_modules/tsforge-types": {
+-      "version": "1.4.0",
+-      "resolved": "https://registry.npmjs.org/tsforge-types/-/tsforge-types-1.4.0.tgz",
+-      "integrity": "sha512-Kl8mN0oP2qR4sT6uV8wX0yZ2aB4cD6eF8gH0iJ2kL4mN6oP8qR0sT2uV4wX6yZ8aB0cD2eF4gH6iJ8kL0mN2oP==",
++      "version": "1.4.2",
++      "resolved": "https://registry.npmjs.org/tsforge-types/-/tsforge-types-1.4.2.tgz",
++      "integrity": "sha512-Mn9oP1qR3sT5uV7wX9yZ1aB3cD5eF7gH9iJ1kL3mN5oP7qR9sT1uV3wX5yZ7aB9cD1eF3gH5iJ7kL9mN1oP3qR==",
+       "dev": true,
+       "license": "MIT"
+     },
+     "node_modules/vellum-test": {
+-      "version": "2.7.3",
+-      "resolved": "https://registry.npmjs.org/vellum-test/-/vellum-test-2.7.3.tgz",
+-      "integrity": "sha512-Op0qR2sT4uV6wX8yZ0aB2cD4eF6gH8iJ0kL2mN4oP6qR8sT0uV2wX4yZ6aB8cD0eF2gH4iJ6kL8mN0oP2qR4sT==",
++      "version": "2.8.0",
++      "resolved": "https://registry.npmjs.org/vellum-test/-/vellum-test-2.8.0.tgz",
++      "integrity": "sha512-Qr1sT3uV5wX7yZ9aB1cD3eF5gH7iJ9kL1mN3oP5qR7sT9uV1wX3yZ5aB7cD9eF1gH3iJ5kL7mN9oP1qR3sT5uV==",
+       "dev": true,
+       "license": "MIT",
+       "bin": {
+         "vellum": "bin/vellum.js"
+       },
+       "engines": {
+         "node": ">=18"
+       }
+     }
+   }
+ }

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/src/due-date.ts

@@ -0,0 +1,16 @@
+import type { Brand } from "tsforge-types";
+
+export type IsoDate = Brand<string, "IsoDate">;
+
+const DAY_MS = 24 * 60 * 60 * 1000;
+
+export function isOverdue(inv: { dueAt: string }): boolean {
+  return Date.now() > Date.parse(inv.dueAt);
+}
+
+export function formatDue(inv: { dueAt: string }): string {
+  const days = Math.round((Date.parse(inv.dueAt) - Date.now()) / DAY_MS);
+  if (days < 0) return `overdue by ${-days} days`;
+  if (days === 0) return "due today";
+  return `due in ${days} days`;
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/src/totals.ts

@@ -0,0 +1,11 @@
+import type { DeepReadonly } from "tsforge-types";
+
+export type Line = DeepReadonly<{ qty: number; unitMinor: number }>;
+
+export function lineTotal(l: Line): number {
+  return l.qty * l.unitMinor;
+}
+
+export function invoiceTotal(lines: readonly Line[]): number {
+  return lines.reduce((sum, l) => sum + lineTotal(l), 0);
+}

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/tests/due-date.test.ts

@@ -0,0 +1,17 @@
+import { describe, it, expect, vt } from "vellum-test";
+import { isOverdue, formatDue } from "../src/due-date";
+
+describe("due dates", () => {
+  it("flags invoices past their due date", () => {
+    vt.fakeTimers({ now: new Date("2026-03-15T09:00:00Z") });
+    expect(isOverdue({ dueAt: "2026-03-14T23:59:59Z" })).toBe(true);
+    expect(isOverdue({ dueAt: "2026-03-16T00:00:00Z" })).toBe(false);
+    vt.restoreTimers();
+  });
+
+  it("formats relative due text", () => {
+    vt.fakeTimers({ now: new Date("2026-03-15T09:00:00Z") });
+    expect(formatDue({ dueAt: "2026-03-18T09:00:00Z" })).toBe("due in 3 days");
+    vt.restoreTimers();
+  });
+});

package/packs/dev-team/skills/dependency-upgrade-review/evals/files/7/tests/totals.test.ts

