@skillsmith/core 0.10.0 → 0.11.0

package/dist/src/security/scanner/SecurityScanner.hostile-update.js

@@ -0,0 +1,209 @@
+/**
+ * Hostile-Update Detection — R0 Wave 2A (SMI-5535)
+ * @module @skillsmith/core/security/scanner/SecurityScanner.hostile-update
+ *
+ * A PURE comparator (no I/O, no clock, no mutation of its inputs) that detects a
+ * benign→malicious "rug-pull" between two SecurityScanner scans of the SAME
+ * skill. The scanner already blocks a skill that is malicious on first sight;
+ * this detector catches the harder case where an initially-clean skill is
+ * silently updated to exfiltrate credentials or execute remote payloads.
+ *
+ * The verdict is delta-based: it never re-scores content, it only reasons about
+ * what changed between `previous` and `current`. "hostile" is reserved for the
+ * benign→malicious transition — a skill that was ALREADY flagged and merely got
+ * worse is a worsening (`suspicious`), not a fresh rug-pull.
+ */
+/**
+ * Default risk-score threshold. Mirrors SecurityScanner's `riskThreshold`
+ * default (SMI-5359) so the "crossed the failure bar" signal here lines up with
+ * the `passed` computation in `SecurityScanner.scan`.
+ */
+export const DEFAULT_RISK_THRESHOLD = 40;
+/**
+ * Minimum positive risk jump (short of crossing the threshold) that still counts
+ * as a "material" worsening worth a `suspicious` verdict.
+ */
+const MATERIAL_RISK_DELTA = 10;
+/**
+ * Co-occurrence finding types that, paired with a NEW `code_execution` finding,
+ * indicate a supply-chain execution rug-pull. Mirrors the intuition of
+ * `escalateCodeExecution`'s CODE_EXECUTION_CO_OCCURRENCE set (SecurityScanner.exec.ts),
+ * minus `obfuscated_directive` — a live concealed directive is already critical
+ * and self-quarantines on its own, so it needs no code_execution pairing here.
+ */
+const SUPPLY_CHAIN_CO_SIGNALS = new Set([
+    'data_exfiltration',
+    'privilege_escalation',
+    'sensitive_path',
+]);
+const SEVERITY_ORDER = {
+    low: 0,
+    medium: 1,
+    high: 2,
+    critical: 3,
+};
+function isHighOrCritical(f) {
+    return f.severity === 'high' || f.severity === 'critical';
+}
+/**
+ * Normalize free-text so cosmetic churn (whitespace runs, casing) does not make
+ * an otherwise-identical finding look "new". lineNumber is deliberately excluded
+ * from the key (see `findingKey`) because inserting benign prose above a finding
+ * shifts its line without changing the finding itself.
+ */
+function normalizeText(text) {
+    if (!text)
+        return '';
+    return text.toLowerCase().replace(/\s+/g, ' ').trim();
+}
+/**
+ * Stable identity for a finding: type + severity + normalized message + location.
+ * Severity is part of the key on purpose — an escalation (e.g. code_execution
+ * medium→critical, which also rewrites the message) is a genuinely NEW hostile
+ * signal, not the "same" finding. A finding that got SAFER (higher→lower
+ * severity, or disappeared entirely) therefore never shows up in `newFindings`.
+ */
+function findingKey(f) {
+    return [f.type, f.severity, normalizeText(f.message), normalizeText(f.location)].join('\u0000');
+}
+/** Findings present in `current` whose key is absent from `previous`. */
+function diffNewFindings(previous, current) {
+    const previousKeys = new Set(previous.findings.map(findingKey));
+    return current.findings.filter((f) => !previousKeys.has(findingKey(f)));
+}
+function highestSeverity(findings) {
+    return findings.reduce((worst, f) => SEVERITY_ORDER[f.severity] > SEVERITY_ORDER[worst.severity] ? f : worst);
+}
+/** Compact, one-line, single-number formatting for a (possibly fractional) score. */
+function fmt(n) {
+    const rounded = Math.round(n * 10) / 10;
+    return Number.isInteger(rounded) ? String(rounded) : rounded.toFixed(1);
+}
+function signed(n) {
+    return n > 0 ? `+${fmt(n)}` : fmt(n);
+}
+function describeFinding(f) {
+    const msg = f.message.length > 80 ? `${f.message.slice(0, 77)}...` : f.message;
+    return `${f.type} (${f.severity}): ${msg}`;
+}
+/**
+ * A NEW, non-documentation `code_execution` finding paired with a NEW,
+ * non-documentation high/critical exfiltration/privilege/credential-path
+ * finding = supply-chain execution. Requiring both to be new (and non-doc)
+ * keeps a security-research skill that merely documents these techniques from
+ * tripping the strongest signal.
+ */
+function detectSupplyChain(newFindings) {
+    const codeExec = newFindings.find((f) => f.type === 'code_execution' && f.inDocumentationContext !== true);
+    if (!codeExec)
+        return null;
+    const coSignal = newFindings.find((f) => f !== codeExec &&
+        SUPPLY_CHAIN_CO_SIGNALS.has(f.type) &&
+        f.inDocumentationContext !== true &&
+        isHighOrCritical(f));
+    if (!coSignal)
+        return null;
+    return { codeExec, coSignal };
+}
+/**
+ * Compare two scans of the same skill and classify the transition.
+ *
+ * Ordering is hostile → suspicious → benign so the strongest signal wins.
+ *
+ * @param previous  Scan of the prior (trusted) version.
+ * @param current   Scan of the incoming version.
+ * @param threshold Risk-score failure bar; defaults to {@link DEFAULT_RISK_THRESHOLD}.
+ *
+ *   CALLER CONTRACT (LOW-2): this value MUST equal the `riskThreshold` the
+ *   `SecurityScanner` instance used to produce BOTH `previous` and `current`
+ *   (i.e. the same `ScannerOptions.riskThreshold` — or the scanner's own
