@skillsmith/core 0.12.1 → 0.12.3

package/dist/src/services/skill-content-comparison.test.js

@@ -0,0 +1,83 @@
+/**
+ * @fileoverview Unit tests for the shared skill content-hash comparator
+ * @see SMI-6343 Wave 2 — repair the content-hash comparison
+ */
+import { describe, it, expect } from 'vitest';
+import { compareSkillContentHashes, firstNonBlankHash } from './skill-content-comparison.js';
+describe('compareSkillContentHashes', () => {
+    it('returns current when both hashes match exactly', () => {
+        const result = compareSkillContentHashes('abc123', 'abc123');
+        expect(result.outcome).toBe('current');
+        expect(result.reason).toBeUndefined();
+    });
+    it('returns outdated when the hashes differ', () => {
+        const result = compareSkillContentHashes('abc123', 'def456');
+        expect(result.outcome).toBe('outdated');
+        expect(result.reason).toBeUndefined();
+    });
+    it('returns unknown with a reason when the installed hash is missing', () => {
+        const result = compareSkillContentHashes(null, 'def456');
+        expect(result.outcome).toBe('unknown');
+        expect(result.reason).toMatch(/no installed content hash/i);
+    });
+    it('returns unknown with a reason when the installed hash is undefined', () => {
+        const result = compareSkillContentHashes(undefined, 'def456');
+        expect(result.outcome).toBe('unknown');
+        expect(result.reason).toMatch(/no installed content hash/i);
+    });
+    it('returns unknown with a reason when the registry hash is missing', () => {
+        const result = compareSkillContentHashes('abc123', null);
+        expect(result.outcome).toBe('unknown');
+        expect(result.reason).toMatch(/no registry content hash/i);
+    });
+    it('returns unknown with a reason when the registry hash is undefined', () => {
+        const result = compareSkillContentHashes('abc123', undefined);
+        expect(result.outcome).toBe('unknown');
+        expect(result.reason).toMatch(/no registry content hash/i);
+    });
+    it('returns unknown when both hashes are missing', () => {
+        const result = compareSkillContentHashes(null, null);
+        expect(result.outcome).toBe('unknown');
+        expect(result.reason).toMatch(/no installed content hash and no registry content hash/i);
+    });
+    it('treats a blank/whitespace-only hash the same as missing', () => {
+        expect(compareSkillContentHashes('   ', 'abc123').outcome).toBe('unknown');
+        expect(compareSkillContentHashes('abc123', '   ').outcome).toBe('unknown');
+        expect(compareSkillContentHashes('', '').outcome).toBe('unknown');
+    });
+    it('is case-sensitive — differently-cased hex digests are treated as different hashes', () => {
+        const result = compareSkillContentHashes('ABC123', 'abc123');
+        expect(result.outcome).toBe('outdated');
+    });
+    it('trims surrounding whitespace before comparing', () => {
+        const result = compareSkillContentHashes('  abc123  ', 'abc123');
+        expect(result.outcome).toBe('current');
+    });
+});
+describe('firstNonBlankHash (adversarial-review addition, SMI-6343)', () => {
+    it('returns the first candidate when it is non-blank', () => {
+        expect(firstNonBlankHash('abc123', 'def456')).toBe('abc123');
+    });
+    it('falls through past null/undefined to the next candidate', () => {
+        expect(firstNonBlankHash(null, 'def456')).toBe('def456');
+        expect(firstNonBlankHash(undefined, 'def456')).toBe('def456');
+    });
+    it('falls through past a BLANK (whitespace-only) first candidate — the exact case a raw `??` chain gets wrong', () => {
+        // `'   ' ?? 'def456'` would incorrectly return '   ' (?? only falls
+        // through on null/undefined) — this is the whole reason this helper
+        // exists instead of a raw `??` chain at each call site.
