@skillsmith/core 0.5.4 → 0.5.6

package/dist/services/quarantine/QuarantineService.d.ts

@@ -0,0 +1,136 @@
+/**
+ * SMI-2269: Quarantine Service with Authentication
+ * SMI-2277: Persist multi-approval state to database
+ * @see SMI-2741: Multi-approval workflow split to QuarantineService.multiapproval.ts
+ *
+ * Service layer for quarantine operations that enforces authentication
+ * and authorization. Wraps QuarantineRepository with security controls.
+ *
+ * VP Engineering Guidance:
+ * - Auth belongs in service/handler layer, not repository
+ * - Repositories should be pure data access
+ *
+ * Security Controls:
+ * - QUA-002: Requires authenticated session for review operations
+ * - Enforces security_reviewer permission for review access
+ * - Multi-approval workflow for MALICIOUS severity
+ * - Audit logs include verified reviewer identity
+ * - Approval state persisted to database (survives restarts)
+ *
+ * @module @skillsmith/core/services/quarantine/QuarantineService
+ */
+import type { QuarantineRepository } from '../../repositories/quarantine/index.js';
+import type { ApprovalRepository } from '../../repositories/quarantine/ApprovalRepository.js';
+import type { AuditLogger } from '../../security/AuditLogger.js';
+import type { AuthenticatedSession, AuthenticatedReviewInput, AuthenticatedReviewResult, MultiApprovalStatus } from './types.js';
+export { handleMaliciousApproval, buildMultiApprovalStatus, } from './QuarantineService.multiapproval.js';
+export { MALICIOUS_APPROVAL_COUNT, MULTI_APPROVAL_TIMEOUT_MS, } from './QuarantineService.multiapproval.js';
+/**
+ * Quarantine Service with Authentication
+ *
+ * Provides authenticated access to quarantine operations with:
+ * - Session validation
+ * - Permission checks (security_reviewer role)
+ * - Multi-approval workflow for MALICIOUS severity
+ * - Audit logging with verified identities
+ * - Database-persisted approval state (SMI-2277)
+ *
+ * @example
+ * ```typescript
+ * const service = new QuarantineService(repository, approvalRepository, auditLogger)
+ *
+ * // Review a quarantined skill (requires authentication)
+ * const result = await service.review(
+ *   session,
+ *   quarantineId,
+ *   { reviewStatus: 'approved', reviewNotes: 'Verified safe' }
+ * )
+ * ```
+ */
+export declare class QuarantineService {
+    private readonly repository;
+    private readonly approvalRepository;
+    private readonly auditLogger;
+    constructor(repository: QuarantineRepository, approvalRepository: ApprovalRepository, auditLogger: AuditLogger);
+    /**
+     * Find a quarantine entry by ID
+     *
+     * @param session - Authenticated session
+     * @param id - Quarantine entry ID
+     * @returns Quarantine entry or null
+     */
+    findById(session: AuthenticatedSession, id: string): import("../../repositories/quarantine/types.js").QuarantineEntry | null;
+    /**
+     * Find quarantine entries for a skill
+     *
+     * @param session - Authenticated session
+     * @param skillId - Skill ID
+     * @returns Array of quarantine entries
+     */
+    findBySkillId(session: AuthenticatedSession, skillId: string): import("../../repositories/quarantine/types.js").QuarantineEntry[];
+    /**
+     * Find all quarantine entries with optional filtering
+     *
+     * @param session - Authenticated session
+     * @param filter - Query filters
+     * @returns Paginated quarantine results
+     */
+    findAll(session: AuthenticatedSession, filter?: Parameters<QuarantineRepository['findAll']>[0]): import("../../repositories/quarantine/types.js").PaginatedQuarantineResults;
+    /**
+     * Get quarantine statistics
+     *
+     * @param session - Authenticated session
+     * @returns Quarantine statistics
+     */
+    getStats(session: AuthenticatedSession): import("../../repositories/quarantine/types.js").QuarantineStats;
+    /**
+     * Review a quarantine entry with authentication
+     *
+     * This is the secure replacement for QuarantineRepository.review().