+ *   default of 40, which is why this parameter also defaults to
+ *   {@link DEFAULT_RISK_THRESHOLD}). `previouslyBenign` below is derived from
+ *   `previous.passed`, which was computed by the scanner against ITS OWN
+ *   `riskThreshold` at scan time — if the caller passes a `threshold` here
+ *   that differs from that value, `crossedThreshold`'s "did the score cross
+ *   the bar" signal and `previouslyBenign`'s "was it passing" signal are
+ *   reasoning about two different bars, and the hostile/suspicious/benign
+ *   verdict can disagree with what `previous.passed` / `current.passed`
+ *   would say under a freshly-run scan.
+ */
+export function compareScanReports(previous, current, threshold = DEFAULT_RISK_THRESHOLD) {
+    const newFindings = diffNewFindings(previous, current);
+    const riskDelta = current.riskScore - previous.riskScore;
+    const previouslyBenign = previous.passed === true;
+    const crossedThreshold = previous.riskScore < threshold && current.riskScore >= threshold;
+    const newHighCritical = newFindings.filter(isHighOrCritical);
+    // Mirror escalateCodeExecution's non-doc gate: a new high/critical finding that
+    // lives ONLY in a documentation context (a fenced example) is weak rug-pull
+    // evidence, so it does not on its own trip `hostile` — it falls to `suspicious`.
+    const newHighCriticalNonDoc = newHighCritical.filter((f) => f.inDocumentationContext !== true);
+    const newMedium = newFindings.filter((f) => f.severity === 'medium');
+    const materialDelta = riskDelta >= MATERIAL_RISK_DELTA;
+    // A new medium finding only signals a worsening when the overall risk actually
+    // rose. This suppresses the case where an old high finding was DOWNGRADED to
+    // medium (its medium variant is technically "new" under the severity-keyed diff,
+    // but the net change made the skill safer — riskDelta <= 0).
+    const mediumWorsening = newMedium.length > 0 && riskDelta > 0;
+    const scoreClause = `risk ${fmt(previous.riskScore)}->${fmt(current.riskScore)}`;
+    // ---- hostile: a benign→malicious flip ----------------------------------
+    if (previouslyBenign && (newHighCriticalNonDoc.length > 0 || crossedThreshold)) {
+        const supplyChain = detectSupplyChain(newFindings);
+        let reason;
+        if (supplyChain) {
+            reason =
+                `Rug-pull: previously-benign skill now ships a remote-execution command ` +
+                    `[${describeFinding(supplyChain.codeExec)}] co-occurring with a fresh ` +
+                    `${supplyChain.coSignal.type} signal [${describeFinding(supplyChain.coSignal)}] - ` +
+                    `classic supply-chain execution (${scoreClause}).`;
+        }
+        else if (newHighCriticalNonDoc.length > 0) {
+            const worst = highestSeverity(newHighCriticalNonDoc);
+            reason =
+                `Rug-pull: previously-benign skill introduced ${newHighCriticalNonDoc.length} new ` +
+                    `high/critical finding(s), e.g. ${describeFinding(worst)} (${scoreClause}).`;
+        }
+        else {
+            reason =
+                `Rug-pull: previously-benign skill's risk score crossed the failure bar ` +
+                    `(${fmt(previous.riskScore)} -> ${fmt(current.riskScore)} >= ${threshold}).`;
+        }
+        return { verdict: 'hostile', newFindings, riskDelta, reason };
+    }
+    // ---- suspicious: a worsening short of a benign→malicious flip -----------
+    if (newHighCritical.length > 0 || mediumWorsening || materialDelta) {
+        let reason;
+        if (newHighCritical.length > 0) {
+            const worst = highestSeverity(newHighCritical);
+            const base = previouslyBenign
+                ? `Update added ${newHighCritical.length} new high/critical finding(s) confined to a documentation context`
+                : `Already-flagged skill added ${newHighCritical.length} new high/critical finding(s) - a worsening, not a fresh benign->malicious transition`;
+            reason = `${base}, e.g. ${describeFinding(worst)} (${scoreClause}).`;
+        }
+        else if (newMedium.length > 0) {
+            reason =
+                `Update introduced ${newMedium.length} new medium finding(s) without reaching the ` +
+                    `hostile bar (${scoreClause}).`;
+        }
+        else {
+            reason =
+                `Risk score rose materially (${scoreClause}, delta ${signed(riskDelta)}) ` +
+                    `without any new high/critical findings.`;
+        }
+        return { verdict: 'suspicious', newFindings, riskDelta, reason };
+    }
+    // ---- benign: unchanged, reduced, or harmless churn ---------------------
+    let reason;
+    if (newFindings.length === 0) {
+        reason =
+            riskDelta < 0
+                ? `No new findings; risk score fell (${scoreClause}) - a safer revision or benign churn.`
+                : `No new findings and no risk increase (${scoreClause}) - content unchanged or benign churn.`;
+    }
+    else {
+        reason =
+            `No new high/critical findings and no threshold crossing (${scoreClause}); ` +
+                `${newFindings.length} minor new finding(s) below the suspicious bar.`;
+    }
+    return { verdict: 'benign', newFindings, riskDelta, reason };
+}
+//# sourceMappingURL=SecurityScanner.hostile-update.js.map