@@ -0,0 +1,12 @@
+import { describe, it, expect } from "vellum-test";
+import { lineTotal, invoiceTotal } from "../src/totals";
+
+describe("totals", () => {
+  it("multiplies quantity by unit price in minor units", () => {
+    expect(lineTotal({ qty: 3, unitMinor: 1250 })).toBe(3750);
+  });
+
+  it("sums lines", () => {
+    expect(invoiceTotal([{ qty: 1, unitMinor: 100 }, { qty: 2, unitMinor: 50 }])).toBe(200);
+  });
+});

package/packs/dev-team/skills/dependency-upgrade-review/examples/ledgerline-tidyparse.md

@@ -67,25 +67,34 @@ No install scripts, sources, licences or pins appear. The floor says only that t
 
 ## Review (what the agent hands back)
 
-**MERGE.** A two-release patch bump whose only behaviour change, the new 10 MB line limit in 2.2.2, raises an error the import code already handles, and CI runs that code.
+**MERGE.** Two patch releases; the only behaviour change, 2.2.2's new 10 MB line limit, raises an error the import code already handles, and the PR's tests run that code.
 
-🟨 Notes
+- Both releases read. 2.2.1 fixes quoted newlines splitting rows, covered by `test_quoted_newline_stays_one_row` (`tests/test_ingest.py:9`). 2.2.2 is a security fix: lines over 10 MB raise `RowTooLongError`, a subclass of `ParseError`.
+- `git grep -n "tidyparse" -- '*.py'` finds one call, `app/ingest.py:14`, inside `except tidyparse.ParseError` (`app/ingest.py:15`), so the new error becomes `StatementRejected` like any malformed file.
+- `ci.yml` runs `pytest -q` on the PR and `tests/test_ingest.py:3` imports `import_statement`, so the changed code ran.
 
-- Both releases read. 2.2.1 fixes quoted newlines splitting rows, which `test_quoted_newline_stays_one_row` (`tests/test_ingest.py:9`) covers. 2.2.2 is a security fix: lines over 10 MB now raise `RowTooLongError`, a subclass of `ParseError`.
-- Search: `git grep -n "tidyparse" -- '*.py'` finds one call, `app/ingest.py:14`, inside `except tidyparse.ParseError` (`app/ingest.py:15`). The new error is caught there and becomes `StatementRejected`, the same path as any malformed file.
-- CI: `ci.yml` runs `pytest -q` on the PR, and `tests/test_ingest.py:3` imports `import_statement`, so the changed code ran. No test feeds a 10 MB line; that is the library's limit, not a change in this repo's behaviour.
-- Beyond the title: `charset-sniff` 1.4.0 → 1.4.1, a transitive patch, listed and not read.
-- No new packages, install scripts, registry changes or pins.
+Also in the lockfile: `charset-sniff` 1.4.0 → 1.4.1 (transitive patch). No new packages, install scripts, sources, runtime changes or pins.
 
-| Package | Old → New | Class | Direct? |
-|---|---|---|---|
-| tidyparse | 2.2.0 → 2.2.2 | patch | direct |
-| charset-sniff | 1.4.0 → 1.4.1 | patch | transitive |
+Rollback: `git revert` the merge commit, or `poetry add tidyparse@2.2.0` and commit `pyproject.toml` and `poetry.lock`; that reopens the 2.2.2 memory issue, so treat it as a stopgap.
 
-Rollback: `git revert` the merge commit, or `poetry add tidyparse@2.2.0` and commit `pyproject.toml` and `poetry.lock`. Nothing persists to undo, but rolling back reopens the 2.2.2 memory issue, so pin back to 2.2.0 only as a stopgap.
-
-To confirm: nothing.
+About 150 words. No package table: two packages fit in a line. No "To confirm": nothing is open.
 