+     * It enforces:
+     * - Valid authenticated session
+     * - security_reviewer permission (quarantine:review)
+     * - Multi-approval for MALICIOUS severity (quarantine:review_malicious)
+     * - Audit logging with verified reviewer identity
+     *
+     * @param session - Authenticated session (verified by auth layer)
+     * @param quarantineId - Quarantine entry ID to review
+     * @param input - Review decision and notes
+     * @returns Review result with verified reviewer identity
+     * @throws QuarantineServiceError on auth/permission failure
+     */
+    review(session: AuthenticatedSession, quarantineId: string, input: AuthenticatedReviewInput): AuthenticatedReviewResult;
+    /**
+     * Get pending multi-approval status for a quarantine entry
+     *
+     * @param session - Authenticated session
+     * @param quarantineId - Quarantine entry ID
+     * @returns Multi-approval status or null
+     */
+    getMultiApprovalStatus(session: AuthenticatedSession, quarantineId: string): MultiApprovalStatus | null;
+    /**
+     * Cancel a pending multi-approval workflow
+     *
+     * @param session - Authenticated session (requires admin)
+     * @param quarantineId - Quarantine entry ID
+     * @returns Whether the cancellation was successful
+     */
+    cancelMultiApproval(session: AuthenticatedSession, quarantineId: string): boolean;
+    /**
+     * Create a quarantine entry (admin only)
+     *
+     * @param session - Authenticated session
+     * @param input - Quarantine creation input
+     * @returns Created quarantine entry
+     */
+    create(session: AuthenticatedSession, input: Parameters<QuarantineRepository['create']>[0]): import("../../repositories/quarantine/types.js").QuarantineEntry;
+    /**
+     * Delete a quarantine entry (admin only)
+     *
+     * @param session - Authenticated session
+     * @param id - Quarantine entry ID
+     * @returns Whether the entry was deleted
+     */
+    delete(session: AuthenticatedSession, id: string): boolean;
+}
+//# sourceMappingURL=QuarantineService.d.ts.map

package/dist/services/quarantine/QuarantineService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuarantineService.d.ts","sourceRoot":"","sources":["../../../src/services/quarantine/QuarantineService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAA;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAA;AAC7F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAQnB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,sCAAsC,CAAA;AAM7C;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAFX,UAAU,EAAE,oBAAoB,EAChC,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,WAAW;IAO3C;;;;;;OAMG;IACH,QAAQ,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM;IAKlD;;;;;;OAMG;IACH,aAAa,CAAC,OAAO,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM;IAK5D;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAK9F;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,EAAE,oBAAoB;IAStC;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CACJ,OAAO,EAAE,oBAAoB,EAC7B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,wBAAwB,GAC9B,yBAAyB;IA4F5B;;;;;;OAMG;IACH,sBAAsB,CACpB,OAAO,EAAE,oBAAoB,EAC7B,YAAY,EAAE,MAAM,GACnB,mBAAmB,GAAG,IAAI;IAW7B;;;;;;OAMG;IACH,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO;IA8BjF;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,oBAAoB,EAAE,KAAK,EAAE,UAAU,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAK1F;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,oBAAoB,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO;CAQ3D"}

package/dist/services/quarantine/QuarantineService.js

@@ -0,0 +1,267 @@
+/**
+ * SMI-2269: Quarantine Service with Authentication
+ * SMI-2277: Persist multi-approval state to database
+ * @see SMI-2741: Multi-approval workflow split to QuarantineService.multiapproval.ts
+ *
+ * Service layer for quarantine operations that enforces authentication
+ * and authorization. Wraps QuarantineRepository with security controls.