+        expect(firstNonBlankHash('   ', 'def456')).toBe('def456');
+        expect(firstNonBlankHash('', 'def456')).toBe('def456');
+    });
+    it('trims a winning candidate', () => {
+        expect(firstNonBlankHash('  abc123  ')).toBe('abc123');
+    });
+    it('returns null when every candidate is blank/null/undefined', () => {
+        expect(firstNonBlankHash(null, undefined, '   ', '')).toBeNull();
+        expect(firstNonBlankHash()).toBeNull();
+    });
+    it('supports three or more candidates (on-disk-hash fallback chains)', () => {
+        expect(firstNonBlankHash('   ', undefined, 'on-disk-hash')).toBe('on-disk-hash');
+    });
+});
+//# sourceMappingURL=skill-content-comparison.test.js.map

package/dist/src/services/skill-content-comparison.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-content-comparison.test.js","sourceRoot":"","sources":["../../../src/services/skill-content-comparison.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAE5F,QAAQ,CAAC,2BAA2B,EAAE,GAAG,EAAE;IACzC,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC5D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC5D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QACvC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,EAAE,CAAA;IACvC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;QACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;QAC7D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;IAC7D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAA;QACxD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAA;QAC7D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;QACpD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACtC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,yDAAyD,CAAC,CAAA;IAC1F,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,yBAAyB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1E,MAAM,CAAC,yBAAyB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QAC1E,MAAM,CAAC,yBAAyB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mFAAmF,EAAE,GAAG,EAAE;QAC3F,MAAM,MAAM,GAAG,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;QAC5D,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACzC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,yBAAyB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;QAChE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;IACxC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACzE,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,iBAAiB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC9D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxD,MAAM,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2GAA2G,EAAE,GAAG,EAAE;QACnH,oEAAoE;QACpE,oEAAoE;QACpE,wDAAwD;QACxD,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,CAAC,iBAAiB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACxD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2DAA2D,EAAE,GAAG,EAAE;QACnE,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAA;QAChE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;IACxC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,kEAAkE,EAAE,GAAG,EAAE;QAC1E,MAAM,CAAC,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;IAClF,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/services/skill-identity-classification.d.ts

@@ -0,0 +1,202 @@
+/**
+ * @fileoverview Shared skill-identity contradiction-signal classification
+ * @module @skillsmith/core/services/skill-identity-classification
+ * @see SMI-6343 Wave 3 — tamper-check classification (AC#3)
+ *
+ * Three deterministic-or-best-effort "does this manifest entry's recorded
+ * identity contradict what's actually installed" signals, plus a
+ * "has this on-disk content been locally edited since install" check —
+ * consumed by BOTH `packages/mcp-server/src/tools/outdated.ts` (via
+ * `outdated.identity.ts`) and `packages/cli/src/commands/manage.update.ts`,
+ * so the two packages cannot drift into two independently-maintained
+ * implementations of the same contradiction logic (exactly the "sibling
+ * implementation" bug class both Wave 1 and Wave 2 of SMI-6343 already hit).
+ *
+ * Deliberately decoupled from either caller's own `RegistrySkillInfo` shape
+ * (mcp-server's `install.types.ts` and core's own `skill-installation.types.ts`
+ * both have independently-evolved versions) — callers adapt their own
+ * registry-lookup result into the minimal {@link RegistryLookupOutcome} shape
+ * this module needs.
+ *
+ * Every function here is synchronous and filesystem-free by design: signal 3
+ * (path containment) is a pure string check against an already-resolved
+ * expected root directory, not a `fs.realpath` call — the callers of this
+ * module (`outdated.ts`, `manage.update.ts`) only ever reach the "outdated"
+ * classification branch after already having successfully read the
+ * installed skill's SKILL.md this same iteration, so "does installPath
+ * exist" is already established by the time these signals run.
+ */
+import type { ContentComparisonOutcome } from './skill-content-comparison.js';
+import type { ClientId } from '../install/paths.js';
+/** Which of the three contradiction signals fired. */
+export type IdentitySignal = 'owner-mismatch' | 'frontmatter-contradiction' | 'path-unresolved';
+/** Why a classification could not be conclusively determined. */
+export type IdentityInconclusiveReason = 'offline' | 'quota-exhausted' | 'network-error' | 'no-registry-record' | 'no-history';
+/** The five-state classification `outdated.ts`/`manage.update.ts` report against a divergent entry. */
+export type OutdatedClassificationState = 'current' | 'outdated' | 'local-drift' | 'identity-mismatch' | 'unknown';
+/** Minimal registry-record shape signal 2 needs. */
+export interface IdentityRegistryRecord {
+    author?: string | null;
+    name?: string | null;
+}
+/**
+ * The outcome of a caller's OWN registry lookup for the entry's claimed
+ * `id`, adapted into this module's minimal shape.
+ *
+ * `attempted: false` means the caller never even tried this run (offline,
+ * or an earlier skill in the same batch already exhausted quota) —
+ * `failureReason` in that case names WHY it wasn't attempted. `attempted:
+ * true` with `record: null` means the lookup completed but found nothing
+ * for this id (a distinct case from a failed lookup — see
+ * `no-registry-record` below).
+ */
+export interface RegistryLookupOutcome {
+    attempted: boolean;
+    record: IdentityRegistryRecord | null;
+    /** Populated when the lookup either wasn't attempted or didn't complete. */
+    failureReason?: 'offline' | 'quota-exhausted' | 'network-error' | null;
+}
+/** The subset of a manifest entry every signal needs. */
+export interface ManifestEntryForIdentity {
+    id: string;
+    source: string;
+    installPath: string;
+    client?: ClientId;
+    contentHash?: string;
+    originalContentHash?: string;
+}
+/** Result of {@link classifyManifestEntryIdentity}. */
+export interface IdentityClassificationResult {
+    /** Which signal fired. Null when no signal fired (regardless of `inconclusive`). */
+    signal: IdentitySignal | null;
+    /** True when signal 2 (frontmatter) could not be checked at all. */
+    inconclusive: boolean;
+    /** Populated only when `inconclusive` is true. */
+    inconclusiveReason: IdentityInconclusiveReason | null;
+}
+/** Result of {@link classifyDivergentEntry}. */
+export interface DivergentEntryClassification {
+    state: Exclude<OutdatedClassificationState, 'current'>;
+    signal: IdentitySignal | null;
+    inconclusiveReason: IdentityInconclusiveReason | null;
+}
+/**
+ * Parse the owner segment out of a manifest `source` string. Real installs
+ * write `source` as `'github:' + owner + '/' + repo` (`skill-installation.
