@skillsmith/core 0.11.4 → 0.11.6

package/dist/src/services/skill-installation.types.d.ts

@@ -8,6 +8,7 @@
 import type { ScanReport, ScannerOptions } from '../security/index.js';
 import type { TrustTier } from '../types/skill.js';
 import type { DependencyDeclaration } from '../types/dependencies.js';
+import type { ClientId } from '../install/paths.js';
 /**
  * Callback invoked during install/uninstall to report progress.
  * CLI wires this to an `ora` spinner; mcp-server wires to MCP notifications.
@@ -15,6 +16,39 @@ import type { DependencyDeclaration } from '../types/dependencies.js';
 export type ProgressCallback = (stage: string, detail: string) => void;
 /** Action to take when a conflict is detected during skill update */
 export type ConflictAction = 'overwrite' | 'merge' | 'cancel';
+/**
+ * SMI-5905: a packaged skill's files as a flat { relativePath: fileText } map,
+ * e.g. `{ "SKILL.md": "...", "scripts/foo.sh": "..." }`.
+ *
+ * Deliberately duplicated (not imported) from the mcp-server's own
+ * `SkillContent` (zod-inferred in `registry-tools.ts`) — core cannot depend
+ * on mcp-server. Keep the shape in sync if it ever changes.
+ */
+export type SkillContent = Record<string, string>;
+/**
+ * Options for `installFromContent()` — the content-based install path used by
+ * private-registry installs (SMI-5905). Distinct from `InstallOptions` (used
+ * by the GitHub-fetch `install()` path): the caller has already resolved
+ * `skillId`/`version`/`content` (e.g. via a registry `getContent()` call one
+ * layer up) rather than supplying a skillId for `install()` to resolve itself.
+ */
+export interface InstallFromContentOptions {
+    /** Registry skill ID (author/name format) this content was published under. */
+    skillId: string;
+    /**
+     * Already-resolved semver version string. `installFromContent()` does not
+     * choose a version itself — the caller resolves "no version specified"
+     * (defaulting to the most-recently-published version) before calling this,
+     * mirroring `registry-tools.live.ts`'s `get(teamId, skillId, version)`
+     * convention, so `install` and `get` never disagree about what "no
+     * version specified" means.
+     */
+    version: string;
+    /** Packaged skill files; must include a non-empty `"SKILL.md"` entry. */
+    content: SkillContent;
+    /** Force reinstall if the skill is already installed (mirrors `InstallOptions.force`). */
+    force?: boolean;
+}
 /** Options for the install operation */
 export interface InstallOptions {
     /** Force reinstall if the skill already exists */
@@ -63,7 +97,7 @@ export interface OptimizationInfo {
  * stable across releases. Adding a new code requires (a) a real new failure
  * return path and (b) updating downstream funnel queries.
  */
-export type InstallErrorCode = 'REGISTRY_LOOKUP_UNAVAILABLE' | 'REGISTRY_SKILL_NOT_FOUND' | 'QUARANTINED' | 'ALREADY_INSTALLED' | 'FETCH_FAILED' | 'VALIDATION_FAILED' | 'SKIP_SCAN_FORBIDDEN' | 'SCAN_REJECTED' | 'CONFIRMATION_REQUIRED' | 'UNKNOWN';
+export type InstallErrorCode = 'REGISTRY_LOOKUP_UNAVAILABLE' | 'REGISTRY_SKILL_NOT_FOUND' | 'QUARANTINED' | 'ALREADY_INSTALLED' | 'FETCH_FAILED' | 'VALIDATION_FAILED' | 'SKIP_SCAN_FORBIDDEN' | 'SCAN_REJECTED' | 'CONFIRMATION_REQUIRED' | 'INVALID_CONTENT' | 'UNKNOWN';
 /** Result of an install operation */
 export interface InstallResult {
     success: boolean;
@@ -143,6 +177,13 @@ export interface SkillManifestEntry {
     pinnedVersion?: string;
     /** How updates are handled */
     updatePolicy?: 'auto' | 'manual' | 'never';
+    /**
+     * SMI-5894 (Wave 1 Step 3): which client this installation targets.
+     * Absent on manifest entries written before multi-client re-keying —
+     * treat a missing value as the canonical client (`claude-code`), matching
+     * `manifestKeyFor()`'s own default.
+     */
+    client?: ClientId;
 }
 /** Manifest tracking all installed skills */
 export interface SkillManifest {