+ *
+ * VP Engineering Guidance:
+ * - Auth belongs in service/handler layer, not repository
+ * - Repositories should be pure data access
+ *
+ * Security Controls:
+ * - QUA-002: Requires authenticated session for review operations
+ * - Enforces security_reviewer permission for review access
+ * - Multi-approval workflow for MALICIOUS severity
+ * - Audit logs include verified reviewer identity
+ * - Approval state persisted to database (survives restarts)
+ *
+ * @module @skillsmith/core/services/quarantine/QuarantineService
+ */
+import { QuarantineServiceError, requirePermission } from './types.js';
+import { handleMaliciousApproval, buildMultiApprovalStatus, } from './QuarantineService.multiapproval.js';
+// Re-export multi-approval functions for public API
+export { handleMaliciousApproval, buildMultiApprovalStatus, } from './QuarantineService.multiapproval.js';
+export { MALICIOUS_APPROVAL_COUNT, MULTI_APPROVAL_TIMEOUT_MS, } from './QuarantineService.multiapproval.js';
+// ============================================================================
+// Service Implementation
+// ============================================================================
+/**
+ * Quarantine Service with Authentication
+ *
+ * Provides authenticated access to quarantine operations with:
+ * - Session validation
+ * - Permission checks (security_reviewer role)
+ * - Multi-approval workflow for MALICIOUS severity
+ * - Audit logging with verified identities
+ * - Database-persisted approval state (SMI-2277)
+ *
+ * @example
+ * ```typescript
+ * const service = new QuarantineService(repository, approvalRepository, auditLogger)
+ *
+ * // Review a quarantined skill (requires authentication)
+ * const result = await service.review(
+ *   session,
+ *   quarantineId,
+ *   { reviewStatus: 'approved', reviewNotes: 'Verified safe' }
+ * )
+ * ```
+ */
+export class QuarantineService {
+    repository;
+    approvalRepository;
+    auditLogger;
+    constructor(repository, approvalRepository, auditLogger) {
+        this.repository = repository;
+        this.approvalRepository = approvalRepository;
+        this.auditLogger = auditLogger;
+    }
+    // ==========================================================================
+    // Read Operations (require quarantine:read permission)
+    // ==========================================================================
+    /**
+     * Find a quarantine entry by ID
+     *
+     * @param session - Authenticated session
+     * @param id - Quarantine entry ID
+     * @returns Quarantine entry or null
+     */
+    findById(session, id) {
+        requirePermission(session, 'quarantine:read');
+        return this.repository.findById(id);
+    }
+    /**
+     * Find quarantine entries for a skill
+     *
+     * @param session - Authenticated session
+     * @param skillId - Skill ID
+     * @returns Array of quarantine entries
+     */
+    findBySkillId(session, skillId) {
+        requirePermission(session, 'quarantine:read');
+        return this.repository.findBySkillId(skillId);
+    }
+    /**
+     * Find all quarantine entries with optional filtering
+     *
+     * @param session - Authenticated session
+     * @param filter - Query filters
+     * @returns Paginated quarantine results
+     */
+    findAll(session, filter) {
+        requirePermission(session, 'quarantine:read');
+        return this.repository.findAll(filter);
+    }
+    /**
+     * Get quarantine statistics
+     *
+     * @param session - Authenticated session
+     * @returns Quarantine statistics
+     */
+    getStats(session) {
+        requirePermission(session, 'quarantine:read');
+        return this.repository.getStats();
+    }
+    // ==========================================================================
+    // Review Operations (require quarantine:review permission)
+    // ==========================================================================
+    /**
+     * Review a quarantine entry with authentication
+     *
+     * This is the secure replacement for QuarantineRepository.review().
+     * It enforces:
+     * - Valid authenticated session
+     * - security_reviewer permission (quarantine:review)
+     * - Multi-approval for MALICIOUS severity (quarantine:review_malicious)
+     * - Audit logging with verified reviewer identity
+     *
+     * @param session - Authenticated session (verified by auth layer)
+     * @param quarantineId - Quarantine entry ID to review
+     * @param input - Review decision and notes
+     * @returns Review result with verified reviewer identity
+     * @throws QuarantineServiceError on auth/permission failure
+     */
+    review(session, quarantineId, input) {
+        // Validate session and require review permission
+        requirePermission(session, 'quarantine:review');
+        // Get the quarantine entry
+        const entry = this.repository.findById(quarantineId);
+        if (!entry) {
+            throw new QuarantineServiceError(`Quarantine entry not found: ${quarantineId}`, 'NOT_FOUND', {
+                quarantineId,
+            });
+        }
+        // Check if already reviewed
+        if (entry.reviewStatus !== 'pending') {
+            throw new QuarantineServiceError(`Quarantine entry already reviewed: ${entry.reviewStatus}`, 'ALREADY_REVIEWED', { quarantineId, currentStatus: entry.reviewStatus });
+        }