package/dist/src/security/scanner/SecurityScanner.hostile-update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.hostile-update.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.hostile-update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAUH;;;;GAIG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,CAAA;AAExC;;;GAGG;AACH,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B;;;;;;GAMG;AACH,MAAM,uBAAuB,GAAqC,IAAI,GAAG,CAAC;IACxE,mBAAmB;IACnB,sBAAsB;IACtB,gBAAgB;CACjB,CAAC,CAAA;AAEF,MAAM,cAAc,GAAqC;IACvD,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,CAAC;IACT,IAAI,EAAE,CAAC;IACP,QAAQ,EAAE,CAAC;CACZ,CAAA;AAED,SAAS,gBAAgB,CAAC,CAAkB;IAC1C,OAAO,CAAC,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAA;AAC3D,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,IAAwB;IAC7C,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAA;IACpB,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;AACvD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,CAAkB;IACpC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AACjG,CAAC;AAED,yEAAyE;AACzE,SAAS,eAAe,CAAC,QAAoB,EAAE,OAAmB;IAChE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAA;IAC/D,OAAO,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,eAAe,CAAC,QAA2B;IAClD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAClC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CACxE,CAAA;AACH,CAAC;AAED,qFAAqF;AACrF,SAAS,GAAG,CAAC,CAAS;IACpB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAA;IACvC,OAAO,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AACzE,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,CAAkB;IACzC,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAC9E,OAAO,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,MAAM,GAAG,EAAE,CAAA;AAC5C,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACxB,WAA8B;IAE9B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,sBAAsB,KAAK,IAAI,CACxE,CAAA;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAC/B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,KAAK,QAAQ;QACd,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,CAAC,CAAC,sBAAsB,KAAK,IAAI;QACjC,gBAAgB,CAAC,CAAC,CAAC,CACtB,CAAA;IACD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAA;IAE1B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAA;AAC/B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAoB,EACpB,OAAmB,EACnB,YAAoB,sBAAsB;IAE1C,MAAM,WAAW,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAA;IACtD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAA;IAExD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,MAAM,KAAK,IAAI,CAAA;IACjD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,SAAS,GAAG,SAAS,IAAI,OAAO,CAAC,SAAS,IAAI,SAAS,CAAA;IAEzF,MAAM,eAAe,GAAG,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;IAC5D,gFAAgF;IAChF,4EAA4E;IAC5E,iFAAiF;IACjF,MAAM,qBAAqB,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,sBAAsB,KAAK,IAAI,CAAC,CAAA;IAC9F,MAAM,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;IACpE,MAAM,aAAa,GAAG,SAAS,IAAI,mBAAmB,CAAA;IACtD,+EAA+E;IAC/E,6EAA6E;IAC7E,iFAAiF;IACjF,6DAA6D;IAC7D,MAAM,eAAe,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,CAAA;IAE7D,MAAM,WAAW,GAAG,QAAQ,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAA;IAEhF,2EAA2E;IAC3E,IAAI,gBAAgB,IAAI,CAAC,qBAAqB,CAAC,MAAM,GAAG,CAAC,IAAI,gBAAgB,CAAC,EAAE,CAAC;QAC/E,MAAM,WAAW,GAAG,iBAAiB,CAAC,WAAW,CAAC,CAAA;QAClD,IAAI,MAAc,CAAA;QAClB,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM;gBACJ,yEAAyE;oBACzE,IAAI,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,8BAA8B;oBACvE,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,YAAY,eAAe,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM;oBACnF,mCAAmC,WAAW,IAAI,CAAA;QACtD,CAAC;aAAM,IAAI,qBAAqB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5C,MAAM,KAAK,GAAG,eAAe,CAAC,qBAAqB,CAAC,CAAA;YACpD,MAAM;gBACJ,gDAAgD,qBAAqB,CAAC,MAAM,OAAO;oBACnF,kCAAkC,eAAe,CAAC,KAAK,CAAC,KAAK,WAAW,IAAI,CAAA;QAChF,CAAC;aAAM,CAAC;YACN,MAAM;gBACJ,yEAAyE;oBACzE,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,SAAS,IAAI,CAAA;QAChF,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAC/D,CAAC;IAED,4EAA4E;IAC5E,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,eAAe,IAAI,aAAa,EAAE,CAAC;QACnE,IAAI,MAAc,CAAA;QAClB,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,eAAe,CAAC,CAAA;YAC9C,MAAM,IAAI,GAAG,gBAAgB;gBAC3B,CAAC,CAAC,gBAAgB,eAAe,CAAC,MAAM,mEAAmE;gBAC3G,CAAC,CAAC,+BAA+B,eAAe,CAAC,MAAM,uFAAuF,CAAA;YAChJ,MAAM,GAAG,GAAG,IAAI,UAAU,eAAe,CAAC,KAAK,CAAC,KAAK,WAAW,IAAI,CAAA;QACtE,CAAC;aAAM,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM;gBACJ,qBAAqB,SAAS,CAAC,MAAM,8CAA8C;oBACnF,gBAAgB,WAAW,IAAI,CAAA;QACnC,CAAC;aAAM,CAAC;YACN,MAAM;gBACJ,+BAA+B,WAAW,WAAW,MAAM,CAAC,SAAS,CAAC,IAAI;oBAC1E,yCAAyC,CAAA;QAC7C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;IAClE,CAAC;IAED,2EAA2E;IAC3E,IAAI,MAAc,CAAA;IAClB,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM;YACJ,SAAS,GAAG,CAAC;gBACX,CAAC,CAAC,qCAAqC,WAAW,uCAAuC;gBACzF,CAAC,CAAC,yCAAyC,WAAW,wCAAwC,CAAA;IACpG,CAAC;SAAM,CAAC;QACN,MAAM;YACJ,4DAA4D,WAAW,KAAK;gBAC5E,GAAG,WAAW,CAAC,MAAM,iDAAiD,CAAA;IAC1E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,EAAE,CAAA;AAC9D,CAAC"}

