@skillsmith/core 0.4.16 → 0.5.0

package/dist/src/security/scanner/weights.js.map

@@ -1 +1 @@
-{"version":3,"file":"weights.js","sourceRoot":"","sources":["../../../../src/security/scanner/weights.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC;IAChE,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,EAAE;CACb,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,SAAS,EAAE,GAAG;IACd,kBAAkB,EAAE,GAAG;IACvB,cAAc,EAAE,GAAG;IACnB,iBAAiB,EAAE,GAAG;IACtB,oBAAoB,EAAE,GAAG;IACzB,kBAAkB,EAAE,GAAG;IACvB,cAAc,EAAE,GAAG;IACnB,GAAG,EAAE,GAAG;IACR,UAAU,EAAE,GAAG,EAAE,iDAAiD;CACnE,CAAA"}
+{"version":3,"file":"weights.js","sourceRoot":"","sources":["../../../../src/security/scanner/weights.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC;IAChE,GAAG,EAAE,CAAC;IACN,MAAM,EAAE,EAAE;IACV,IAAI,EAAE,EAAE;IACR,QAAQ,EAAE,EAAE;CACb,CAAA;AAED;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAA2B;IACtD,SAAS,EAAE,GAAG;IACd,kBAAkB,EAAE,GAAG;IACvB,cAAc,EAAE,GAAG;IACnB,iBAAiB,EAAE,GAAG;IACtB,oBAAoB,EAAE,GAAG;IACzB,kBAAkB,EAAE,GAAG;IACvB,cAAc,EAAE,GAAG;IACnB,GAAG,EAAE,GAAG;IACR,UAAU,EAAE,GAAG,EAAE,iDAAiD;IAClE,IAAI,EAAE,GAAG,EAAE,uCAAuC;IAClD,GAAG,EAAE,GAAG,EAAE,8CAA8C;CACzD,CAAA"}

package/dist/src/services/skill-config-schema.d.ts

@@ -0,0 +1,36 @@
+/**
+ * @fileoverview Zod schema for skill config.json validation
+ * @module @skillsmith/core/services/skill-config-schema
+ * @see SMI-3870: Config.json Schema Validation
+ *
+ * Validates config.json files fetched during skill installation.
+ * v1 uses .passthrough() — logs unknown keys as warnings but does not reject.
+ */
+import { z } from 'zod';
+/**
+ * Schema for skill config.json files.
+ * v1: passthrough mode — unknown keys logged as warnings, not rejected.
+ * Switch to .strict() after publishing the schema spec.
+ */
+export declare const SkillConfigSchema: z.ZodObject<{
+    displayName: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+    presets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    settings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    mcpServers: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    minClaudeCodeVersion: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type SkillConfig = z.infer<typeof SkillConfigSchema>;
+export interface ConfigValidationResult {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+    /** Sanitized config (only if valid) */
+    config?: SkillConfig;
+}
+/**
+ * Validate a config.json string against the skill config schema.
+ * Returns validation result with errors and warnings for unknown keys.
+ */
+export declare function validateSkillConfig(content: string): ConfigValidationResult;
+//# sourceMappingURL=skill-config-schema.d.ts.map

package/dist/src/services/skill-config-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-config-schema.d.ts","sourceRoot":"","sources":["../../../src/services/skill-config-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;;;;;;;iBAmBd,CAAA;AAEhB,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAW3D,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,uCAAuC;IACvC,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,CA+B3E"}

