@skillsmith/core 0.5.4 → 0.5.6

package/dist/services/quarantine/QuarantineService.multiapproval.js

@@ -0,0 +1,211 @@
+/**
+ * @fileoverview Multi-Approval Workflow for MALICIOUS Severity Quarantine
+ * @module @skillsmith/core/services/quarantine/QuarantineService.multiapproval
+ * @see SMI-2277: Persist multi-approval state to database
+ * @see SMI-2741: Split from QuarantineService.ts to meet 500-line standard
+ *
+ * Handles the multi-approval workflow required for MALICIOUS severity skills.
+ * MALICIOUS severity requires multiple independent reviewers to approve before
+ * a skill can be unquarantined, preventing single-reviewer compromise.
+ */
+import { QuarantineServiceError, requirePermission } from './types.js';
+/**
+ * Number of approvals required for MALICIOUS severity reviews
+ */
+export const MALICIOUS_APPROVAL_COUNT = 2;
+/**
+ * Multi-approval timeout in milliseconds (24 hours)
+ */
+export const MULTI_APPROVAL_TIMEOUT_MS = 24 * 60 * 60 * 1000;
+/**
+ * Handle approval for MALICIOUS severity skills
+ *
+ * MALICIOUS severity requires multiple reviewers to approve
+ * before a skill can be unquarantined. This prevents single
+ * reviewer compromise from allowing malicious skills.
+ *
+ * Approval state is persisted to the database (SMI-2277) so
+ * pending approvals survive service restarts.
+ *
+ * @param session - Authenticated session
+ * @param quarantineId - Quarantine entry ID
+ * @param skillId - Skill ID
+ * @param input - Review input
+ * @param repository - Quarantine repository
+ * @param approvalRepository - Approval repository
+ * @param auditLogger - Audit logger
+ * @returns Review result with multi-approval status
+ */
+export function handleMaliciousApproval(session, quarantineId, skillId, input, repository, approvalRepository, auditLogger) {
+    // Require elevated permission for MALICIOUS review
+    requirePermission(session, 'quarantine:review_malicious');
+    // Check if this reviewer already approved (database-backed)
+    if (approvalRepository.hasReviewerApproved(quarantineId, session.userId)) {
+        // Retrieve existing approval for error details
+        const existingApprovals = approvalRepository.getPendingApprovals(quarantineId);
+        const existing = existingApprovals.find((a) => a.reviewerId === session.userId);
+        throw new QuarantineServiceError('You have already approved this entry', 'ALREADY_REVIEWED', {
+            quarantineId,
+            previousApprovalAt: existing?.createdAt ?? 'unknown',
+        });
+    }
+    // Check for approval timeout
+    const startTime = approvalRepository.getWorkflowStartTime(quarantineId);
+    if (startTime) {
+        const timeSinceStart = Date.now() - new Date(startTime).getTime();
+        if (timeSinceStart > MULTI_APPROVAL_TIMEOUT_MS) {
+            // Capture existing approvals before clearing for audit
+            const expiredApprovals = approvalRepository.getPendingApprovals(quarantineId);
+            // Reset approval workflow
+            approvalRepository.clearApprovals(quarantineId);
+            // Log timeout event so cleared reviewer work is auditable
+            auditLogger.log({
+                event_type: 'quarantine_multi_approval_timeout',
+                actor: 'system',
+                resource: skillId,
+                action: 'timeout',
+                result: 'success',
+                metadata: {
+                    quarantineId,
+                    timeoutMs: MULTI_APPROVAL_TIMEOUT_MS,
+                    expiredApprovals: expiredApprovals.map((a) => ({
+                        reviewerId: a.reviewerId,
+                        email: a.reviewerEmail,
+                        approvedAt: a.createdAt,
+                    })),
+                    triggeredBy: {
+                        userId: session.userId,
+                        email: session.email,
+                    },
+                },
+            });
+            throw new QuarantineServiceError('Multi-approval workflow timed out. Please start again.', 'INVALID_INPUT', { quarantineId, timeoutMs: MULTI_APPROVAL_TIMEOUT_MS });