package/dist/src/services/skill-installation.types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installation.types.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AAMrE;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;AAMtE,qEAAqE;AACrE,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAA;AAE7D,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,wEAAwE;IACxE,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,kFAAkF;IAClF,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,8DAA8D;IAC9D,YAAY,EAAE,qBAAqB,GAAG,SAAS,CAAA;IAC/C,+DAA+D;IAC/D,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,SAAS,EAAE,OAAO,CAAA;IAClB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,0BAA0B;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,2BAA2B;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB,6BAA6B,GAC7B,0BAA0B,GAC1B,aAAa,GACb,mBAAmB,GACnB,cAAc,GACd,mBAAmB,GACnB,qBAAqB,GACrB,eAAe,GACf,uBAAuB,GACvB,SAAS,CAAA;AAEb,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,UAAU,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAA;IAC5B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,wDAAwD;IACxD,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4DAA4D;IAC5D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED,8DAA8D;AAC9D,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,CAAA;AAErD,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,MAAM,EAAE;QACrB,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,OAAO,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;QACrC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAMD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAMD,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oBAAoB;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;CAC3C;AAED,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;CACpD;AAMD,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,SAAS,CAAA;IACpB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;CAC3D;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAClD;AAMD,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,CAkCxE,CAAA"}
+{"version":3,"file":"skill-installation.types.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AACtE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAA;AACrE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAMnD;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,IAAI,CAAA;AAMtE,qEAAqE;AACrE,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAA;AAE7D;;;;;;;GAOG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;AAEjD;;;;;;GAMG;AACH,MAAM,WAAW,yBAAyB;IACxC,+EAA+E;IAC/E,OAAO,EAAE,MAAM,CAAA;IACf;;;;;;;OAOG;IACH,OAAO,EAAE,MAAM,CAAA;IACf,yEAAyE;IACzE,OAAO,EAAE,YAAY,CAAA;IACrB,0FAA0F;IAC1F,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,wEAAwE;IACxE,YAAY,CAAC,EAAE,OAAO,CAAA;IACtB,2DAA2D;IAC3D,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,kFAAkF;IAClF,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,qDAAqD;AACrD,MAAM,WAAW,cAAc;IAC7B,mDAAmD;IACnD,oBAAoB,EAAE,MAAM,EAAE,CAAA;IAC9B,8DAA8D;IAC9D,YAAY,EAAE,qBAAqB,GAAG,SAAS,CAAA;IAC/C,+DAA+D;IAC/D,YAAY,EAAE,MAAM,EAAE,CAAA;CACvB;AAED,uDAAuD;AACvD,MAAM,WAAW,gBAAgB;IAC/B,kCAAkC;IAClC,SAAS,EAAE,OAAO,CAAA;IAClB,qCAAqC;IACrC,SAAS,CAAC,EAAE,MAAM,EAAE,CAAA;IACpB,+CAA+C;IAC/C,iBAAiB,CAAC,EAAE,OAAO,CAAA;IAC3B,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2CAA2C;IAC3C,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,0BAA0B;IAC1B,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,2BAA2B;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GACxB,6BAA6B,GAC7B,0BAA0B,GAC1B,aAAa,GACb,mBAAmB,GACnB,cAAc,GACd,mBAAmB,GACnB,qBAAqB,GACrB,eAAe,GACf,uBAAuB,GACvB,iBAAiB,GACjB,SAAS,CAAA;AAEb,qCAAqC;AACrC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,cAAc,CAAC,EAAE,UAAU,CAAA;IAC3B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,SAAS,CAAC,EAAE,gBAAgB,CAAA;IAC5B,4CAA4C;IAC5C,SAAS,CAAC,EAAE,SAAS,CAAA;IACrB,wDAAwD;IACxD,YAAY,CAAC,EAAE,gBAAgB,CAAA;IAC/B,6DAA6D;IAC7D,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,cAAc,CAAA;IACzB,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAA;IAC7B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,8EAA8E;IAC9E,oBAAoB,CAAC,EAAE,OAAO,CAAA;IAC9B,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,4DAA4D;IAC5D,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;CAC3B;AAED,8DAA8D;AAC9D,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,UAAU,CAAA;AAErD,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,MAAM,EAAE;QACrB,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,OAAO,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAA;QACrC,iBAAiB,CAAC,EAAE,OAAO,CAAA;KAC5B,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAClB;AAMD,0CAA0C;AAC1C,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,KAAK,CAAC,EAAE,OAAO,CAAA;CAChB;AAED,uCAAuC;AACvC,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAMD,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,0EAA0E;IAC1E,mBAAmB,CAAC,EAAE,MAAM,CAAA;IAC5B,iDAAiD;IACjD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,oBAAoB;IACpB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,8BAA8B;IAC9B,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAA;IAC1C;;;;;OAKG;IACH,MAAM,CAAC,EAAE,QAAQ,CAAA;CAClB;AAED,6CAA6C;AAC7C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAA;CACpD;AAMD,0CAA0C;AAC1C,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,SAAS,CAAA;IACpB,6CAA6C;IAC7C,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB,kEAAkE;IAClE,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAAA;CAC3D;AAED;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,uBAAuB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;CAClD;AAMD,iDAAiD;AACjD,eAAO,MAAM,0BAA0B,EAAE,MAAM,CAAC,SAAS,EAAE,cAAc,CAkCxE,CAAA"}

package/dist/src/services/skill-installation.types.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installation.types.js","sourceRoot":"","sources":["../../../src/services/skill-installation.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA6NH,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,iDAAiD;AACjD,MAAM,CAAC,MAAM,0BAA0B,GAAsC;IAC3E,QAAQ,EAAE;QACR,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,SAAS;KAC5B;IACD,OAAO,EAAE;QACP,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,SAAS;KAC5B;IACD,SAAS,EAAE;QACT,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,SAAS;KAC5B;IACD,KAAK,EAAE;QACL,aAAa,EAAE,GAAG;QAClB,gBAAgB,EAAE,UAAU;KAC7B;IACD,YAAY,EAAE;QACZ,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,OAAO;KAC1B;IACD,OAAO,EAAE;QACP,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,OAAO;KAC1B;IACD,6BAA6B;IAC7B,QAAQ,EAAE;QACR,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,SAAS;KAC5B;IACD,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,EAAE,+DAA+D;QAClF,gBAAgB,EAAE,OAAO;KAC1B;CACF,CAAA"}
+{"version":3,"file":"skill-installation.types.js","sourceRoot":"","sources":["../../../src/services/skill-installation.types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAyQH,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E,iDAAiD;AACjD,MAAM,CAAC,MAAM,0BAA0B,GAAsC;IAC3E,QAAQ,EAAE;QACR,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,SAAS;KAC5B;IACD,OAAO,EAAE;QACP,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,SAAS;KAC5B;IACD,SAAS,EAAE;QACT,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,SAAS;KAC5B;IACD,KAAK,EAAE;QACL,aAAa,EAAE,GAAG;QAClB,gBAAgB,EAAE,UAAU;KAC7B;IACD,YAAY,EAAE;QACZ,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,OAAO;KAC1B;IACD,OAAO,EAAE;QACP,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,OAAO;KAC1B;IACD,6BAA6B;IAC7B,QAAQ,EAAE;QACR,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,SAAS;KAC5B;IACD,UAAU,EAAE;QACV,aAAa,EAAE,EAAE,EAAE,+DAA+D;QAClF,gBAAgB,EAAE,OAAO;KAC1B;CACF,CAAA"}