+ * service.ts`) — the `'github:'` prefix is optional here so a bare
+ * `owner/repo` (or a future non-GitHub source shape) still parses. Returns
+ * `null` for the `'unknown'` distrust sentinel, a raw URL, or anything else
+ * with no parseable `owner/name` shape.
+ */
+export declare function parseOwnerFromSource(source: string | undefined | null): string | null;
+/**
+ * Parse the owner segment out of a manifest entry's `id`. Returns `null`
+ * for anything that isn't a clean `owner/name` pair — most importantly a
+ * raw GitHub URL, which a direct-URL install records as `id` verbatim (see
+ * {@link parseOwnerFromOwnerNamePair}).
+ */
+export declare function parseOwnerFromId(id: string | undefined | null): string | null;
+/**
+ * Signal 1: `id` parses as `owner/name` and `source` names a DIFFERENT
+ * owner. Deterministic, offline, zero network dependency. Catches the real
+ * `linear` skill corruption (`source: "github:lobehub/lobehub"` vs
+ * `id: "wrsmith108/linear"`).
+ */
+export declare function detectOwnerMismatch(entry: Pick<ManifestEntryForIdentity, 'id' | 'source'>): boolean;
+/**
+ * Signal 3: `installPath` is absent, or resolves OUTSIDE `expectedRootDir`
+ * (the claimed client's native install root, or a workspace-scoped
+ * equivalent the caller resolves — see each caller's own scope handling).
+ *
+ * Deliberately a pure string containment check (`path.relative`), not a
+ * filesystem call: both callers of this module only reach this signal after
+ * already having successfully read the entry's SKILL.md this same
+ * iteration, so filesystem existence is already established. This also
+ * catches the exact shape of the SMI-6343 Wave 1 test-fixture leak (an
+ * OS-temp-dir `installPath` written into the real manifest) via simple
+ * string comparison, with no need to resolve symlinks.
+ *
+ * NOT a symlink-escape check (Wave 3 adversarial review, considered and
+ * scoped out): a real `installPath` inside `expectedRootDir` that is
+ * ITSELF a symlink pointing elsewhere is a local-filesystem-tampering
+ * threat distinct from this signal's actual purpose (catching a manifest
+ * entry whose *recorded* path doesn't match a legitimate install
+ * location — a software-bug/registry-tamper shape, not local attacker
+ * capability); an attacker with write access to plant such a symlink
+ * inside the client root already has equivalent-or-greater capability to
+ * edit SKILL.md content directly, making a `fs.realpath` upgrade here
+ * (which would also force this whole synchronous, filesystem-free module
+ * to become async) address a threat this signal was never meant to cover.
+ *
+ * The parent-segment check below (`rel === '..' || rel.startsWith('..' +
+ * sep)`) is deliberately NOT a bare `rel.startsWith('..')`: a literal
+ * directory name that happens to start with two dots (e.g. `..cache`) is a
+ * legitimate contained child — `path.relative('/r', '/r/..cache')` returns
+ * `'..cache'`, which a bare `startsWith('..')` would misclassify as an
+ * escape (Wave 3 adversarial review finding).
+ */
+export declare function detectPathUnresolved(installPath: string | undefined | null, expectedRootDir: string): boolean;
+/**
+ * Run all three contradiction signals against a manifest entry. Any one
+ * conclusively firing means `signal` is non-null — order (1, 3, 2) checks
+ * the two deterministic/offline signals first, only falling to the
+ * network-dependent signal 2 when neither of those already answered the
+ * question.
+ */
+export declare function classifyManifestEntryIdentity(params: {
+    entry: ManifestEntryForIdentity;
+    localContent: string | null;
+    expectedRootDir: string;
+    registryLookup: RegistryLookupOutcome;
+}): IdentityClassificationResult;
+/**
+ * Has the on-disk content changed since the manifest's own recorded
+ * install/update-time hash? This is what distinguishes a benign local edit
+ * (`local-drift`) from a genuine registry version bump (`outdated`) once
+ * no identity signal has fired.
+ *
+ * When the manifest never recorded a comparable hash at all (a legacy or
+ * adopted entry, `contentHash`/`originalContentHash` both absent), this
+ * deliberately defaults to `false` (no edit evidence) rather than `true`
+ * (conservative) — absence of a recorded hash is a data-quality gap, not
+ * positive evidence of tampering, and defaulting to `true` here would
+ * misclassify the large population of legacy/adopted entries that never had
+ * a hash recorded as `local-drift` even when they are genuinely just
+ * outdated (SMI-6343 Wave 3 review finding).