+        // For MALICIOUS severity, require multi-approval workflow
+        if (entry.severity === 'MALICIOUS' && input.reviewStatus === 'approved') {
+            return handleMaliciousApproval(session, quarantineId, entry.skillId, input, this.repository, this.approvalRepository, this.auditLogger);
+        }
+        // For MALICIOUS severity rejection or non-MALICIOUS, check elevated permission
+        if (entry.severity === 'MALICIOUS') {
+            requirePermission(session, 'quarantine:review_malicious');
+        }
+        // Perform the review with verified identity
+        const reviewResult = this.repository.review(quarantineId, {
+            reviewedBy: session.email, // Verified email from session
+            reviewStatus: input.reviewStatus,
+            reviewNotes: input.reviewNotes,
+        });
+        if (!reviewResult) {
+            throw new QuarantineServiceError('Failed to review quarantine entry', 'INVALID_INPUT', {
+                quarantineId,
+            });
+        }
+        // Log audit event with full session details
+        this.auditLogger.log({
+            event_type: 'quarantine_authenticated_review',
+            actor: 'reviewer',
+            resource: entry.skillId,
+            action: 'review',
+            result: 'success',
+            metadata: {
+                quarantineId,
+                reviewStatus: input.reviewStatus,
+                reviewer: {
+                    userId: session.userId,
+                    email: session.email,
+                    displayName: session.displayName,
+                },
+                sessionId: session.sessionId,
+                severity: entry.severity,
+                canImport: reviewResult.canImport,
+            },
+        });
+        return {
+            success: true,
+            approved: reviewResult.approved,
+            skillId: reviewResult.skillId,
+            severity: reviewResult.severity,
+            canImport: reviewResult.canImport,
+            warnings: reviewResult.warnings,
+            reviewedBy: {
+                userId: session.userId,
+                email: session.email,
+                displayName: session.displayName,
+            },
+        };
+    }
+    // ==========================================================================
+    // Multi-Approval Status Operations
+    // ==========================================================================
+    /**
+     * Get pending multi-approval status for a quarantine entry
+     *
+     * @param session - Authenticated session
+     * @param quarantineId - Quarantine entry ID
+     * @returns Multi-approval status or null
+     */
+    getMultiApprovalStatus(session, quarantineId) {
+        requirePermission(session, 'quarantine:read');
+        const pendingApprovals = this.approvalRepository.getPendingApprovals(quarantineId);
+        if (pendingApprovals.length === 0) {
+            return null;
+        }
+        return buildMultiApprovalStatus(quarantineId, pendingApprovals);
+    }
+    /**
+     * Cancel a pending multi-approval workflow
+     *
+     * @param session - Authenticated session (requires admin)
+     * @param quarantineId - Quarantine entry ID
+     * @returns Whether the cancellation was successful
+     */
+    cancelMultiApproval(session, quarantineId) {
+        requirePermission(session, 'quarantine:admin');
+        const pendingApprovals = this.approvalRepository.getPendingApprovals(quarantineId);
+        if (pendingApprovals.length === 0) {
+            return false;
+        }
+        this.approvalRepository.clearApprovals(quarantineId);
+        this.auditLogger.log({
+            event_type: 'quarantine_multi_approval_cancelled',
+            actor: 'reviewer',
+            resource: quarantineId,
+            action: 'cancel',
+            result: 'success',
+            metadata: {
+                quarantineId,
+                cancelledBy: session.email,
+                pendingApprovals: pendingApprovals.length,
+            },
+        });
+        return true;
+    }
+    // ==========================================================================
+    // Admin Operations (require quarantine:admin permission)
+    // ==========================================================================
+    /**
+     * Create a quarantine entry (admin only)
+     *
+     * @param session - Authenticated session
+     * @param input - Quarantine creation input
+     * @returns Created quarantine entry
+     */
+    create(session, input) {
+        requirePermission(session, 'quarantine:create');
+        return this.repository.create(input);
+    }
+    /**
+     * Delete a quarantine entry (admin only)
+     *
+     * @param session - Authenticated session
+     * @param id - Quarantine entry ID
+     * @returns Whether the entry was deleted
+     */
+    delete(session, id) {
+        requirePermission(session, 'quarantine:delete');
+        // Cancel any pending multi-approval
+        this.approvalRepository.clearApprovals(id);
+        return this.repository.delete(id);
+    }
+}
+//# sourceMappingURL=QuarantineService.js.map