package/dist/src/services/skill-manifest.d.ts

@@ -11,7 +11,28 @@ import type { SkillManifest } from './skill-installation.types.js';
 export declare class ManifestManager {
     private readonly manifestPath;
     constructor(manifestPath: string);
+    /**
+     * SMI-6007: distinguishes "no manifest yet" (ENOENT — legitimate first-run
+     * case, safe to synthesize an empty manifest) from "a manifest file exists
+     * but couldn't be read/parsed" (corrupt JSON, permission error, I/O
+     * failure). The latter used to be silently swallowed into the same empty
+     * manifest, which is a real data-loss risk: a caller that then `save()`s
+     * that empty snapshot back out would erase every previously-recorded
+     * install. Now it throws loudly instead, so a corrupt manifest surfaces as
+     * an error rather than silently wiping state on the next write.
+     */
     load(): Promise<SkillManifest>;
+    /**
+     * SMI-6007: the temp filename now includes a `randomUUID()` suffix (not
+     * just `process.pid`) — two concurrent `save()` calls in the same process
+     * previously collided on an identical `.tmp.<pid>` path, letting one
+     * call's temp file win the write while the other's `rename()` either
+     * clobbered it mid-flight or failed outright. Each call now owns a
+     * uniquely-named temp file for its own lifetime. The write+rename is
+     * wrapped in try/catch so a failure best-effort removes only *this
+     * invocation's* temp file before rethrowing the original error (mirrors
+     * `sqljsDriver.ts`'s `persist()`, SMI-5997) — the error is never swallowed.
+     */
     save(manifest: SkillManifest): Promise<void>;
     acquireLock(): Promise<void>;
     releaseLock(): Promise<void>;

package/dist/src/services/skill-manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-manifest.d.ts","sourceRoot":"","sources":["../../../src/services/skill-manifest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAKlE;;;GAGG;AACH,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,MAAM;IAE3C,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;IAS9B,IAAI,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5C,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IA+B5B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAUxF"}
+{"version":3,"file":"skill-manifest.d.ts","sourceRoot":"","sources":["../../../src/services/skill-manifest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,+BAA+B,CAAA;AAKlE;;;GAGG;AACH,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAAZ,YAAY,EAAE,MAAM;IAEjD;;;;;;;;;OASG;IACG,IAAI,IAAI,OAAO,CAAC,aAAa,CAAC;IAuBpC;;;;;;;;;;OAUG;IACG,IAAI,CAAC,QAAQ,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB5C,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IA+B5B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,YAAY,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,aAAa,KAAK,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;CAUxF"}

package/dist/src/services/skill-manifest.js

@@ -5,6 +5,7 @@
  */
 import * as fs from 'fs/promises';
 import * as path from 'path';
+import { randomUUID } from 'node:crypto';
 const MANIFEST_LOCK_TIMEOUT_MS = 30000;
 const MANIFEST_LOCK_RETRY_MS = 100;
 /**
@@ -16,20 +17,64 @@ export class ManifestManager {
     constructor(manifestPath) {
         this.manifestPath = manifestPath;
     }
+    /**
+     * SMI-6007: distinguishes "no manifest yet" (ENOENT — legitimate first-run
+     * case, safe to synthesize an empty manifest) from "a manifest file exists
+     * but couldn't be read/parsed" (corrupt JSON, permission error, I/O
+     * failure). The latter used to be silently swallowed into the same empty
+     * manifest, which is a real data-loss risk: a caller that then `save()`s
+     * that empty snapshot back out would erase every previously-recorded
+     * install. Now it throws loudly instead, so a corrupt manifest surfaces as
+     * an error rather than silently wiping state on the next write.
+     */
     async load() {
+        let content;
+        try {
+            content = await fs.readFile(this.manifestPath, 'utf-8');
+        }
+        catch (error) {
+            if (error.code === 'ENOENT') {
+                return { version: '1.0.0', installedSkills: {} };
+            }
+            throw error;
+        }
         try {
-            const content = await fs.readFile(this.manifestPath, 'utf-8');
             return JSON.parse(content);
         }
-        catch {
-            return { version: '1.0.0', installedSkills: {} };
+        catch (error) {
+            throw new Error('Manifest file at ' +
+                this.manifestPath +
+                ' exists but is corrupt/unparseable: ' +
+                (error instanceof Error ? error.message : String(error)));
         }
     }
+    /**
+     * SMI-6007: the temp filename now includes a `randomUUID()` suffix (not
+     * just `process.pid`) — two concurrent `save()` calls in the same process
+     * previously collided on an identical `.tmp.<pid>` path, letting one
+     * call's temp file win the write while the other's `rename()` either
+     * clobbered it mid-flight or failed outright. Each call now owns a
+     * uniquely-named temp file for its own lifetime. The write+rename is
+     * wrapped in try/catch so a failure best-effort removes only *this
+     * invocation's* temp file before rethrowing the original error (mirrors
+     * `sqljsDriver.ts`'s `persist()`, SMI-5997) — the error is never swallowed.
+     */
     async save(manifest) {
         await fs.mkdir(path.dirname(this.manifestPath), { recursive: true });
-        const tempPath = this.manifestPath + '.tmp.' + process.pid;
-        await fs.writeFile(tempPath, JSON.stringify(manifest, null, 2));
-        await fs.rename(tempPath, this.manifestPath);
+        const tempPath = this.manifestPath + '.tmp.' + process.pid + '.' + randomUUID();
+        try {
+            await fs.writeFile(tempPath, JSON.stringify(manifest, null, 2));
+            await fs.rename(tempPath, this.manifestPath);
+        }
+        catch (error) {
+            try {
+                await fs.unlink(tempPath);
+            }
+            catch {
+                // best-effort cleanup — surface the original error either way
+            }
+            throw error;
+        }
     }
     async acquireLock() {
         const lockPath = this.manifestPath + '.lock';