package/dist/src/security/scanner/index.d.ts

@@ -3,9 +3,10 @@
  *
  * Re-exports for security scanning functionality.
  */
-export type { SecurityFindingType, SecuritySeverity, SecurityFinding, RiskScoreBreakdown, ScanReport, ScannerOptions, } from './types.js';
+export type { SecurityFindingType, SecuritySeverity, SecurityFinding, RiskScoreBreakdown, ScanReport, ScannerOptions, HostileUpdateVerdict, } from './types.js';
 export { DEFAULT_ALLOWED_DOMAINS, SENSITIVE_PATH_PATTERNS, JAILBREAK_PATTERNS, SUSPICIOUS_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, AI_DEFENCE_PATTERNS, SSRF_INSTRUCTION_PATTERNS, PII_PATTERNS, CODE_EXECUTION_PATTERNS, } from './patterns.js';
 export { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
 export { MAX_LINE_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck } from './regex-utils.js';
 export { SecurityScanner, default } from './SecurityScanner.js';
+export { compareScanReports, DEFAULT_RISK_THRESHOLD } from './SecurityScanner.hostile-update.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/security/scanner/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGjE,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAG3F,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,EACd,oBAAoB,GACrB,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGjE,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAG3F,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAG/D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}

package/dist/src/security/scanner/index.js

@@ -11,4 +11,6 @@ export { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
 export { MAX_LINE_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck } from './regex-utils.js';
 // Main class
 export { SecurityScanner, default } from './SecurityScanner.js';
+// Hostile-update comparator (SMI-5535, R0 Wave 2A)
+export { compareScanReports, DEFAULT_RISK_THRESHOLD } from './SecurityScanner.hostile-update.js';
 //# sourceMappingURL=index.js.map

package/dist/src/security/scanner/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAEtB,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEjE,0CAA0C;AAC1C,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAE3F,aAAa;AACb,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,EACZ,uBAAuB,GACxB,MAAM,eAAe,CAAA;AAEtB,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEjE,0CAA0C;AAC1C,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAE3F,aAAa;AACb,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA;AAE/D,mDAAmD;AACnD,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAA"}

package/dist/src/security/scanner/types.d.ts

@@ -68,6 +68,27 @@ export interface ScanReport {
     /** Breakdown of risk score by category */
     riskBreakdown: RiskScoreBreakdown;
 }
+/**
+ * Verdict returned by comparing two scans of the SAME skill to detect a
+ * benign→malicious "rug-pull" update (SMI-5535, R0 Wave 2A).
+ *
+ * - `hostile`    — a previously-passing skill introduced new high/critical
+ *   findings (or crossed the risk threshold): a genuine benign→malicious flip.
+ * - `suspicious` — the update added new medium findings or a material risk
+ *   increase, but did not meet the hostile bar (also covers an already-flagged
+ *   skill that got materially worse, which is a worsening — not a new rug-pull).
+ * - `benign`     — no new high/critical findings and no threshold crossing;
+ *   findings are unchanged, reduced, or only benign churn.
+ */
+export interface HostileUpdateVerdict {
+    verdict: 'benign' | 'suspicious' | 'hostile';
+    /** Findings present in the current scan but absent from the previous scan. */
+    newFindings: SecurityFinding[];
+    /** `current.riskScore - previous.riskScore` (positive = riskier). */
+    riskDelta: number;
+    /** One concrete human-readable sentence citing the deciding signal. */
+    reason: string;
+}
 /**
  * Configuration options for the security scanner
  */