package/dist/services/quarantine/QuarantineService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuarantineService.js","sourceRoot":"","sources":["../../../src/services/quarantine/QuarantineService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAWH,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,sCAAsC,CAAA;AAE7C,oDAAoD;AACpD,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,sCAAsC,CAAA;AAC7C,OAAO,EACL,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,sCAAsC,CAAA;AAE7C,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IAHnB,YACmB,UAAgC,EAChC,kBAAsC,EACtC,WAAwB;QAFxB,eAAU,GAAV,UAAU,CAAsB;QAChC,uBAAkB,GAAlB,kBAAkB,CAAoB;QACtC,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,6EAA6E;IAC7E,uDAAuD;IACvD,6EAA6E;IAE7E;;;;;;OAMG;IACH,QAAQ,CAAC,OAA6B,EAAE,EAAU;QAChD,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;QAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IACrC,CAAC;IAED;;;;;;OAMG;IACH,aAAa,CAAC,OAA6B,EAAE,OAAe;QAC1D,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;QAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,CAAA;IAC/C,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,OAA6B,EAAE,MAAuD;QAC5F,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;QAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IACxC,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,OAA6B;QACpC,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;QAC7C,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAA;IACnC,CAAC;IAED,6EAA6E;IAC7E,2DAA2D;IAC3D,6EAA6E;IAE7E;;;;;;;;;;;;;;;OAeG;IACH,MAAM,CACJ,OAA6B,EAC7B,YAAoB,EACpB,KAA+B;QAE/B,iDAAiD;QACjD,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;QAE/C,2BAA2B;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAA;QACpD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,sBAAsB,CAAC,+BAA+B,YAAY,EAAE,EAAE,WAAW,EAAE;gBAC3F,YAAY;aACb,CAAC,CAAA;QACJ,CAAC;QAED,4BAA4B;QAC5B,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACrC,MAAM,IAAI,sBAAsB,CAC9B,sCAAsC,KAAK,CAAC,YAAY,EAAE,EAC1D,kBAAkB,EAClB,EAAE,YAAY,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CACpD,CAAA;QACH,CAAC;QAED,0DAA0D;QAC1D,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,IAAI,KAAK,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACxE,OAAO,uBAAuB,CAC5B,OAAO,EACP,YAAY,EACZ,KAAK,CAAC,OAAO,EACb,KAAK,EACL,IAAI,CAAC,UAAU,EACf,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,WAAW,CACjB,CAAA;QACH,CAAC;QAED,+EAA+E;QAC/E,IAAI,KAAK,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACnC,iBAAiB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAA;QAC3D,CAAC;QAED,4CAA4C;QAC5C,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE;YACxD,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,8BAA8B;YACzD,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;SAC/B,CAAC,CAAA;QAEF,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,sBAAsB,CAAC,mCAAmC,EAAE,eAAe,EAAE;gBACrF,YAAY;aACb,CAAC,CAAA;QACJ,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YACnB,UAAU,EAAE,iCAAiC;YAC7C,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,KAAK,CAAC,OAAO;YACvB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE;gBACR,YAAY;gBACZ,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,QAAQ,EAAE;oBACR,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;iBACjC;gBACD,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,SAAS,EAAE,YAAY,CAAC,SAAS;aAClC;SACF,CAAC,CAAA;QAEF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,OAAO,EAAE,YAAY,CAAC,OAAO;YAC7B,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,SAAS,EAAE,YAAY,CAAC,SAAS;YACjC,QAAQ,EAAE,YAAY,CAAC,QAAQ;YAC/B,UAAU,EAAE;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC;SACF,CAAA;IACH,CAAC;IAED,6EAA6E;IAC7E,mCAAmC;IACnC,6EAA6E;IAE7E;;;;;;OAMG;IACH,sBAAsB,CACpB,OAA6B,EAC7B,YAAoB;QAEpB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;QAE7C,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QAClF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,wBAAwB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAA;IACjE,CAAC;IAED;;;;;;OAMG;IACH,mBAAmB,CAAC,OAA6B,EAAE,YAAoB;QACrE,iBAAiB,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAA;QAE9C,MAAM,gBAAgB,GAAG,IAAI,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QAClF,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAClC,OAAO,KAAK,CAAA;QACd,CAAC;QAED,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;QAEpD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;YACnB,UAAU,EAAE,qCAAqC;YACjD,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,YAAY;YACtB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE;gBACR,YAAY;gBACZ,WAAW,EAAE,OAAO,CAAC,KAAK;gBAC1B,gBAAgB,EAAE,gBAAgB,CAAC,MAAM;aAC1C;SACF,CAAC,CAAA;QAEF,OAAO,IAAI,CAAA;IACb,CAAC;IAED,6EAA6E;IAC7E,yDAAyD;IACzD,6EAA6E;IAE7E;;;;;;OAMG;IACH,MAAM,CAAC,OAA6B,EAAE,KAAoD;QACxF,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;QAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACtC,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,OAA6B,EAAE,EAAU;QAC9C,iBAAiB,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAA;QAE/C,oCAAoC;QACpC,IAAI,CAAC,kBAAkB,CAAC,cAAc,CAAC,EAAE,CAAC,CAAA;QAE1C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACnC,CAAC;CACF"}

package/dist/services/quarantine/QuarantineService.multiapproval.d.ts

@@ -0,0 +1,57 @@
+/**
+ * @fileoverview Multi-Approval Workflow for MALICIOUS Severity Quarantine
+ * @module @skillsmith/core/services/quarantine/QuarantineService.multiapproval
+ * @see SMI-2277: Persist multi-approval state to database
+ * @see SMI-2741: Split from QuarantineService.ts to meet 500-line standard
+ *
+ * Handles the multi-approval workflow required for MALICIOUS severity skills.