package/dist/src/services/skill-manifest.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-manifest.js","sourceRoot":"","sources":["../../../src/services/skill-manifest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAI5B,MAAM,wBAAwB,GAAG,KAAK,CAAA;AACtC,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAElC;;;GAGG;AACH,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,YAAoB;QAApB,iBAAY,GAAZ,YAAY,CAAQ;IAAG,CAAC;IAErD,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;YAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;QAClD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAuB;QAChC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,CAAA;QAC1D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;QAC/D,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IAC9C,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAE5B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAEpE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,wBAAwB,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;gBACjE,OAAM;YACR,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvD,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;wBACrC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,GAAG,wBAAwB,EAAE,CAAC;4BAC1D,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;4BACzC,SAAQ;wBACV,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,SAAQ;oBACV,CAAC;oBACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAA;gBAC7E,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,wBAAwB,GAAG,IAAI,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,CAAA;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAoD;QACrE,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"skill-manifest.js","sourceRoot":"","sources":["../../../src/services/skill-manifest.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC,MAAM,wBAAwB,GAAG,KAAK,CAAA;AACtC,MAAM,sBAAsB,GAAG,GAAG,CAAA;AAElC;;;GAGG;AACH,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,YAAoB;QAApB,iBAAY,GAAZ,YAAY,CAAQ;IAAG,CAAC;IAErD;;;;;;;;;OASG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;QACzD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAA;YAClD,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;QAED,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CACb,mBAAmB;gBACjB,IAAI,CAAC,YAAY;gBACjB,sCAAsC;gBACtC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAC3D,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;;OAUG;IACH,KAAK,CAAC,IAAI,CAAC,QAAuB;QAChC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,GAAG,OAAO,GAAG,OAAO,CAAC,GAAG,GAAG,GAAG,GAAG,UAAU,EAAE,CAAA;QAC/E,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAA;YAC/D,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YAC3B,CAAC;YAAC,MAAM,CAAC;gBACP,8DAA8D;YAChE,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,KAAK,CAAC,WAAW;QACf,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,GAAG,OAAO,CAAA;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAE5B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAEpE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,wBAAwB,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;gBACjE,OAAM;YACR,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;oBACvD,IAAI,CAAC;wBACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;wBACrC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,GAAG,wBAAwB,EAAE,CAAC;4BAC1D,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;4BACzC,SAAQ;wBACV,CAAC;oBACH,CAAC;oBAAC,MAAM,CAAC;wBACP,SAAQ;oBACV,CAAC;oBACD,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAA;gBAC7E,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,wBAAwB,GAAG,IAAI,CAAC,CAAA;IAC7F,CAAC;IAED,KAAK,CAAC,WAAW;QACf,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,CAAA;QAC9C,CAAC;QAAC,MAAM,CAAC;YACP,oDAAoD;QACtD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAoD;QACrE,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QACxB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAA;YAClC,MAAM,OAAO,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAA;YAClC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1B,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,WAAW,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;CACF"}

package/dist/src/services/skill-manifest.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skill-manifest.test.d.ts.map

package/dist/src/services/skill-manifest.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-manifest.test.d.ts","sourceRoot":"","sources":["../../../src/services/skill-manifest.test.ts"],"names":[],"mappings":""}