package/dist/src/services/skill-config-schema.js

@@ -0,0 +1,76 @@
+/**
+ * @fileoverview Zod schema for skill config.json validation
+ * @module @skillsmith/core/services/skill-config-schema
+ * @see SMI-3870: Config.json Schema Validation
+ *
+ * Validates config.json files fetched during skill installation.
+ * v1 uses .passthrough() — logs unknown keys as warnings but does not reject.
+ */
+import { z } from 'zod';
+/**
+ * Schema for skill config.json files.
+ * v1: passthrough mode — unknown keys logged as warnings, not rejected.
+ * Switch to .strict() after publishing the schema spec.
+ */
+export const SkillConfigSchema = z
+    .object({
+    /** Skill display name override */
+    displayName: z.string().max(100).optional(),
+    /** Version constraint */
+    version: z.string().max(20).optional(),
+    /** Configuration presets (values must be primitives) */
+    presets: z
+        .record(z.string(), z.union([z.string().max(500), z.number(), z.boolean()]))
+        .optional(),
+    /** Custom settings (values must be primitives) */
+    settings: z
+        .record(z.string().max(50), z.union([z.string().max(500), z.number(), z.boolean()]))
+        .optional(),
+    /** MCP server requirements */
+    mcpServers: z.array(z.string().max(100)).max(10).optional(),
+    /** Minimum Claude Code version */
+    minClaudeCodeVersion: z.string().max(20).optional(),
+})
+    .passthrough();
+const KNOWN_KEYS = [
+    'displayName',
+    'version',
+    'presets',
+    'settings',
+    'mcpServers',
+    'minClaudeCodeVersion',
+];
+/**
+ * Validate a config.json string against the skill config schema.
+ * Returns validation result with errors and warnings for unknown keys.
+ */
+export function validateSkillConfig(content) {
+    try {
+        const parsed = JSON.parse(content);
+        const result = SkillConfigSchema.safeParse(parsed);
+        if (!result.success) {
+            return {
+                valid: false,
+                errors: result.error.issues.map((i) => i.path.join('.') + ': ' + i.message),
+                warnings: [],
+            };
+        }
+        // v1 passthrough: log unknown keys as warnings
+        const warnings = [];
+        if (parsed !== null && typeof parsed === 'object') {
+            const unknownKeys = Object.keys(parsed).filter((k) => !KNOWN_KEYS.includes(k));
+            if (unknownKeys.length > 0) {
+                warnings.push('config.json contains unknown keys: ' + unknownKeys.join(', ') + '. These are ignored.');
+            }
+        }
+        return { valid: true, errors: [], warnings, config: result.data };
+    }
+    catch (e) {
+        return {
+            valid: false,
+            errors: ['Invalid JSON: ' + (e instanceof Error ? e.message : 'parse error')],
+            warnings: [],
+        };
+    }
+}
+//# sourceMappingURL=skill-config-schema.js.map

package/dist/src/services/skill-config-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-config-schema.js","sourceRoot":"","sources":["../../../src/services/skill-config-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,kCAAkC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,wDAAwD;IACxD,OAAO,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;SAC3E,QAAQ,EAAE;IACb,kDAAkD;IAClD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;SACnF,QAAQ,EAAE;IACb,8BAA8B;IAC9B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,kCAAkC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,WAAW,EAAE,CAAA;AAIhB,MAAM,UAAU,GAAG;IACjB,aAAa;IACb,SAAS;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,sBAAsB;CACvB,CAAA;AAUD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC;gBAC3E,QAAQ,EAAE,EAAE;aACb,CAAA;QACH,CAAC;QACD,+CAA+C;QAC/C,MAAM,QAAQ,GAAa,EAAE,CAAA;QAC7B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,CAAC,MAAM,CACvE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC/B,CAAA;YACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CACX,qCAAqC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,sBAAsB,CACxF,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IACnE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,gBAAgB,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAC7E,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/src/services/skill-installation.feedback.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @fileoverview AIDefence feedback + risk trend helpers for install pipeline
+ * @module @skillsmith/core/services/skill-installation.feedback
+ * @see SMI-3873: AIDefence Learning Loop
+ * @see SMI-3874: Risk Trend Detection
+ */
+import type { ScanReport } from '../security/index.js';
+import type { RiskScoreHistoryRepository } from '../repositories/RiskScoreHistoryRepository.js';
+import type { AiDefenceFeedback } from './skill-installation.types.js';
+/** SMI-3873: Record AIDefence learning feedback. Best-effort, non-blocking. */
+export declare function recordAiDefenceFeedback(params: {
+    feedback: AiDefenceFeedback | undefined;
+    skillMdContent: string;
+    scanReport: ScanReport | undefined;
+    blocked: boolean;
+}): void;
+/** SMI-3874: Collect risk trend warnings from scan history. */
+export declare function collectTrendWarnings(params: {
+    historyRepo: RiskScoreHistoryRepository | undefined;
+    skillId: string;
+    scanReport: ScanReport;
+    contentHash: string | null;
+}): string[];
+//# sourceMappingURL=skill-installation.feedback.d.ts.map

package/dist/src/services/skill-installation.feedback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.feedback.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.feedback.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAA;AAC/F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAGtE,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAA;IACvC,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,UAAU,GAAG,SAAS,CAAA;IAClC,OAAO,EAAE,OAAO,CAAA;CACjB,GAAG,IAAI,CAaP;AAED,+DAA+D;AAC/D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,WAAW,EAAE,0BAA0B,GAAG,SAAS,CAAA;IACnD,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B,GAAG,MAAM,EAAE,CASX"}