+ */
+export declare function hasRecordedLocalEdit(entry: Pick<ManifestEntryForIdentity, 'contentHash' | 'originalContentHash'>, localHash: string | null): boolean;
+/**
+ * Classify an entry the caller has ALREADY determined is divergent from the
+ * registry (mcp-server: `compareSkillContentHashes(...).outcome ===
+ * 'outdated'`; CLI: `getSkillDiff()` found a version/content difference).
+ * Never returns `'current'` — callers own that trivial case themselves,
+ * since it never needs signal evaluation at all.
+ */
+export declare function classifyDivergentEntry(params: {
+    entry: ManifestEntryForIdentity;
+    localHash: string | null;
+    localContent: string | null;
+    expectedRootDir: string;
+    registryLookup: RegistryLookupOutcome;
+}): DivergentEntryClassification;
+/**
+ * Full 5-state classification given an already-computed content-comparison
+ * outcome (from `compareSkillContentHashes`) plus the caller-derived reason
+ * a plain `'unknown'` comparison outcome couldn't be resolved (offline,
+ * quota-exhausted, network-error, or no-history — the caller already tracks
+ * which applies; see `outdated.ts`'s `deriveUnknownReason`).
+ */
+export declare function classifyOutdatedState(params: {
+    comparisonOutcome: ContentComparisonOutcome;
+    unknownReasonWhenComparisonUnknown: IdentityInconclusiveReason;
+    entry: ManifestEntryForIdentity;
+    localHash: string | null;
+    localContent: string | null;
+    expectedRootDir: string;
+    registryLookup: RegistryLookupOutcome;
+}): {
+    state: OutdatedClassificationState;
+    signal: IdentitySignal | null;
+    inconclusiveReason: IdentityInconclusiveReason | null;
+};
+//# sourceMappingURL=skill-identity-classification.d.ts.map

package/dist/src/services/skill-identity-classification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-identity-classification.d.ts","sourceRoot":"","sources":["../../../src/services/skill-identity-classification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAKH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAA;AAC7E,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAMnD,sDAAsD;AACtD,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,2BAA2B,GAAG,iBAAiB,CAAA;AAE/F,iEAAiE;AACjE,MAAM,MAAM,0BAA0B,GAClC,SAAS,GACT,iBAAiB,GACjB,eAAe,GACf,oBAAoB,GACpB,YAAY,CAAA;AAEhB,uGAAuG;AACvG,MAAM,MAAM,2BAA2B,GACnC,SAAS,GACT,UAAU,GACV,aAAa,GACb,mBAAmB,GACnB,SAAS,CAAA;AAEb,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACrB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,OAAO,CAAA;IAClB,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAA;IACrC,4EAA4E;IAC5E,aAAa,CAAC,EAAE,SAAS,GAAG,iBAAiB,GAAG,eAAe,GAAG,IAAI,CAAA;CACvE;AAED,yDAAyD;AACzD,MAAM,WAAW,wBAAwB;IACvC,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,QAAQ,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,uDAAuD;AACvD,MAAM,WAAW,4BAA4B;IAC3C,oFAAoF;IACpF,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;IAC7B,oEAAoE;IACpE,YAAY,EAAE,OAAO,CAAA;IACrB,kDAAkD;IAClD,kBAAkB,EAAE,0BAA0B,GAAG,IAAI,CAAA;CACtD;AAED,gDAAgD;AAChD,MAAM,WAAW,4BAA4B;IAC3C,KAAK,EAAE,OAAO,CAAC,2BAA2B,EAAE,SAAS,CAAC,CAAA;IACtD,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;IAC7B,kBAAkB,EAAE,0BAA0B,GAAG,IAAI,CAAA;CACtD;AAwBD;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAIrF;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG7E;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,IAAI,GAAG,QAAQ,CAAC,GACrD,OAAO,CAKT;AAMD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EACtC,eAAe,EAAE,MAAM,GACtB,OAAO,CAKT;AA6FD;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,KAAK,EAAE,wBAAwB,CAAA;IAC/B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,qBAAqB,CAAA;CACtC,GAAG,4BAA4B,CAkB/B;AAMD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,IAAI,CAAC,wBAAwB,EAAE,aAAa,GAAG,qBAAqB,CAAC,EAC5E,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAIT;AAMD;;;;;;GAMG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,KAAK,EAAE,wBAAwB,CAAA;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,qBAAqB,CAAA;CACtC,GAAG,4BAA4B,CAa/B;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAC5C,iBAAiB,EAAE,wBAAwB,CAAA;IAC3C,kCAAkC,EAAE,0BAA0B,CAAA;IAC9D,KAAK,EAAE,wBAAwB,CAAA;IAC/B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,eAAe,EAAE,MAAM,CAAA;IACvB,cAAc,EAAE,qBAAqB,CAAA;CACtC,GAAG;IACF,KAAK,EAAE,2BAA2B,CAAA;IAClC,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;IAC7B,kBAAkB,EAAE,0BAA0B,GAAG,IAAI,CAAA;CACtD,CAYA"}

package/dist/src/services/skill-identity-classification.js

@@ -0,0 +1,295 @@
+/**
+ * @fileoverview Shared skill-identity contradiction-signal classification
+ * @module @skillsmith/core/services/skill-identity-classification
+ * @see SMI-6343 Wave 3 — tamper-check classification (AC#3)
+ *
+ * Three deterministic-or-best-effort "does this manifest entry's recorded
+ * identity contradict what's actually installed" signals, plus a
+ * "has this on-disk content been locally edited since install" check —
+ * consumed by BOTH `packages/mcp-server/src/tools/outdated.ts` (via
+ * `outdated.identity.ts`) and `packages/cli/src/commands/manage.update.ts`,
+ * so the two packages cannot drift into two independently-maintained
+ * implementations of the same contradiction logic (exactly the "sibling
+ * implementation" bug class both Wave 1 and Wave 2 of SMI-6343 already hit).
