skills-layer 0.1.4 → 0.1.6

package/tests/public-cli-package.test.mjs

@@ -11,6 +11,12 @@ const runtimeUrl = new URL("../public/skills-layer-public.mjs", import.meta.url)
 const readmeUrl = new URL("../README.md", import.meta.url);
 const licenseUrl = new URL("../LICENSE", import.meta.url);
 const wrapperUrl = new URL("../scripts/skills-layer.mjs", import.meta.url);
+const securityUrl = new URL("../SECURITY.md", import.meta.url);
+const contributingUrl = new URL("../CONTRIBUTING.md", import.meta.url);
+const codeOfConductUrl = new URL("../CODE_OF_CONDUCT.md", import.meta.url);
+const dependabotUrl = new URL("../.github/dependabot.yml", import.meta.url);
+const ciWorkflowUrl = new URL("../.github/workflows/ci.yml", import.meta.url);
+const trustedPublishWorkflowUrl = new URL("../.github/workflows/publish.yml", import.meta.url);
 const binPath = fileURLToPath(new URL("../bin/skills-layer.js", import.meta.url));
 
 async function loadRuntime() {
@@ -74,8 +80,12 @@ test("public package metadata keeps the npm tree narrow and non-lifecycle", asyn
   assert.equal(packageJson.bin["skills-layer"], "bin/skills-layer.js");
   assert.equal(packageJson.dependencies, undefined);
   assert.equal(packageJson.devDependencies, undefined);
-  assert.equal(packageJson.repository, undefined);
-  assert.equal(packageJson.bugs, undefined);
+  assert.equal(packageJson.license, "Apache-2.0");
+  assert.deepEqual(packageJson.repository, {
+    type: "git",
+    url: "git+https://github.com/ankurdhoom/skills-layer.git"
+  });
+  assert.deepEqual(packageJson.bugs, { url: "https://github.com/ankurdhoom/skills-layer/issues" });
   assert.deepEqual(packageJson.files, [
     "bin/skills-layer.js",
     "public/skills-layer-public.mjs",
@@ -87,6 +97,31 @@ test("public package metadata keeps the npm tree narrow and non-lifecycle", asyn
   for (const lifecycleScript of ["preinstall", "install", "postinstall", "prepare", "prepack", "postpack", "prepublishOnly"]) {
     assert.equal(packageJson.scripts[lifecycleScript], undefined);
   }
+
+  const workflow = await readFile(trustedPublishWorkflowUrl, "utf8");
+  assert.match(workflow, /name: Publish skills-layer to npm/u);
+  assert.match(workflow, /id-token: write/u);
+  assert.match(workflow, /npm publish --access public --provenance/u);
+  assert.doesNotMatch(workflow, /NPM_TOKEN/u);
+
+  const ciWorkflow = await readFile(ciWorkflowUrl, "utf8");
+  assert.match(ciWorkflow, /name: CLI package CI/u);
+  assert.match(ciWorkflow, /npm run typecheck/u);
+  assert.match(ciWorkflow, /npm run test:coverage/u);
+  assert.doesNotMatch(ciWorkflow, /NPM_TOKEN/u);
+
+  const dependabot = await readFile(dependabotUrl, "utf8");
+  assert.match(dependabot, /package-ecosystem: npm/u);
+
+  const [security, contributing, codeOfConduct] = await Promise.all([
+    readFile(securityUrl, "utf8"),
+    readFile(contributingUrl, "utf8"),
+    readFile(codeOfConductUrl, "utf8")
+  ]);
+  assert.match(security, /Please do not open public issues for active vulnerabilities/u);
+  assert.match(security, /hello@skills-layer\.com/u);
+  assert.match(contributing, /Do not submit backend service code/u);
+  assert.match(codeOfConduct, /Expected Behavior/u);
 });
 
 test("public package text stays limited to public CLI surface", async () => {
@@ -100,6 +135,9 @@ test("public package text stays limited to public CLI surface", async () => {
   const combined = `${packageText}\n${readme}\n${license}\n${runtime}\n${wrapper}`;
   assert.match(combined, /Skills Layer/u);
   assert.match(combined, /skills-layer/u);
+  assert.match(readme, /open-source CLI, MCP setup, and local agent integration layer/u);
+  assert.match(readme, /hosted backend code, marketplace services, Guardian scoring internals, and service operations remain proprietary/u);
+  assert.match(readme, /actions\/workflows\/ci\.yml\/badge\.svg/u);
   assert.match(readme, /https:\/\/unpkg\.com\/skills-layer\/docs\/assets\/skills-layer-logo\.svg/u);
   assert.match(readme, /https:\/\/unpkg\.com\/skills-layer\/docs\/assets\/skills-layer-hero\.svg/u);
   assert.match(readme, /https:\/\/unpkg\.com\/skills-layer\/docs\/assets\/skills-layer-flow\.svg/u);
@@ -170,7 +208,9 @@ test("public runtime fails closed for internal and login-required commands", asy
   const whoami = await runPublic(["whoami", "--json"]);
   assert.equal(whoami.exitCode, 1);
   const whoamiPayload = parseJsonError(whoami);
-  assert.equal(whoamiPayload.status, "error");
-  assert.match(whoamiPayload.summary, /Run `skills-layer login` first/u);
+  assert.equal(whoamiPayload.status, "login_required");
+  assert.equal(whoamiPayload.reasonCode, "login_required");
+  assert.equal(whoamiPayload.nextAction, "login");
+  assert.match(whoamiPayload.nextStep, /skills-layer login/u);
   assert.doesNotMatch(whoamiPayload.summary, /--api-key/u);
 });