package/dist/src/services/skill-installation.feedback.js

@@ -0,0 +1,37 @@
+/**
+ * @fileoverview AIDefence feedback + risk trend helpers for install pipeline
+ * @module @skillsmith/core/services/skill-installation.feedback
+ * @see SMI-3873: AIDefence Learning Loop
+ * @see SMI-3874: Risk Trend Detection
+ */
+import { detectRiskTrend } from '../security/risk-trend.js';
+/** SMI-3873: Record AIDefence learning feedback. Best-effort, non-blocking. */
+export function recordAiDefenceFeedback(params) {
+    if (!params.feedback || !params.scanReport)
+        return;
+    const report = params.scanReport;
+    params.feedback
+        .recordFeedback({
+        input: params.skillMdContent.slice(0, 1000),
+        wasAccurate: true,
+        verdict: params.blocked ? 'true_positive' : report.passed ? 'true_negative' : 'true_positive',
+        threatType: !report.passed ? report.findings[0]?.type : undefined,
+        mitigation: params.blocked ? 'block' : report.passed ? 'log' : 'block',
+        mitigationSuccess: true,
+    })
+        .catch(() => { }); // best-effort
+}
+/** SMI-3874: Collect risk trend warnings from scan history. */
+export function collectTrendWarnings(params) {
+    if (!params.historyRepo)
+        return [];
+    try {
+        const history = params.historyRepo.getHistory(params.skillId, 5);
+        const trend = detectRiskTrend(params.scanReport.riskScore, history);
+        return trend.anomaly ? [trend.message] : [];
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=skill-installation.feedback.js.map

package/dist/src/services/skill-installation.feedback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.feedback.js","sourceRoot":"","sources":["../../../src/services/skill-installation.feedback.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAE3D,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,MAKvC;IACC,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,OAAM;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAA;IAChC,MAAM,CAAC,QAAQ;SACZ,cAAc,CAAC;QACd,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;QAC3C,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe;QAC7F,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,SAAS;QACjE,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;QACtE,iBAAiB,EAAE,IAAI;KACxB,CAAC;SACD,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA,CAAC,cAAc;AACnC,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,oBAAoB,CAAC,MAKpC;IACC,IAAI,CAAC,MAAM,CAAC,WAAW;QAAE,OAAO,EAAE,CAAA;IAClC,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAA;QAChE,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;QACnE,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;AACH,CAAC"}