package/dist/src/security/scanner/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,sBAAsB,CAAA;AAE1B;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,0IAA0I;IAC1I,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,SAAS,EAAE,IAAI,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,aAAa,EAAE,kBAAkB,CAAA;CAClC;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAC3B,KAAK,GACL,gBAAgB,GAChB,WAAW,GACX,oBAAoB,GACpB,oBAAoB,GACpB,gBAAgB,GAChB,mBAAmB,GACnB,sBAAsB,GACtB,YAAY,GACZ,MAAM,GACN,KAAK,GACL,gBAAgB,GAChB,sBAAsB,CAAA;AAE1B;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAA;AAErE;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEzD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,mBAAmB,CAAA;IACzB,QAAQ,EAAE,gBAAgB,CAAA;IAC1B,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,iFAAiF;IACjF,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,qEAAqE;IACrE,UAAU,CAAC,EAAE,iBAAiB,CAAA;IAC9B,0IAA0I;IAC1I,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAA;IACjB,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,MAAM,CAAA;IACrB,gBAAgB,EAAE,MAAM,CAAA;IACxB,mBAAmB,EAAE,MAAM,CAAA;IAC3B,cAAc,EAAE,MAAM,CAAA;IACtB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;IACX,aAAa,EAAE,MAAM,CAAA;IACrB,mBAAmB,EAAE,MAAM,CAAA;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,eAAe,EAAE,CAAA;IAC3B,SAAS,EAAE,IAAI,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;IACtB,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,aAAa,EAAE,kBAAkB,CAAA;CAClC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAA;IAC5C,8EAA8E;IAC9E,WAAW,EAAE,eAAe,EAAE,CAAA;IAC9B,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;IACjB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB"}

package/dist/src/services/skill-installation.io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installation.io.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAStE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ1E;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,aAAa,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC3D,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,kBAAkB,CAAC,CA0E7B;AAED,MAAM,WAAW,0BAA0B;IACzC,uEAAuE;IACvE,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAA;IACxD,4EAA4E;IAC5E,YAAY,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,cAAc,GAAG,IAAI,GACpC,OAAO,CAAC,0BAA0B,CAAC,CAgDrC"}
+{"version":3,"file":"skill-installation.io.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAStE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ1E;AAkBD,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,MAAM,CAAC,CAyBjB;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,aAAa,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC3D,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,kBAAkB,CAAC,CA0E7B;AAED,MAAM,WAAW,0BAA0B;IACzC,uEAAuE;IACvE,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAA;IACxD,4EAA4E;IAC5E,YAAY,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,cAAc,GAAG,IAAI,GACpC,OAAO,CAAC,0BAA0B,CAAC,CAgDrC"}

package/dist/src/services/skill-installation.io.js

@@ -17,13 +17,30 @@ export function assertNotEncrypted(content, filePath) {
             '" is git-crypt encrypted. The repository uses git-crypt and this file cannot be fetched from GitHub.');
     }
 }
+/**
+ * SMI-5582: per-request timeout for raw.githubusercontent.com fetches.
+ *
+ * This is THE critical-path GitHub fetch for a registry install: it is reached
+ * from `SkillInstallationService.install()` (SKILL.md) and from
+ * `fetchAndScanOptionalFiles` (up to 7 optional files), each with a possible
+ * `main`→`master` fallback — i.e. up to ~16 sequential network calls per
+ * skill. Before SMI-5582 none of them were bounded, so a single hung GitHub
+ * socket could stall the caller indefinitely. Since Tier-1 auto-install now
+ * runs this chain at server startup, an unbounded fetch here is what would
+ * have hung MCP startup. 10s matches the "generous but finite" budget of the
+ * other startup network paths (`version-check.ts` uses 3s for a single npm
+ * ping; this is a heavier raw-content fetch, hence the larger bound).
+ */
+const GITHUB_FETCH_TIMEOUT_MS = 10_000;
 export async function fetchFromGitHub(owner, repo, filePath, branch = 'main') {
     const url = 'https://raw.githubusercontent.com/' + owner + '/' + repo + '/' + branch + '/' + filePath;
-    const response = await fetch(url);
+    const response = await fetch(url, { signal: AbortSignal.timeout(GITHUB_FETCH_TIMEOUT_MS) });
     if (!response.ok) {
         if (branch === 'main') {
             const masterUrl = 'https://raw.githubusercontent.com/' + owner + '/' + repo + '/master/' + filePath;
-            const masterResponse = await fetch(masterUrl);
+            const masterResponse = await fetch(masterUrl, {
+                signal: AbortSignal.timeout(GITHUB_FETCH_TIMEOUT_MS),
+            });
             if (!masterResponse.ok) {
                 throw new Error('Failed to fetch ' + filePath + ': ' + response.status);
             }