+        }
+    }
+    // Record this approval in the database
+    approvalRepository.recordApproval({
+        skillId: quarantineId,
+        reviewerId: session.userId,
+        reviewerEmail: session.email,
+        decision: 'approved',
+        reason: input.reviewNotes,
+        requiredApprovals: MALICIOUS_APPROVAL_COUNT,
+    });
+    // Get current approval count and all pending approvals
+    const pendingApprovals = approvalRepository.getPendingApprovals(quarantineId);
+    const approvalCount = pendingApprovals.filter((a) => a.decision === 'approved').length;
+    // Build the multi-approval status from database state
+    const approvalStatus = buildMultiApprovalStatus(quarantineId, pendingApprovals);
+    // Log the approval
+    auditLogger.log({
+        event_type: 'quarantine_multi_approval',
+        actor: 'reviewer',
+        resource: skillId,
+        action: 'approve',
+        result: 'success',
+        metadata: {
+            quarantineId,
+            approvalNumber: approvalCount,
+            requiredApprovals: MALICIOUS_APPROVAL_COUNT,
+            reviewer: {
+                userId: session.userId,
+                email: session.email,
+            },
+        },
+    });
+    // Check if we have enough approvals
+    if (approvalCount >= MALICIOUS_APPROVAL_COUNT) {
+        // Mark approvals as complete in database
+        approvalRepository.markComplete(quarantineId);
+        approvalStatus.isComplete = true;
+        approvalStatus.completedAt = new Date();
+        // Perform the actual review
+        const approverEmails = pendingApprovals
+            .filter((a) => a.decision === 'approved')
+            .map((a) => a.reviewerEmail);
+        const reviewResult = repository.review(quarantineId, {
+            reviewedBy: approverEmails.join(', '),
+            reviewStatus: 'approved',
+            reviewNotes: `Multi-approval complete: ${approvalCount} reviewers approved. ${input.reviewNotes || ''}`,
+        });
+        // Log completion
+        auditLogger.log({
+            event_type: 'quarantine_multi_approval_complete',
+            actor: 'reviewer',
+            resource: skillId,
+            action: 'complete',
+            result: 'success',
+            metadata: {
+                quarantineId,
+                approvals: pendingApprovals
+                    .filter((a) => a.decision === 'approved')
+                    .map((a) => ({
+                    reviewerId: a.reviewerId,
+                    email: a.reviewerEmail,
+                    approvedAt: a.createdAt,
+                })),
+            },
+        });
+        return {
+            success: true,
+            approved: true,
+            skillId,
+            severity: 'MALICIOUS',
+            canImport: reviewResult?.canImport ?? false,
+            warnings: [
+                'MALICIOUS skill approved through multi-approval workflow',
+                `Approved by: ${approverEmails.join(', ')}`,
+            ],
+            reviewedBy: {
+                userId: session.userId,
+                email: session.email,
+                displayName: session.displayName,
+            },
+            multiApprovalStatus: approvalStatus,
+        };
+    }
+    // Need more approvals
+    return {
+        success: true,
+        approved: false,
+        skillId,
+        severity: 'MALICIOUS',
+        canImport: false,
+        warnings: [
+            `Multi-approval in progress: ${approvalCount}/${MALICIOUS_APPROVAL_COUNT} approvals received`,
+            `Requires ${MALICIOUS_APPROVAL_COUNT - approvalCount} more approval(s)`,
+        ],
+        reviewedBy: {
+            userId: session.userId,
+            email: session.email,
+            displayName: session.displayName,
+        },
+        multiApprovalStatus: approvalStatus,
+    };
+}
+/**
+ * Build a MultiApprovalStatus from database rows
+ *
+ * Converts persisted approval entries into the MultiApprovalStatus
+ * interface expected by consumers.