package/dist/src/services/skill-manifest.test.js

@@ -0,0 +1,202 @@
+/**
+ * @fileoverview Tests for ManifestManager concurrency hardening (SMI-6007)
+ * @module @skillsmith/core/services/skill-manifest.test
+ * @see SMI-6007: manifest write-path concurrency hardening — split out of
+ *   the flaky-test investigation SMI-6004. Two confirmed hazards:
+ *     1. performUninstall() bypassed the lock (fixed in
+ *        skill-installation.helpers.ts — see its own test coverage).
+ *     2. save() computed a temp filename from `process.pid` alone, so two
+ *        concurrent `save()` calls in the same process collided on the
+ *        identical `.tmp.<pid>` path.
+ *   Plus a load()-hardening item: distinguish "no manifest yet" (ENOENT,
+ *   legitimate first run) from "manifest exists but is corrupt/unreadable"
+ *   (should throw, not silently return an empty manifest that a later
+ *   save() could use to erase real state).
+ *
+ * These tests use a real temp directory + real fs/promises calls (not an
+ * in-memory mock) so the concurrent cases exercise actual OS-level file
+ * operations — `acquireLock()`'s `wx`-flag file creation is only
+ * meaningfully racy against real fs semantics.
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import * as os from 'os';
+import * as path from 'path';
+// The Node ESM module namespace object is not configurable, so a plain
+// `vi.spyOn(fs, 'readFile')` throws "Cannot redefine property" under this
+// runtime. Instead, wrap the specific functions the write/rename-failure
+// tests need to override in `vi.fn(actual.fn)` at mock-registration time —
+// each defaults to forwarding to the real implementation (so every other
+// test that doesn't override them still hits the real filesystem), and
+// individual tests can layer a `mockImplementationOnce`/`mockRejectedValueOnce`
+// on top without needing `vi.spyOn`.
+vi.mock('fs/promises', async (importOriginal) => {
+    const actual = await importOriginal();
+    return {
+        ...actual,
+        readFile: vi.fn(actual.readFile),
+        writeFile: vi.fn(actual.writeFile),
+        rename: vi.fn(actual.rename),
+        unlink: vi.fn(actual.unlink),
+    };
+});
+import * as fs from 'fs/promises';
+import { ManifestManager } from './skill-manifest.js';
+// ============================================================================
+// Helpers
+// ============================================================================
+function makeEntry(overrides = {}) {
+    const now = new Date().toISOString();
+    return {
+        id: overrides.id ?? 'author/skill',
+        name: overrides.name ?? 'skill',
+        version: overrides.version ?? '1.0.0',
+        source: overrides.source ?? 'github:author/skill',
+        installPath: overrides.installPath ?? '/tmp/skill',
+        installedAt: overrides.installedAt ?? now,
+        lastUpdated: overrides.lastUpdated ?? now,
+        ...overrides,
+    };
+}
+// ============================================================================
+// Tests
+// ============================================================================
+describe('ManifestManager concurrency hardening (SMI-6007)', () => {
+    let tmpDir;
+    let manifestPath;
+    let manager;
+    beforeEach(async () => {
+        tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), 'skillsmith-manifest-test-'));
+        manifestPath = path.join(tmpDir, 'manifest.json');
+        manager = new ManifestManager(manifestPath);
+    });
+    afterEach(async () => {
+        vi.clearAllMocks();
+        await fs.rm(tmpDir, { recursive: true, force: true });
+    });
+    // --------------------------------------------------------------------------
+    // Item 1: two direct save() calls overlap; neither throws (temp-file fix)
+    // --------------------------------------------------------------------------
+    describe('save() same-pid temp-file collision', () => {
+        it('two overlapping save() calls both resolve without throwing', async () => {
+            const first = {
+                version: '1.0.0',
+                installedSkills: { a: makeEntry({ id: 'a' }) },
+            };
+            const second = {
+                version: '1.0.0',
+                installedSkills: { b: makeEntry({ id: 'b' }) },
+            };
+            await expect(Promise.all([manager.save(first), manager.save(second)])).resolves.toBeDefined();
+            // Whichever write landed last, the file must be a full, valid write —
+            // never a partial/corrupt mix of the two.
+            const loaded = await manager.load();
+            expect(Object.keys(loaded.installedSkills)).toHaveLength(1);
+        });
+        it('does not leave stray .tmp.* files behind after concurrent saves', async () => {
+            await Promise.all([
+                manager.save({ version: '1.0.0', installedSkills: {} }),
+                manager.save({ version: '1.0.0', installedSkills: {} }),
+            ]);
+            const files = await fs.readdir(tmpDir);
+            expect(files.some((f) => f.includes('.tmp.'))).toBe(false);
+        });
+    });
+    // --------------------------------------------------------------------------
+    // Item 2: two concurrent updateSafely() calls on DISTINCT entries; both
+    // survive (validates the lock actually serializes correctly)
+    // --------------------------------------------------------------------------
+    describe('updateSafely() serializes concurrent updates to distinct entries', () => {
+        it('both entries survive when two updateSafely() calls run concurrently', async () => {
+            await manager.save({ version: '1.0.0', installedSkills: {} });
+            await Promise.all([
+                manager.updateSafely((m) => ({
+                    ...m,
+                    installedSkills: { ...m.installedSkills, 'skill-a': makeEntry({ id: 'skill-a' }) },
+                })),
+                manager.updateSafely((m) => ({
+                    ...m,
+                    installedSkills: { ...m.installedSkills, 'skill-b': makeEntry({ id: 'skill-b' }) },
+                })),
+            ]);
+            const loaded = await manager.load();
+            expect(Object.keys(loaded.installedSkills).sort()).toEqual(['skill-a', 'skill-b']);
+        });
+    });
+    // --------------------------------------------------------------------------
+    // Item 4: load() distinguishes ENOENT (expected first run) from a
+    // corrupt/unreadable manifest (should throw, not silently go empty)
+    // --------------------------------------------------------------------------
+    describe('load() distinguishes missing vs corrupt manifest', () => {
+        it('returns an empty manifest when the file does not exist (ENOENT — expected first run)', async () => {
+            const loaded = await manager.load();
+            expect(loaded).toEqual({ version: '1.0.0', installedSkills: {} });
+        });
+        it('throws (does not silently return an empty manifest) when the file contains unparseable JSON', async () => {
+            await fs.writeFile(manifestPath, '{ not valid json');
+            await expect(manager.load()).rejects.toThrow(/corrupt|unparseable/i);
+        });
+        it('rethrows a non-ENOENT read error (e.g. EACCES) instead of returning an empty manifest', async () => {
+            const permissionError = Object.assign(new Error('EACCES: permission denied'), {
+                code: 'EACCES',
+            });
+            vi.mocked(fs.readFile).mockRejectedValueOnce(permissionError);
+            await expect(manager.load()).rejects.toThrow('EACCES');
+        });
+    });
+    // --------------------------------------------------------------------------
+    // Item 5: inject a write/rename failure — verify the unique-temp-file
+    // cleanup removes only that invocation's own temp file and the original
+    // error still propagates (not swallowed)
+    // --------------------------------------------------------------------------
+    describe('save() write/rename failure cleanup', () => {
+        it('on a writeFile failure, the temp file is cleaned up and the original error propagates', async () => {
+            const originalError = new Error('ENOSPC: no space left on device');
+            vi.mocked(fs.writeFile).mockRejectedValueOnce(originalError);
+            await expect(manager.save({ version: '1.0.0', installedSkills: {} })).rejects.toThrow(originalError);
+            const files = await fs.readdir(tmpDir).catch(() => []);
+            expect(files.some((f) => f.includes('.tmp.'))).toBe(false);
+        });
+        it('on a rename failure, the temp file is cleaned up, the original error propagates, and the manifest is untouched', async () => {
+            await manager.save({
+                version: '1.0.0',
+                installedSkills: { existing: makeEntry({ id: 'existing' }) },
+            });
+            const originalError = new Error('EPERM: operation not permitted');
+            vi.mocked(fs.rename).mockRejectedValueOnce(originalError);
+            await expect(manager.save({ version: '1.0.0', installedSkills: { other: makeEntry({ id: 'other' }) } })).rejects.toThrow(originalError);
+            const loaded = await manager.load();
+            expect(Object.keys(loaded.installedSkills)).toEqual(['existing']);
+            const files = await fs.readdir(tmpDir);
+            expect(files.some((f) => f.includes('.tmp.'))).toBe(false);
+        });
+        it('a failed save() only removes its own temp file, leaving a concurrently in-flight one untouched', async () => {
+            // call A's rename fails and must be cleaned up; call B's rename must
+            // succeed normally. Because each call's temp filename is now
+            // per-invocation-unique (SMI-6007), A's cleanup cannot touch B's file.
+            // mockRejectedValueOnce queues exactly one rejection ahead of the
+            // default (real) implementation, so whichever of the two concurrent
+            // renames happens to run first gets it — order isn't asserted below.
+            vi.mocked(fs.rename).mockRejectedValueOnce(new Error('simulated rename failure for call A'));
+            const callA = manager.save({
+                version: '1.0.0',
+                installedSkills: { a: makeEntry({ id: 'a' }) },
+            });
+            const callB = manager.save({
+                version: '1.0.0',
+                installedSkills: { b: makeEntry({ id: 'b' }) },
+            });
+            const results = await Promise.allSettled([callA, callB]);
+            // Order between the two concurrent calls isn't guaranteed by real fs
+            // I/O scheduling — assert the invariant that matters: exactly one
+            // call's rename failed (and was cleaned up), the other succeeded, and
+            // no cross-contamination between their distinct temp files occurred.
+            const rejected = results.filter((r) => r.status === 'rejected');
+            const fulfilled = results.filter((r) => r.status === 'fulfilled');
+            expect(rejected).toHaveLength(1);
+            expect(fulfilled).toHaveLength(1);
+            const files = await fs.readdir(tmpDir);
+            expect(files.some((f) => f.includes('.tmp.'))).toBe(false);
+        });
+    });
+});
+//# sourceMappingURL=skill-manifest.test.js.map