+ *
+ * Deliberately decoupled from either caller's own `RegistrySkillInfo` shape
+ * (mcp-server's `install.types.ts` and core's own `skill-installation.types.ts`
+ * both have independently-evolved versions) — callers adapt their own
+ * registry-lookup result into the minimal {@link RegistryLookupOutcome} shape
+ * this module needs.
+ *
+ * Every function here is synchronous and filesystem-free by design: signal 3
+ * (path containment) is a pure string check against an already-resolved
+ * expected root directory, not a `fs.realpath` call — the callers of this
+ * module (`outdated.ts`, `manage.update.ts`) only ever reach the "outdated"
+ * classification branch after already having successfully read the
+ * installed skill's SKILL.md this same iteration, so "does installPath
+ * exist" is already established by the time these signals run.
+ */
+import { relative, isAbsolute, sep } from 'node:path';
+import { SkillParser } from '../indexer/SkillParser.js';
+import { firstNonBlankHash } from './skill-content-comparison.js';
+// ============================================================================
+// Signal 1 — owner mismatch
+// ============================================================================
+/**
+ * Parse a clean `owner/name` pair (exactly one slash, no URL scheme) into
+ * its owner segment. Returns `null` for anything that isn't that exact
+ * shape — critically, a raw URL (`https://github.com/owner/repo`, a
+ * direct-URL install's `id`/`source`) is NOT an `owner/name` pair and must
+ * return `null` here rather than a garbage "owner" parsed from before the
+ * URL's first slash (e.g. `'https:'`). Mirrors the same 2-segment
+ * distinction `install.helpers.ts`'s `parseSkillId()` already draws between
+ * a registry id and a direct GitHub reference.
+ */
+function parseOwnerFromOwnerNamePair(value) {
+    if (value.includes('://'))
+        return null;
+    const parts = value.split('/');
+    if (parts.length !== 2)
+        return null;
+    const [owner, name] = parts;
+    return owner.length > 0 && name.length > 0 ? owner : null;
+}
+/**
+ * Parse the owner segment out of a manifest `source` string. Real installs
+ * write `source` as `'github:' + owner + '/' + repo` (`skill-installation.
+ * service.ts`) — the `'github:'` prefix is optional here so a bare
+ * `owner/repo` (or a future non-GitHub source shape) still parses. Returns
+ * `null` for the `'unknown'` distrust sentinel, a raw URL, or anything else
+ * with no parseable `owner/name` shape.
+ */
+export function parseOwnerFromSource(source) {
+    if (!source || source === 'unknown')
+        return null;
+    const withoutPrefix = source.startsWith('github:') ? source.slice('github:'.length) : source;
+    return parseOwnerFromOwnerNamePair(withoutPrefix);
+}
+/**
+ * Parse the owner segment out of a manifest entry's `id`. Returns `null`
+ * for anything that isn't a clean `owner/name` pair — most importantly a
+ * raw GitHub URL, which a direct-URL install records as `id` verbatim (see
+ * {@link parseOwnerFromOwnerNamePair}).
+ */
+export function parseOwnerFromId(id) {
+    if (!id)
+        return null;
+    return parseOwnerFromOwnerNamePair(id);
+}
+/**
+ * Signal 1: `id` parses as `owner/name` and `source` names a DIFFERENT
+ * owner. Deterministic, offline, zero network dependency. Catches the real
+ * `linear` skill corruption (`source: "github:lobehub/lobehub"` vs
+ * `id: "wrsmith108/linear"`).
+ */
+export function detectOwnerMismatch(entry) {
+    const idOwner = parseOwnerFromId(entry.id);
+    const sourceOwner = parseOwnerFromSource(entry.source);
+    if (!idOwner || !sourceOwner)
+        return false;
+    return idOwner.toLowerCase() !== sourceOwner.toLowerCase();
+}
+// ============================================================================
+// Signal 3 — path unresolved
+// ============================================================================
+/**
+ * Signal 3: `installPath` is absent, or resolves OUTSIDE `expectedRootDir`
+ * (the claimed client's native install root, or a workspace-scoped
+ * equivalent the caller resolves — see each caller's own scope handling).