package/dist/src/services/skill-installation.io.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installation.io.js","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kCAAkC,EAClC,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAEvC,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,QAAgB;IAClE,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,QAAQ;YACN,QAAQ;YACR,sGAAsG,CACzG,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,SAAiB,MAAM;IAEvB,MAAM,GAAG,GACP,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAA;IAC3F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IAEjC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,SAAS,GACb,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,UAAU,GAAG,QAAQ,CAAA;YACnF,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAA;YAC7C,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;YACzE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;YAC9C,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YACxC,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAElE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACrC,IAAI,KAAK,CAAC,KAAK,GAAG,WAAW,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,SAAiB,EACjB,SAAiB,EACjB,iBAAyB,EACzB,aAA2D,EAC3D,eAAmC;IAEnC,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,IAAI,YAAgC,CAAA;IACpC,mFAAmF;IACnF,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,6CAA6C;IAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACjD,IACE,eAAe,KAAK,iBAAiB;QACrC,CAAC,eAAe,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,WAAW,CAAC,CAAA;IACpF,CAAC;IACD,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,8BAA8B;IAC9B,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,uFAAuF;QACvF,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QACxF,IACE,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;YACtD,eAAe,KAAK,cAAc,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,GAAG,WAAW,CAAC,CAAA;QACrF,CAAC;QACD,aAAa,GAAG,IAAI,CAAA;QAEpB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACxD,MAAM,aAAa,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;QACrD,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAChC,+BAA+B;QAC/B,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;gBACzD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAC9C,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC5B,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QACD,wCAAwC;QACxC,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;YAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9C,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAA;YACjE,MAAM,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;YAClD,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,8EAA8E;QAC9E,wCAAwC;QACxC,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;QACD,+EAA+E;QAC/E,oFAAoF;QACpF,8EAA8E;QAC9E,gFAAgF;QAChF,mFAAmF;QACnF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,UAAU,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAA;AACvC,CAAC;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,OAAe,EACf,cAAqC;IAErC,MAAM,mBAAmB,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,WAAW,GAAgD,EAAE,CAAA;IACnE,MAAM,YAAY,GAAiD,EAAE,CAAA;IACrE,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,SAAQ;QACV,CAAC;QACD,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAC3C,4EAA4E;YAC5E,8CAA8C;YAC9C,IAAI,UAAyB,CAAA;YAC7B,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAA;gBAC7D,oEAAoE;gBACpE,UAAU,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;YACtD,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,OAAO,CAAA;YACtB,CAAC;YACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,UAAU,CAAC,CAAA;gBAC3E,yEAAyE;gBACzE,yEAAyE;gBACzE,sEAAsE;gBACtE,kEAAkE;gBAClE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/B,sEAAsE;oBACtE,IAAI,SAAS,KAAK,KAAK;wBAAE,SAAQ;oBACjC,mEAAmE;oBACnE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;oBAC5C,SAAQ;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,CAAC,WAAW,CAAC,KAAK;gBAAE,SAAQ,CAAC,gCAAgC;YACjE,cAAc,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AACtD,CAAC"}
+{"version":3,"file":"skill-installation.io.js","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kCAAkC,EAClC,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAEvC,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,QAAgB;IAClE,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,QAAQ;YACN,QAAQ;YACR,sGAAsG,CACzG,CAAA;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAEtC,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,SAAiB,MAAM;IAEvB,MAAM,GAAG,GACP,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAA;IAC3F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAA;IAE3F,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,SAAS,GACb,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,UAAU,GAAG,QAAQ,CAAA;YACnF,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;gBAC5C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC;aACrD,CAAC,CAAA;YACF,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;YACzE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;YAC9C,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YACxC,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAElE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACrC,IAAI,KAAK,CAAC,KAAK,GAAG,WAAW,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,SAAiB,EACjB,SAAiB,EACjB,iBAAyB,EACzB,aAA2D,EAC3D,eAAmC;IAEnC,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,IAAI,YAAgC,CAAA;IACpC,mFAAmF;IACnF,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,6CAA6C;IAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACjD,IACE,eAAe,KAAK,iBAAiB;QACrC,CAAC,eAAe,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,WAAW,CAAC,CAAA;IACpF,CAAC;IACD,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,8BAA8B;IAC9B,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,uFAAuF;QACvF,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QACxF,IACE,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;YACtD,eAAe,KAAK,cAAc,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,GAAG,WAAW,CAAC,CAAA;QACrF,CAAC;QACD,aAAa,GAAG,IAAI,CAAA;QAEpB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACxD,MAAM,aAAa,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;QACrD,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAChC,+BAA+B;QAC/B,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;gBACzD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAC9C,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC5B,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QACD,wCAAwC;QACxC,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;YAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9C,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAA;YACjE,MAAM,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;YAClD,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,8EAA8E;QAC9E,wCAAwC;QACxC,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;QACD,+EAA+E;QAC/E,oFAAoF;QACpF,8EAA8E;QAC9E,gFAAgF;QAChF,mFAAmF;QACnF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,UAAU,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAA;AACvC,CAAC;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,OAAe,EACf,cAAqC;IAErC,MAAM,mBAAmB,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,WAAW,GAAgD,EAAE,CAAA;IACnE,MAAM,YAAY,GAAiD,EAAE,CAAA;IACrE,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,SAAQ;QACV,CAAC;QACD,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAC3C,4EAA4E;YAC5E,8CAA8C;YAC9C,IAAI,UAAyB,CAAA;YAC7B,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAA;gBAC7D,oEAAoE;gBACpE,UAAU,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;YACtD,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,OAAO,CAAA;YACtB,CAAC;YACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,UAAU,CAAC,CAAA;gBAC3E,yEAAyE;gBACzE,yEAAyE;gBACzE,sEAAsE;gBACtE,kEAAkE;gBAClE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/B,sEAAsE;oBACtE,IAAI,SAAS,KAAK,KAAK;wBAAE,SAAQ;oBACjC,mEAAmE;oBACnE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;oBAC5C,SAAQ;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,CAAC,WAAW,CAAC,KAAK;gBAAE,SAAQ,CAAC,gCAAgC;YACjE,cAAc,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AACtD,CAAC"}