package/dist/src/services/skill-manifest.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-manifest.test.js","sourceRoot":"","sources":["../../../src/services/skill-manifest.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,uEAAuE;AACvE,0EAA0E;AAC1E,yEAAyE;AACzE,2EAA2E;AAC3E,yEAAyE;AACzE,uEAAuE;AACvE,gFAAgF;AAChF,qCAAqC;AACrC,EAAE,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE;IAC9C,MAAM,MAAM,GAAG,MAAM,cAAc,EAAgC,CAAA;IACnE,OAAO;QACL,GAAG,MAAM;QACT,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC;QAClC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5B,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;KAC7B,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAGrD,+EAA+E;AAC/E,UAAU;AACV,+EAA+E;AAE/E,SAAS,SAAS,CAAC,YAAyC,EAAE;IAC5D,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACpC,OAAO;QACL,EAAE,EAAE,SAAS,CAAC,EAAE,IAAI,cAAc;QAClC,IAAI,EAAE,SAAS,CAAC,IAAI,IAAI,OAAO;QAC/B,OAAO,EAAE,SAAS,CAAC,OAAO,IAAI,OAAO;QACrC,MAAM,EAAE,SAAS,CAAC,MAAM,IAAI,qBAAqB;QACjD,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,YAAY;QAClD,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,GAAG;QACzC,WAAW,EAAE,SAAS,CAAC,WAAW,IAAI,GAAG;QACzC,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;IAChE,IAAI,MAAc,CAAA;IAClB,IAAI,YAAoB,CAAA;IACxB,IAAI,OAAwB,CAAA;IAE5B,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC,CAAC,CAAA;QAC9E,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAA;QACjD,OAAO,GAAG,IAAI,eAAe,CAAC,YAAY,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,EAAE,CAAC,aAAa,EAAE,CAAA;QAClB,MAAM,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,0EAA0E;IAC1E,6EAA6E;IAE7E,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;QACnD,EAAE,CAAC,4DAA4D,EAAE,KAAK,IAAI,EAAE;YAC1E,MAAM,KAAK,GAAkB;gBAC3B,OAAO,EAAE,OAAO;gBAChB,eAAe,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;aAC/C,CAAA;YACD,MAAM,MAAM,GAAkB;gBAC5B,OAAO,EAAE,OAAO;gBAChB,eAAe,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;aAC/C,CAAA;YAED,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;YAE7F,sEAAsE;YACtE,0CAA0C;YAC1C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC7D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;YAC/E,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;gBACvD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC;aACxD,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,wEAAwE;IACxE,6DAA6D;IAC7D,6EAA6E;IAE7E,QAAQ,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAChF,EAAE,CAAC,qEAAqE,EAAE,KAAK,IAAI,EAAE;YACnF,MAAM,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAA;YAE7D,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,GAAG,CAAC;oBACJ,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;iBACnF,CAAC,CAAC;gBACH,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBAC3B,GAAG,CAAC;oBACJ,eAAe,EAAE,EAAE,GAAG,CAAC,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE;iBACnF,CAAC,CAAC;aACJ,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAA;QACpF,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,kEAAkE;IAClE,oEAAoE;IACpE,6EAA6E;IAE7E,QAAQ,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAChE,EAAE,CAAC,sFAAsF,EAAE,KAAK,IAAI,EAAE;YACpG,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAA;QACnE,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;YAC3G,MAAM,EAAE,CAAC,SAAS,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAA;YACpD,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;QACtE,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;YACrG,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,2BAA2B,CAAC,EAAE;gBAC5E,IAAI,EAAE,QAAQ;aACf,CAAC,CAAA;YACF,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAA;YAE7D,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACxD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,sEAAsE;IACtE,wEAAwE;IACxE,yCAAyC;IACzC,6EAA6E;IAE7E,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;QACnD,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;YACrG,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;YAClE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAA;YAE5D,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CACnF,aAAa,CACd,CAAA;YAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;YACtD,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gHAAgH,EAAE,KAAK,IAAI,EAAE;YAC9H,MAAM,OAAO,CAAC,IAAI,CAAC;gBACjB,OAAO,EAAE,OAAO;gBAChB,eAAe,EAAE,EAAE,QAAQ,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;aAC7D,CAAC,CAAA;YAEF,MAAM,aAAa,GAAG,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAA;YACjE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,aAAa,CAAC,CAAA;YAEzD,MAAM,MAAM,CACV,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,CAAC,CAC3F,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAA;YAEhC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;YAEjE,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,gGAAgG,EAAE,KAAK,IAAI,EAAE;YAC9G,qEAAqE;YACrE,6DAA6D;YAC7D,uEAAuE;YACvE,kEAAkE;YAClE,oEAAoE;YACpE,qEAAqE;YACrE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAA;YAE5F,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;gBACzB,OAAO,EAAE,OAAO;gBAChB,eAAe,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;aAC/C,CAAC,CAAA;YACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;gBACzB,OAAO,EAAE,OAAO;gBAChB,eAAe,EAAE,EAAE,CAAC,EAAE,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE;aAC/C,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAA;YAExD,qEAAqE;YACrE,kEAAkE;YAClE,sEAAsE;YACtE,qEAAqE;YACrE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAA;YAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAA;YACjE,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;YAChC,MAAM,CAAC,SAAS,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;YAEjC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;YACtC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC5D,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/services/skill-resolution.d.ts