+ * MALICIOUS severity requires multiple independent reviewers to approve before
+ * a skill can be unquarantined, preventing single-reviewer compromise.
+ */
+import type { QuarantineRepository } from '../../repositories/quarantine/index.js';
+import type { ApprovalRepository } from '../../repositories/quarantine/ApprovalRepository.js';
+import type { AuditLogger } from '../../security/AuditLogger.js';
+import type { AuthenticatedSession, AuthenticatedReviewInput, AuthenticatedReviewResult, MultiApprovalStatus } from './types.js';
+/**
+ * Number of approvals required for MALICIOUS severity reviews
+ */
+export declare const MALICIOUS_APPROVAL_COUNT = 2;
+/**
+ * Multi-approval timeout in milliseconds (24 hours)
+ */
+export declare const MULTI_APPROVAL_TIMEOUT_MS: number;
+/**
+ * Handle approval for MALICIOUS severity skills
+ *
+ * MALICIOUS severity requires multiple reviewers to approve
+ * before a skill can be unquarantined. This prevents single
+ * reviewer compromise from allowing malicious skills.
+ *
+ * Approval state is persisted to the database (SMI-2277) so
+ * pending approvals survive service restarts.
+ *
+ * @param session - Authenticated session
+ * @param quarantineId - Quarantine entry ID
+ * @param skillId - Skill ID
+ * @param input - Review input
+ * @param repository - Quarantine repository
+ * @param approvalRepository - Approval repository
+ * @param auditLogger - Audit logger
+ * @returns Review result with multi-approval status
+ */
+export declare function handleMaliciousApproval(session: AuthenticatedSession, quarantineId: string, skillId: string, input: AuthenticatedReviewInput, repository: QuarantineRepository, approvalRepository: ApprovalRepository, auditLogger: AuditLogger): AuthenticatedReviewResult;
+/**
+ * Build a MultiApprovalStatus from database rows
+ *
+ * Converts persisted approval entries into the MultiApprovalStatus
+ * interface expected by consumers.
+ */
+export declare function buildMultiApprovalStatus(quarantineId: string, approvals: Array<{
+    reviewerId: string;
+    reviewerEmail: string;
+    createdAt: string;
+    completedAt: string | null;
+    reason: string | null;
+    isComplete: boolean;
+}>): MultiApprovalStatus;
+//# sourceMappingURL=QuarantineService.multiapproval.d.ts.map

package/dist/services/quarantine/QuarantineService.multiapproval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuarantineService.multiapproval.d.ts","sourceRoot":"","sources":["../../../src/services/quarantine/QuarantineService.multiapproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAA;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qDAAqD,CAAA;AAC7F,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAA;AAChE,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EAEpB,MAAM,YAAY,CAAA;AAGnB;;GAEG;AACH,eAAO,MAAM,wBAAwB,IAAI,CAAA;AAEzC;;GAEG;AACH,eAAO,MAAM,yBAAyB,QAAsB,CAAA;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,oBAAoB,EAC7B,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,wBAAwB,EAC/B,UAAU,EAAE,oBAAoB,EAChC,kBAAkB,EAAE,kBAAkB,EACtC,WAAW,EAAE,WAAW,GACvB,yBAAyB,CAoK3B;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACtC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,KAAK,CAAC;IACf,UAAU,EAAE,MAAM,CAAA;IAClB,aAAa,EAAE,MAAM,CAAA;IACrB,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,EAAE,OAAO,CAAA;CACpB,CAAC,GACD,mBAAmB,CAoBrB"}