package/dist/src/sync/access-token.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Shared device-session access-token resolver (SMI-5541, extracted from
+ * SMI-5392 `inventory-client.ts`).
+ *
+ * Both the inventory upload/purge client and the audit-notify client need to
+ * resolve a fresh access token from the stored device-login credentials,
+ * transparently refreshing (and persisting) one that is within
+ * {@link TOKEN_REFRESH_SKEW_MS} of expiry. This is security-sensitive logic
+ * (token refresh + persistence), so it lives in exactly one place; each caller
+ * supplies its own namespaced "not authenticated" error via `makeAuthError` so
+ * the shared helper stays error-type-agnostic.
+ *
+ * @module @skillsmith/core/sync/access-token
+ */
+/** Refresh the access token this many ms before it actually expires. */
+export declare const TOKEN_REFRESH_SKEW_MS = 60000;
+/**
+ * Resolve a fresh access token, refreshing (and persisting) if the stored one
+ * is within {@link TOKEN_REFRESH_SKEW_MS} of expiry.
+ *
+ * @param makeAuthError - Factory for the caller's namespaced auth error, thrown
+ *   when there are no stored credentials or the refresh fails. Kept as a factory
+ *   (not a value) so the stack originates at the throw site.
+ * @throws Whatever `makeAuthError()` returns, on no/expired-unrefreshable session.
+ */
+export declare function resolveAccessToken(makeAuthError: () => Error): Promise<string>;
+//# sourceMappingURL=access-token.d.ts.map

package/dist/src/sync/access-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../../../src/sync/access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAQH,wEAAwE;AACxE,eAAO,MAAM,qBAAqB,QAAS,CAAA;AAE3C;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CAAC,aAAa,EAAE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAYpF"}

package/dist/src/sync/access-token.js

@@ -0,0 +1,40 @@
+/**
+ * Shared device-session access-token resolver (SMI-5541, extracted from
+ * SMI-5392 `inventory-client.ts`).
+ *
+ * Both the inventory upload/purge client and the audit-notify client need to
+ * resolve a fresh access token from the stored device-login credentials,
+ * transparently refreshing (and persisting) one that is within
+ * {@link TOKEN_REFRESH_SKEW_MS} of expiry. This is security-sensitive logic
+ * (token refresh + persistence), so it lives in exactly one place; each caller
+ * supplies its own namespaced "not authenticated" error via `makeAuthError` so
+ * the shared helper stays error-type-agnostic.
+ *
+ * @module @skillsmith/core/sync/access-token
+ */
+import { loadCredentials, refreshAccessToken, storeCredentials, } from '../config/token-credentials.js';
+/** Refresh the access token this many ms before it actually expires. */
+export const TOKEN_REFRESH_SKEW_MS = 60_000;
+/**
+ * Resolve a fresh access token, refreshing (and persisting) if the stored one
+ * is within {@link TOKEN_REFRESH_SKEW_MS} of expiry.
+ *
+ * @param makeAuthError - Factory for the caller's namespaced auth error, thrown
+ *   when there are no stored credentials or the refresh fails. Kept as a factory
+ *   (not a value) so the stack originates at the throw site.
+ * @throws Whatever `makeAuthError()` returns, on no/expired-unrefreshable session.
+ */
+export async function resolveAccessToken(makeAuthError) {
+    const creds = await loadCredentials();
+    if (!creds)
+        throw makeAuthError();
+    if (creds.expiresAt <= Date.now() + TOKEN_REFRESH_SKEW_MS) {
+        const refreshed = await refreshAccessToken(creds.refreshToken);
+        if (!refreshed)
+            throw makeAuthError();
+        await storeCredentials(refreshed);
+        return refreshed.accessToken;
+    }
+    return creds.accessToken;
+}
+//# sourceMappingURL=access-token.js.map