@@ -0,0 +1,67 @@
+/**
+ * @fileoverview Shared API-first / local-fallback skill resolution.
+ * @module @skillsmith/core/services/skill-resolution
+ * @see SMI-1183: original API-first / local-fallback pattern, first written
+ *   inline in the MCP `get_skill` tool.
+ * @see SMI-5896 (Wave 3, discovery-tool consistency): extracted here so
+ *   `skill_compare` can share the exact same resolution flow instead of only
+ *   ever querying the local cache — which, per SMI-5427, is no longer kept in
+ *   sync with the remote-first registry, so a real, searchable registry skill
+ *   was often simply absent locally and compare would report "not found" for
+ *   a skill `search`/`get_skill` could both resolve fine.
+ *
+ * This module owns exactly the "try API, fall back to local DB, normalize
+ * not-found" flow — NOT the per-tool result-shape mapping (e.g. MCPSkill vs
+ * the compare tool's ExtendedSkill), which stays with each calling tool since
+ * those shapes genuinely differ and forcing one shared shape would just move
+ * the duplication rather than remove it.
+ *
+ * Known non-consumer (intentional): `lookupSkillFromRegistry()` in
+ * `@skillsmith/mcp-server/tools/install.helpers.ts` implements a similar
+ * API-first/local-fallback shape but a materially different contract —
+ * null-not-throw, no local fallback when the registry returns a skill with no
+ * `repo_url`, and a per-branch `quarantined` derivation this resolver has no
+ * concept of. See that function's docblock before attempting to unify them:
+ * doing so naively would relax an install-time security gate.
+ */
+import type { SkillsmithApiClient, ApiSearchResult } from '../api/client.js';
+import type { SkillRepository } from '../repositories/SkillRepository.js';
+import type { Skill } from '../types/skill.js';
+/**
+ * Result of {@link resolveSkillApiFirst} — a discriminated union over the two
+ * possible sources so callers can branch on `source` and access the
+ * source-specific (snake_case API vs camelCase local DB) shape directly
+ * rather than a lossy, pre-merged shape.
+ */
+export type ResolvedSkill = {
+    source: 'api';
+    apiSkill: ApiSearchResult;
+} | {
+    source: 'local';
+    dbSkill: Skill;
+};
+export interface ResolveSkillOptions {
+    /**
+     * Request SKILL.md content alongside metadata on the API path. Only
+     * `get_skill` needs this; `skill_compare` never sets it. Default `false`.
+     */
+    includeContent?: boolean;
+}
+/**
+ * Resolve a skill by ID, API first with local-DB fallback (SMI-1183).
+ *
+ * - Tries the live API first (unless `apiClient.isOffline()`).
+ * - Falls back to the local `SkillRepository` on API-offline or API failure
+ *   of any kind (network, 404, etc — all treated the same: fall through).
+ * - Throws a normalized `SkillsmithError(SKILL_NOT_FOUND)` when neither
+ *   source has the skill. Every caller shares this exact message/details
+ *   shape, so `get_skill` and `skill_compare` report not-found identically
+ *   instead of two independently-worded messages that can drift.
+ *
+ * @param skillId - Already-validated/trimmed skill ID (author/name or UUID).
+ * @param apiClient - API client used for the primary lookup.
+ * @param skillRepository - Local repository used for the fallback lookup.
+ * @param options - Optional resolution behavior (e.g. `includeContent`).
+ */
+export declare function resolveSkillApiFirst(skillId: string, apiClient: SkillsmithApiClient, skillRepository: SkillRepository, options?: ResolveSkillOptions): Promise<ResolvedSkill>;
+//# sourceMappingURL=skill-resolution.d.ts.map