package/dist/src/services/skill-installation.helpers.d.ts

@@ -0,0 +1,88 @@
+/**
+ * @fileoverview Helper functions for SkillInstallationService
+ * @module @skillsmith/core/services/skill-installation.helpers
+ * @see SMI-3483: Wave 0 — Extract SkillInstallationService into core
+ *
+ * Pure helper functions used by the service. Split from the main service
+ * file to meet the 500-line standard.
+ */
+import type { SkillDependencyRepository } from '../repositories/SkillDependencyRepository.js';
+import type { Database } from '../db/database-interface.js';
+import type { RiskScoreHistoryRepository } from '../repositories/RiskScoreHistoryRepository.js';
+import type { ScanReport } from '../security/index.js';
+import type { DepIntelResult, OptimizationInfo, ProgressCallback, QuarantineStatus, UninstallResult } from './skill-installation.types.js';
+import type { ManifestManager } from './skill-manifest.js';
+/** Result of applying optimization to a skill's content. */
+export interface OptimizationResult {
+    finalSkillContent: string;
+    subSkillFiles: Array<{
+        filename: string;
+        content: string;
+    }>;
+    subagentContent: string | undefined;
+    claudeMdSnippet: string | undefined;
+    optimizationInfo: OptimizationInfo;
+}
+export interface ParsedSkillId {
+    owner: string;
+    repo: string;
+    path: string;
+    isRegistryId: boolean;
+}
+export declare function parseSkillIdInternal(input: string): ParsedSkillId;
+export declare function hashContent(content: string): string;
+export interface SkillMdValidation {
+    valid: boolean;
+    errors: string[];
+}
+export declare function validateSkillMd(content: string): SkillMdValidation;
+export declare function assertNotEncrypted(content: string, filePath: string): void;
+export declare function fetchFromGitHub(owner: string, repo: string, filePath: string, branch?: string): Promise<string>;
+export declare function checkForModifications(skillPath: string, installedAt: string): Promise<boolean>;
+export declare function generateTips(skillName: string, optimizationInfo: OptimizationInfo): string[];
+export declare function extractDepIntel(skillMdContent: string): DepIntelResult;
+export declare function persistDependencies(repo: SkillDependencyRepository, skillId: string, content: string, declared: DepIntelResult['dep_declared']): void;
+/** Perform skill uninstall with manifest awareness and orphan fallback. */
+export declare function performUninstall(params: {
+    skillName: string;
+    force: boolean;
+    skillsDir: string;
+    manifest: ManifestManager;
+    skillDependencyRepo: SkillDependencyRepository;
+    onProgress: ProgressCallback;
+}): Promise<UninstallResult>;
+/**
+ * Apply skill optimization via TransformationService.
+ * Returns original content if transformation fails or produces no changes.
+ */
+export declare function applyOptimization(db: Database, skillId: string, skillName: string, skillMdContent: string): Promise<OptimizationResult>;
+export declare function sanitizeInstallError(error: unknown): string;
+/** Compute quality score (0-1) from scan report and skill metadata. */
+export declare function computeAndAttachQualityScore(params: {
+    scanReport: ScanReport | undefined;
+    description: string | null;
+    tagCount: number;
+    hasRepoUrl: boolean;
+    hasAuthor: boolean;
+    trustTier: string;
+    hasExamples: boolean;
+}): number;
+/** Record a risk score snapshot. Best-effort: swallows errors. */
+export declare function recordRiskHistory(params: {
+    historyRepo: RiskScoreHistoryRepository | undefined;
+    skillId: string;
+    scanReport: ScanReport;
+    contentHash: string | null;
+    source: 'install' | 'indexer' | 'rescan';
+}): void;
+/** SMI-3870: Validate config.json content; returns validity and warnings. */
+export declare function validateOptionalConfig(content: string): {
+    valid: boolean;
+    warnings: string[];
+};
+/** SMI-3871: Cross-reference dependency targets against quarantine status. */
+export declare function checkDepsAgainstQuarantine(depIntel: DepIntelResult, getStatus: (skillId: string) => QuarantineStatus | null): {
+    warnings: string[];
+    quarantinedDeps: string[];
+};
+//# sourceMappingURL=skill-installation.helpers.d.ts.map

package/dist/src/services/skill-installation.helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.helpers.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAA;AAI7F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAE3D,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAA;AAC/F,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EAChB,MAAM,+BAA+B,CAAA;AAGtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AAE1D,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,iBAAiB,EAAE,MAAM,CAAA;IACzB,aAAa,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC3D,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAA;IACnC,gBAAgB,EAAE,gBAAgB,CAAA;CACnC;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,OAAO,CAAA;CACtB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CA+BjE;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEnD;AACD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,CASlE;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ1E;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,gBAAgB,EAAE,gBAAgB,GAAG,MAAM,EAAE,CAsB5F;AAED,wBAAgB,eAAe,CAAC,cAAc,EAAE,MAAM,GAAG,cAAc,CAWtE;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,yBAAyB,EAC/B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,cAAc,CAAC,cAAc,CAAC,GACvC,IAAI,CAyBN;AAED,2EAA2E;AAC3E,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAC7C,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,OAAO,CAAA;IACd,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,eAAe,CAAA;IACzB,mBAAmB,EAAE,yBAAyB,CAAA;IAC9C,UAAU,EAAE,gBAAgB,CAAA;CAC7B,GAAG,OAAO,CAAC,eAAe,CAAC,CAuF3B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC,CA8C7B;AAiBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAO3D;AAGD,uEAAuE;AACvE,wBAAgB,4BAA4B,CAAC,MAAM,EAAE;IACnD,UAAU,EAAE,UAAU,GAAG,SAAS,CAAA;IAClC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,OAAO,CAAA;CACrB,GAAG,MAAM,CAYT;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE;IACxC,WAAW,EAAE,0BAA0B,GAAG,SAAS,CAAA;IACnD,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAA;CACzC,GAAG,IAAI,CAcP;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG;IACvD,KAAK,EAAE,OAAO,CAAA;IACd,QAAQ,EAAE,MAAM,EAAE,CAAA;CACnB,CAMA;AAED,8EAA8E;AAC9E,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,GACtD;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;IAAC,eAAe,EAAE,MAAM,EAAE,CAAA;CAAE,CAqBnD"}