package/dist/src/sync/access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../../../src/sync/access-token.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAEvC,wEAAwE;AACxE,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAE3C;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,aAA0B;IACjE,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,MAAM,aAAa,EAAE,CAAA;IAEjC,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAC9D,IAAI,CAAC,SAAS;YAAE,MAAM,aAAa,EAAE,CAAA;QACrC,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;QACjC,OAAO,SAAS,CAAC,WAAW,CAAA;IAC9B,CAAC;IAED,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC"}

package/dist/src/sync/audit-notify-client.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Audit-digest push client (SMI-5541 Wave 2C Stage 2, Option 1).
+ *
+ * The security audit runs CLIENT-side (the inventory data plane is
+ * metadata-only, ADR-124), so the digest's email channel is a thin push: this
+ * client authenticates with the stored device-login session and POSTs a
+ * COMPACT findings summary — never raw skill content — to the gateway-verified
+ * `audit-notify` edge function, which gates on consent + a verified email
+ * server-side and sends the email via Resend.
+ *
+ * The payload contract here is the client-side twin of the edge function's
+ * `parseDigest`: `{ scanned, hostile, malicious, suspicious, findings }`, each
+ * finding `{ identifier, kind, verdict, reason }`. Defined independently in
+ * `@skillsmith/core` (which must not depend on `@skillsmith/mcp-server`); the
+ * mapping from a `RunSecurityAuditResult` into this shape lives in
+ * `@skillsmith/mcp-server/audit` (`buildAuditDigestPayload`), which can see
+ * both types.
+ *
+ * @module @skillsmith/core/sync/audit-notify-client
+ */
+/** The three security verdicts the digest carries (mirrors the edge fn). */
+export type AuditDigestVerdict = 'hostile' | 'malicious' | 'suspicious';
+/** One compact finding in a pushed digest. Carries NO raw skill content. */
+export interface AuditDigestPushFinding {
+    /** Skill/command/agent identifier (e.g. `author/name`). */
+    identifier: string;
+    /** Inventory kind (`skill` | `command` | `agent`). */
+    kind: string;
+    verdict: AuditDigestVerdict;
+    /** One human-readable sentence citing the deciding signal. */
+    reason: string;
+}
+/** The compact digest pushed to `audit-notify`. Mirrors the edge fn's parser. */
+export interface AuditDigestPushPayload {
+    scanned: number;
+    hostile: number;
+    malicious: number;
+    suspicious: number;
+    findings: AuditDigestPushFinding[];
+}
+/**
+ * Outcome of a push. `ok`/`sent`/`reason` mirror the edge function's 200-body
+ * shapes so callers can render a precise message without re-deriving:
+ *   - `{ ok: true,  sent: true }`                         — email dispatched.
+ *   - `{ ok: true,  sent: false, reason: 'nothing_to_report' }`
+ *   - `{ ok: false, reason: 'not_consented' | 'email_not_verified' | 'no_email' }`
+ *   - `{ ok: false, sent: false, reason: 'email_send_failed' }`
+ */
+export interface AuditDigestPushResult {
+    ok: boolean;
+    sent: boolean;
+    reason?: string;
+}
+/**
+ * No usable device session. The message hints at the recovery action so the
+ * CLI/MCP surface can relay it.
+ */
+export declare class AuditNotifyAuthError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Catch-all for transport failures and unexpected server responses (HTTP 5xx,
+ * 400 `invalid_payload`, network errors, unparseable bodies).
+ */
+export declare class AuditNotifyError extends Error {
+    constructor(message: string);
+}
+/**
+ * Push a compact audit digest to the `audit-notify` edge function.
+ *
+ * A `200` response is returned verbatim as an {@link AuditDigestPushResult} —
+ * this INCLUDES the consent-off `{ ok: false, reason: 'not_consented' }` and
+ * the `{ ok: true, sent: false, reason: 'nothing_to_report' }` no-ops, which
+ * are successful round-trips, not errors.
+ *
+ * @param payload - The compact digest (never raw content).
+ * @returns The edge function's outcome.
+ * @throws {AuditNotifyAuthError} HTTP 401, or no/expired session.
+ * @throws {AuditNotifyError} HTTP 400/5xx, network failure, or unparseable 200 body.
+ * @see SMI-5541
+ */
+export declare function sendAuditDigest(payload: AuditDigestPushPayload): Promise<AuditDigestPushResult>;
+//# sourceMappingURL=audit-notify-client.d.ts.map

package/dist/src/sync/audit-notify-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-notify-client.d.ts","sourceRoot":"","sources":["../../../src/sync/audit-notify-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAKH,4EAA4E;AAC5E,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAA;AAEvE,4EAA4E;AAC5E,MAAM,WAAW,sBAAsB;IACrC,2DAA2D;IAC3D,UAAU,EAAE,MAAM,CAAA;IAClB,sDAAsD;IACtD,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,kBAAkB,CAAA;IAC3B,8DAA8D;IAC9D,MAAM,EAAE,MAAM,CAAA;CACf;AAED,iFAAiF;AACjF,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,sBAAsB,EAAE,CAAA;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,OAAO,CAAA;IACX,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;GAGG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAA6D;CAIjF;AAED;;;GAGG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI5B;AAkBD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA2DhC"}