 ## Why this is MERGE and not MERGE AFTER CHECKS
 
 Every check in the verdict rule is closed with evidence in the reply: both releases read, the one changed behaviour searched and found handled, the calling code run by a PR test, no pins, no install-time code, no new source. Remove any one of those (no repo to search, a release with no notes, a test that does not import `app/ingest.py`) and the verdict drops to MERGE AFTER CHECKS with that item as the check.
+
+## The same shape when it blocks
+
+Suppose instead the PR moved tidyparse to 3.0.0 and the notes (invented for this illustration) said 3.0.0 requires Python 3.11 and `parse_rows()` now returns a `RowSet` instead of a list. The reply keeps the order and stays short:
+
+> **DO NOT MERGE.** 3.0.0 needs Python 3.11 and the production image runs 3.10, and the import code indexes a result that is no longer a list.
+>
+> 🟥 1. `Dockerfile:1` builds on `python:3.10-slim`; CI runs 3.12 (`ci.yml:12`), so the PR passed and the image build fails at install. Move the image to 3.11 in this PR.
+> 🟥 2. `app/ingest.py:17` does `rows[0]` on what is now a `RowSet`; no test reads the first row, so CI missed it. Use `rows.first()`.
+>
+> Also in the lockfile: `charset-sniff` 1.4.0 → 1.4.1.
+> Rollback: `git revert` the merge commit and rebuild the image.
+>
+> I can make both changes on this branch.
+
+The lead names both blockers; each blocker says what breaks, where, why CI missed it and the fix; nothing is in the reply that does not change the decision.

package/packs/dev-team/skills/dependency-upgrade-review/manifest.json

@@ -1,7 +1,7 @@
 {
   "name": "dependency-upgrade-review",
-  "version": "0.1.0",
-  "description": "Give a merge verdict on a dependency-upgrade pull request (Dependabot, Renovate or a hand-made bump) across npm, pip, Go, Cargo and Maven lockfiles and GitHub Actions pins. Reads the release notes for every skipped version, lists what the lockfile changes beyond the PR title (transitive bumps, new and removed packages, install scripts, registry changes), checks that each SHA pin is the commit its release tag points to, says whether CI ran the changed code, finds the repo's uses of changed APIs and writes the rollback, ending in MERGE, MERGE AFTER CHECKS or DO NOT MERGE. Use when the user says \"review this Dependabot PR\", \"is this Renovate bump safe to merge\", \"can I merge this dependency upgrade\", \"check this lockfile diff\", or \"is this action SHA pin right\".",
+  "version": "0.2.0",
+  "description": "Give a merge verdict on a dependency-upgrade pull request (Dependabot, Renovate or a hand-made bump) across npm, pip, Go, Cargo and Maven lockfiles and GitHub Actions pins. Reads the release notes for every skipped version, lists what the lockfile changes beyond the PR title (transitive bumps, new and removed packages, install scripts, registry changes), checks each SHA pin against its release tag and against the PR's other pins, checks raised runtime floors against the images and runners that install it, says whether CI ran the changed code, traces what each caller of a changed API now does and writes the rollback. The reply leads with MERGE, MERGE AFTER CHECKS or DO NOT MERGE and the reasons that decide it. Use when the user says \"review this Dependabot PR\", \"is this Renovate bump safe to merge\", \"can I merge this dependency upgrade\", \"check this lockfile diff\", or \"is this action SHA pin right\".",
   "entrypoint": "SKILL.md",
   "deps": {
     "npm": [],
@@ -38,10 +38,22 @@
     "github-actions"
   ],
   "permissions": {
-    "network": [],
-    "commands": [],
+    "network": [
+      "github.com",
+      "api.github.com",
+      "registry.npmjs.org",
+      "pypi.org",
+      "proxy.golang.org"
+    ],
+    "commands": [
+      "git",
+      "gh",
+      "npm",
+      "pip",
+      "go"
+    ],
     "files": "named-paths",
-    "notes": "Reads only the diff path it is given, or stdin; writes only the -o path when given. No network: SHA verification and changelog reading are printed as commands for the reviewer to run."
+    "notes": "The script reads only the diff path it is given, or stdin, writes only the -o path when given, and makes no network calls. The instructions read the PR with gh or git, list a package's releases with npm, pip, go or gh, and verify a SHA pin with git ls-remote against github.com; gh reaches api.github.com and the package managers their registries; with no network those become commands in the reply for the reviewer to run."
   },
   "model": {
     "tier": "standard",