+ *
+ * Deliberately a pure string containment check (`path.relative`), not a
+ * filesystem call: both callers of this module only reach this signal after
+ * already having successfully read the entry's SKILL.md this same
+ * iteration, so filesystem existence is already established. This also
+ * catches the exact shape of the SMI-6343 Wave 1 test-fixture leak (an
+ * OS-temp-dir `installPath` written into the real manifest) via simple
+ * string comparison, with no need to resolve symlinks.
+ *
+ * NOT a symlink-escape check (Wave 3 adversarial review, considered and
+ * scoped out): a real `installPath` inside `expectedRootDir` that is
+ * ITSELF a symlink pointing elsewhere is a local-filesystem-tampering
+ * threat distinct from this signal's actual purpose (catching a manifest
+ * entry whose *recorded* path doesn't match a legitimate install
+ * location — a software-bug/registry-tamper shape, not local attacker
+ * capability); an attacker with write access to plant such a symlink
+ * inside the client root already has equivalent-or-greater capability to
+ * edit SKILL.md content directly, making a `fs.realpath` upgrade here
+ * (which would also force this whole synchronous, filesystem-free module
+ * to become async) address a threat this signal was never meant to cover.
+ *
+ * The parent-segment check below (`rel === '..' || rel.startsWith('..' +
+ * sep)`) is deliberately NOT a bare `rel.startsWith('..')`: a literal
+ * directory name that happens to start with two dots (e.g. `..cache`) is a
+ * legitimate contained child — `path.relative('/r', '/r/..cache')` returns
+ * `'..cache'`, which a bare `startsWith('..')` would misclassify as an
+ * escape (Wave 3 adversarial review finding).
+ */
+export function detectPathUnresolved(installPath, expectedRootDir) {
+    if (!installPath)
+        return true;
+    const rel = relative(expectedRootDir, installPath);
+    if (rel === '')
+        return false;
+    return rel === '..' || rel.startsWith('..' + sep) || isAbsolute(rel);
+}
+function normalize(value) {
+    if (typeof value !== 'string')
+        return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+/**
+ * Signal 2: on-disk front-matter `author`/`name` contradicts the registry's
+ * record for the claimed `id`. Catches the real `commit` skill corruption
+ * (internally-consistent id/source, but content that belongs to an
+ * unrelated skill) — signal 1 alone does not catch this shape.
+ *
+ * H2 (fail-closed): when the registry lookup could not complete (offline,
+ * network error, quota-exhausted) OR completed but found no record for the
+ * claimed id, this returns `inconclusive: true` — NEVER "no contradiction."
+ * An inconclusive signal 2 still forces the overall classification to
+ * `unknown`, not `local-drift`/`current` — see {@link classifyDivergentEntry}.
+ *
+ * Exception, not a weakening of H2: when `id` itself doesn't parse as a
+ * well-formed `owner/name` registry key (a raw GitHub URL from a direct-URL
+ * install, an unresolved UUID) there is structurally no registry record to
+ * look up in the first place — a caller cannot "fail to check" something
+ * that was never a registry-backed identity to begin with. This is a clean
+ * non-fire, not an inconclusive one, exactly mirroring how an unparseable
+ * on-disk front-matter is treated below.
+ */
+function evaluateFrontmatterContradiction(entryId, localContent, registryLookup) {
+    if (parseOwnerFromId(entryId) === null) {
+        return { fired: false, inconclusive: false, inconclusiveReason: null };
+    }
+    if (!registryLookup.attempted) {
+        return {
+            fired: false,
+            inconclusive: true,
+            inconclusiveReason: registryLookup.failureReason ?? 'network-error',
+        };
+    }
+    if (registryLookup.failureReason) {
+        return { fired: false, inconclusive: true, inconclusiveReason: registryLookup.failureReason };
+    }
+    if (!registryLookup.record) {
+        return { fired: false, inconclusive: true, inconclusiveReason: 'no-registry-record' };
+    }
+    const parsed = localContent !== null ? new SkillParser().parse(localContent) : null;
+    if (!parsed) {
+        // Nothing to contradict with — a local parse failure is a data-quality
+        // fact, not a network-dependent uncertainty, so this is a clean
+        // non-fire, not `inconclusive` (see this module's fileoverview).
+        return { fired: false, inconclusive: false, inconclusiveReason: null };
+    }
+    const localAuthor = normalize(parsed.author);
+    const localName = normalize(parsed.name);
+    const registryAuthor = normalize(registryLookup.record.author);
+    const registryName = normalize(registryLookup.record.name);
+    const authorContradiction = localAuthor !== null &&
+        registryAuthor !== null &&
+        localAuthor.toLowerCase() !== registryAuthor.toLowerCase();
+    const nameContradiction = localName !== null &&
+        registryName !== null &&
+        localName.toLowerCase() !== registryName.toLowerCase();
+    return {
+        fired: authorContradiction || nameContradiction,
+        inconclusive: false,
+        inconclusiveReason: null,
+    };
+}
+// ============================================================================
+// Combined signal classification
+// ============================================================================
+/**
+ * Run all three contradiction signals against a manifest entry. Any one
+ * conclusively firing means `signal` is non-null — order (1, 3, 2) checks
+ * the two deterministic/offline signals first, only falling to the
+ * network-dependent signal 2 when neither of those already answered the
+ * question.