package/dist/src/services/skill-resolution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-resolution.d.ts","sourceRoot":"","sources":["../../../src/services/skill-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAUH,OAAO,KAAK,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAC5E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AAE9C;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GACrB;IAAE,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,KAAK,CAAA;CAAE,CAAA;AAEvC,MAAM,WAAW,mBAAmB;IAClC;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAA;CACzB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,mBAAmB,EAC9B,eAAe,EAAE,eAAe,EAChC,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,aAAa,CAAC,CA0BxB"}

package/dist/src/services/skill-resolution.js

@@ -0,0 +1,67 @@
+/**
+ * @fileoverview Shared API-first / local-fallback skill resolution.
+ * @module @skillsmith/core/services/skill-resolution
+ * @see SMI-1183: original API-first / local-fallback pattern, first written
+ *   inline in the MCP `get_skill` tool.
+ * @see SMI-5896 (Wave 3, discovery-tool consistency): extracted here so
+ *   `skill_compare` can share the exact same resolution flow instead of only
+ *   ever querying the local cache — which, per SMI-5427, is no longer kept in
+ *   sync with the remote-first registry, so a real, searchable registry skill
+ *   was often simply absent locally and compare would report "not found" for
+ *   a skill `search`/`get_skill` could both resolve fine.
+ *
+ * This module owns exactly the "try API, fall back to local DB, normalize
+ * not-found" flow — NOT the per-tool result-shape mapping (e.g. MCPSkill vs
+ * the compare tool's ExtendedSkill), which stays with each calling tool since
+ * those shapes genuinely differ and forcing one shared shape would just move
+ * the duplication rather than remove it.
+ *
+ * Known non-consumer (intentional): `lookupSkillFromRegistry()` in
+ * `@skillsmith/mcp-server/tools/install.helpers.ts` implements a similar
+ * API-first/local-fallback shape but a materially different contract —
+ * null-not-throw, no local fallback when the registry returns a skill with no
+ * `repo_url`, and a per-branch `quarantined` derivation this resolver has no
+ * concept of. See that function's docblock before attempting to unify them:
+ * doing so naively would relax an install-time security gate.
+ */
+import { SkillsmithError, ErrorCodes } from '../errors.js';
+/**
+ * Resolve a skill by ID, API first with local-DB fallback (SMI-1183).
+ *
+ * - Tries the live API first (unless `apiClient.isOffline()`).
+ * - Falls back to the local `SkillRepository` on API-offline or API failure
+ *   of any kind (network, 404, etc — all treated the same: fall through).
+ * - Throws a normalized `SkillsmithError(SKILL_NOT_FOUND)` when neither
+ *   source has the skill. Every caller shares this exact message/details
+ *   shape, so `get_skill` and `skill_compare` report not-found identically
+ *   instead of two independently-worded messages that can drift.
+ *
+ * @param skillId - Already-validated/trimmed skill ID (author/name or UUID).
+ * @param apiClient - API client used for the primary lookup.
+ * @param skillRepository - Local repository used for the fallback lookup.
+ * @param options - Optional resolution behavior (e.g. `includeContent`).
+ */
+export async function resolveSkillApiFirst(skillId, apiClient, skillRepository, options = {}) {
+    if (!apiClient.isOffline()) {
+        try {
+            const apiResponse = await apiClient.getSkill(skillId, {
+                includeContent: options.includeContent ?? false,
+            });
+            return { source: 'api', apiSkill: apiResponse.data };
+        }
+        catch (error) {
+            // SMI-1183: log and fall through to the local database for all errors —
+            // this allows local-only skills to resolve even when the API 404s.
+            console.warn('[skillsmith] API getSkill failed, using local database:', error.message);
+        }
+    }
+    const dbSkill = skillRepository.findById(skillId);
+    if (!dbSkill) {
+        throw new SkillsmithError(ErrorCodes.SKILL_NOT_FOUND, `Skill "${skillId}" not found`, {
+            details: { id: skillId },
+            suggestion: 'Try searching for similar skills with the search tool',
+        });
+    }
+    return { source: 'local', dbSkill };
+}
+//# sourceMappingURL=skill-resolution.js.map

package/dist/src/services/skill-resolution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-resolution.js","sourceRoot":"","sources":["../../../src/services/skill-resolution.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,cAAc,CAAA;AA8B1D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,SAA8B,EAC9B,eAAgC,EAChC,UAA+B,EAAE;IAEjC,IAAI,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,QAAQ,CAAC,OAAO,EAAE;gBACpD,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,KAAK;aAChD,CAAC,CAAA;YACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,IAAI,EAAE,CAAA;QACtD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,mEAAmE;YACnE,OAAO,CAAC,IAAI,CACV,yDAAyD,EACxD,KAAe,CAAC,OAAO,CACzB,CAAA;QACH,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAA;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,eAAe,EAAE,UAAU,OAAO,aAAa,EAAE;YACpF,OAAO,EAAE,EAAE,EAAE,EAAE,OAAO,EAAE;YACxB,UAAU,EAAE,uDAAuD;SACpE,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;AACrC,CAAC"}

package/dist/src/services/skill-resolution.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=skill-resolution.test.d.ts.map

package/dist/src/services/skill-resolution.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-resolution.test.d.ts","sourceRoot":"","sources":["../../../src/services/skill-resolution.test.ts"],"names":[],"mappings":""}