+ */
+export function classifyManifestEntryIdentity(params) {
+    const { entry, localContent, expectedRootDir, registryLookup } = params;
+    if (detectOwnerMismatch(entry)) {
+        return { signal: 'owner-mismatch', inconclusive: false, inconclusiveReason: null };
+    }
+    if (detectPathUnresolved(entry.installPath, expectedRootDir)) {
+        return { signal: 'path-unresolved', inconclusive: false, inconclusiveReason: null };
+    }
+    const signal2 = evaluateFrontmatterContradiction(entry.id, localContent, registryLookup);
+    if (signal2.inconclusive) {
+        return { signal: null, inconclusive: true, inconclusiveReason: signal2.inconclusiveReason };
+    }
+    if (signal2.fired) {
+        return { signal: 'frontmatter-contradiction', inconclusive: false, inconclusiveReason: null };
+    }
+    return { signal: null, inconclusive: false, inconclusiveReason: null };
+}
+// ============================================================================
+// Local-edit detection (local-drift vs outdated)
+// ============================================================================
+/**
+ * Has the on-disk content changed since the manifest's own recorded
+ * install/update-time hash? This is what distinguishes a benign local edit
+ * (`local-drift`) from a genuine registry version bump (`outdated`) once
+ * no identity signal has fired.
+ *
+ * When the manifest never recorded a comparable hash at all (a legacy or
+ * adopted entry, `contentHash`/`originalContentHash` both absent), this
+ * deliberately defaults to `false` (no edit evidence) rather than `true`
+ * (conservative) — absence of a recorded hash is a data-quality gap, not
+ * positive evidence of tampering, and defaulting to `true` here would
+ * misclassify the large population of legacy/adopted entries that never had
+ * a hash recorded as `local-drift` even when they are genuinely just
+ * outdated (SMI-6343 Wave 3 review finding).
+ */
+export function hasRecordedLocalEdit(entry, localHash) {
+    const recordedHash = firstNonBlankHash(entry.contentHash, entry.originalContentHash);
+    if (recordedHash === null || localHash === null)
+        return false;
+    return recordedHash !== localHash;
+}
+// ============================================================================
+// Full divergent-entry classification
+// ============================================================================
+/**
+ * Classify an entry the caller has ALREADY determined is divergent from the
+ * registry (mcp-server: `compareSkillContentHashes(...).outcome ===
+ * 'outdated'`; CLI: `getSkillDiff()` found a version/content difference).
+ * Never returns `'current'` — callers own that trivial case themselves,
+ * since it never needs signal evaluation at all.
+ */
+export function classifyDivergentEntry(params) {
+    const identity = classifyManifestEntryIdentity(params);
+    if (identity.signal) {
+        return { state: 'identity-mismatch', signal: identity.signal, inconclusiveReason: null };
+    }
+    if (identity.inconclusive) {
+        return { state: 'unknown', signal: null, inconclusiveReason: identity.inconclusiveReason };
+    }
+    const hasLocalEdit = hasRecordedLocalEdit(params.entry, params.localHash);
+    return hasLocalEdit
+        ? { state: 'local-drift', signal: null, inconclusiveReason: null }
+        : { state: 'outdated', signal: null, inconclusiveReason: null };
+}
+/**
+ * Full 5-state classification given an already-computed content-comparison
+ * outcome (from `compareSkillContentHashes`) plus the caller-derived reason
+ * a plain `'unknown'` comparison outcome couldn't be resolved (offline,
+ * quota-exhausted, network-error, or no-history — the caller already tracks
+ * which applies; see `outdated.ts`'s `deriveUnknownReason`).
+ */
+export function classifyOutdatedState(params) {
+    if (params.comparisonOutcome === 'current') {
+        return { state: 'current', signal: null, inconclusiveReason: null };
+    }
+    if (params.comparisonOutcome === 'unknown') {
+        return {
+            state: 'unknown',
+            signal: null,
+            inconclusiveReason: params.unknownReasonWhenComparisonUnknown,
+        };
+    }
+    return classifyDivergentEntry(params);
+}
+//# sourceMappingURL=skill-identity-classification.js.map

package/dist/src/services/skill-identity-classification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-identity-classification.js","sourceRoot":"","sources":["../../../src/services/skill-identity-classification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AA8EjE,+EAA+E;AAC/E,4BAA4B;AAC5B,+EAA+E;AAE/E;;;;;;;;;GASG;AACH,SAAS,2BAA2B,CAAC,KAAa;IAChD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACnC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,KAAK,CAAA;IAC3B,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAC3D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAiC;IACpE,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAChD,MAAM,aAAa,GAAG,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;IAC5F,OAAO,2BAA2B,CAAC,aAAa,CAAC,CAAA;AACnD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,EAA6B;IAC5D,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAA;IACpB,OAAO,2BAA2B,CAAC,EAAE,CAAC,CAAA;AACxC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,KAAsD;IAEtD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1C,MAAM,WAAW,GAAG,oBAAoB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACtD,IAAI,CAAC,OAAO,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAA;IAC1C,OAAO,OAAO,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,WAAW,EAAE,CAAA;AAC5D,CAAC;AAED,+EAA+E;AAC/E,6BAA6B;AAC7B,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAsC,EACtC,eAAuB;IAEvB,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAA;IAC7B,MAAM,GAAG,GAAG,QAAQ,CAAC,eAAe,EAAE,WAAW,CAAC,CAAA;IAClD,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,KAAK,CAAA;IAC5B,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAA;AACtE,CAAC;AAYD,SAAS,SAAS,CAAC,KAAgC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,gCAAgC,CACvC,OAAe,EACf,YAA2B,EAC3B,cAAqC;IAErC,IAAI,gBAAgB,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;QACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACxE,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,SAAS,EAAE,CAAC;QAC9B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,YAAY,EAAE,IAAI;YAClB,kBAAkB,EAAE,cAAc,CAAC,aAAa,IAAI,eAAe;SACpE,CAAA;IACH,CAAC;IACD,IAAI,cAAc,CAAC,aAAa,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,cAAc,CAAC,aAAa,EAAE,CAAA;IAC/F,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC;QAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,CAAA;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACnF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,uEAAuE;QACvE,gEAAgE;QAChE,iEAAiE;QACjE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACxE,CAAC;IAED,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC5C,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACxC,MAAM,cAAc,GAAG,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,YAAY,GAAG,SAAS,CAAC,cAAc,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAE1D,MAAM,mBAAmB,GACvB,WAAW,KAAK,IAAI;QACpB,cAAc,KAAK,IAAI;QACvB,WAAW,CAAC,WAAW,EAAE,KAAK,cAAc,CAAC,WAAW,EAAE,CAAA;IAC5D,MAAM,iBAAiB,GACrB,SAAS,KAAK,IAAI;QAClB,YAAY,KAAK,IAAI;QACrB,SAAS,CAAC,WAAW,EAAE,KAAK,YAAY,CAAC,WAAW,EAAE,CAAA;IAExD,OAAO;QACL,KAAK,EAAE,mBAAmB,IAAI,iBAAiB;QAC/C,YAAY,EAAE,KAAK;QACnB,kBAAkB,EAAE,IAAI;KACzB,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,MAK7C;IACC,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,MAAM,CAAA;IAEvE,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACpF,CAAC;IACD,IAAI,oBAAoB,CAAC,KAAK,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QAC7D,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACrF,CAAC;IAED,MAAM,OAAO,GAAG,gCAAgC,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,EAAE,cAAc,CAAC,CAAA;IACxF,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,CAAC,kBAAkB,EAAE,CAAA;IAC7F,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,2BAA2B,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IAC/F,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;AACxE,CAAC;AAED,+EAA+E;AAC/E,iDAAiD;AACjD,+EAA+E;AAE/E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAA4E,EAC5E,SAAwB;IAExB,MAAM,YAAY,GAAG,iBAAiB,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAA;IACpF,IAAI,YAAY,KAAK,IAAI,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,KAAK,CAAA;IAC7D,OAAO,YAAY,KAAK,SAAS,CAAA;AACnC,CAAC;AAED,+EAA+E;AAC/E,sCAAsC;AACtC,+EAA+E;AAE/E;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAMtC;IACC,MAAM,QAAQ,GAAG,6BAA6B,CAAC,MAAM,CAAC,CAAA;IACtD,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACpB,OAAO,EAAE,KAAK,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IAC1F,CAAC;IACD,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;QAC1B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAA;IAC5F,CAAC;IAED,MAAM,YAAY,GAAG,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;IACzE,OAAO,YAAY;QACjB,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE;QAClE,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAQrC;IAKC,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAA;IACrE,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3C,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,IAAI;YACZ,kBAAkB,EAAE,MAAM,CAAC,kCAAkC;SAC9D,CAAA;IACH,CAAC;IACD,OAAO,sBAAsB,CAAC,MAAM,CAAC,CAAA;AACvC,CAAC"}

package/dist/src/services/skill-identity-classification.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * @fileoverview Unit tests for the shared skill-identity classification module
+ * @see SMI-6343 Wave 3 — tamper-check classification (AC#3)
+ */
+export {};
+//# sourceMappingURL=skill-identity-classification.test.d.ts.map

package/dist/src/services/skill-identity-classification.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-identity-classification.test.d.ts","sourceRoot":"","sources":["../../../src/services/skill-identity-classification.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}