+ */
+export function buildMultiApprovalStatus(quarantineId, approvals) {
+    const currentApprovals = approvals.map((a) => ({
+        reviewerId: a.reviewerId,
+        reviewerEmail: a.reviewerEmail,
+        approvedAt: new Date(a.createdAt),
+        notes: a.reason ?? undefined,
+    }));
+    const startedAt = approvals.length > 0 ? new Date(approvals[0].createdAt) : new Date();
+    const isComplete = approvals.some((a) => a.isComplete);
+    const completedEntry = approvals.find((a) => a.completedAt);
+    return {
+        quarantineId,
+        requiredApprovals: MALICIOUS_APPROVAL_COUNT,
+        currentApprovals,
+        isComplete,
+        startedAt,
+        completedAt: completedEntry ? new Date(completedEntry.completedAt) : undefined,
+    };
+}
+//# sourceMappingURL=QuarantineService.multiapproval.js.map

package/dist/services/quarantine/QuarantineService.multiapproval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuarantineService.multiapproval.js","sourceRoot":"","sources":["../../../src/services/quarantine/QuarantineService.multiapproval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAA;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAA;AAEzC;;GAEG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAE5D;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAA6B,EAC7B,YAAoB,EACpB,OAAe,EACf,KAA+B,EAC/B,UAAgC,EAChC,kBAAsC,EACtC,WAAwB;IAExB,mDAAmD;IACnD,iBAAiB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAA;IAEzD,4DAA4D;IAC5D,IAAI,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,+CAA+C;QAC/C,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;QAC9E,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;QAC/E,MAAM,IAAI,sBAAsB,CAAC,sCAAsC,EAAE,kBAAkB,EAAE;YAC3F,YAAY;YACZ,kBAAkB,EAAE,QAAQ,EAAE,SAAS,IAAI,SAAS;SACrD,CAAC,CAAA;IACJ,CAAC;IAED,6BAA6B;IAC7B,MAAM,SAAS,GAAG,kBAAkB,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAA;IACvE,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAA;QACjE,IAAI,cAAc,GAAG,yBAAyB,EAAE,CAAC;YAC/C,uDAAuD;YACvD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;YAE7E,0BAA0B;YAC1B,kBAAkB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAA;YAE/C,0DAA0D;YAC1D,WAAW,CAAC,GAAG,CAAC;gBACd,UAAU,EAAE,mCAAmC;gBAC/C,KAAK,EAAE,QAAQ;gBACf,QAAQ,EAAE,OAAO;gBACjB,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE;oBACR,YAAY;oBACZ,SAAS,EAAE,yBAAyB;oBACpC,gBAAgB,EAAE,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;wBAC7C,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,KAAK,EAAE,CAAC,CAAC,aAAa;wBACtB,UAAU,EAAE,CAAC,CAAC,SAAS;qBACxB,CAAC,CAAC;oBACH,WAAW,EAAE;wBACX,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;qBACrB;iBACF;aACF,CAAC,CAAA;YAEF,MAAM,IAAI,sBAAsB,CAC9B,wDAAwD,EACxD,eAAe,EACf,EAAE,YAAY,EAAE,SAAS,EAAE,yBAAyB,EAAE,CACvD,CAAA;QACH,CAAC;IACH,CAAC;IAED,uCAAuC;IACvC,kBAAkB,CAAC,cAAc,CAAC;QAChC,OAAO,EAAE,YAAY;QACrB,UAAU,EAAE,OAAO,CAAC,MAAM;QAC1B,aAAa,EAAE,OAAO,CAAC,KAAK;QAC5B,QAAQ,EAAE,UAAU;QACpB,MAAM,EAAE,KAAK,CAAC,WAAW;QACzB,iBAAiB,EAAE,wBAAwB;KAC5C,CAAC,CAAA;IAEF,uDAAuD;IACvD,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,YAAY,CAAC,CAAA;IAC7E,MAAM,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAA;IAEtF,sDAAsD;IACtD,MAAM,cAAc,GAAG,wBAAwB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAA;IAE/E,mBAAmB;IACnB,WAAW,CAAC,GAAG,CAAC;QACd,UAAU,EAAE,2BAA2B;QACvC,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,SAAS;QACjB,QAAQ,EAAE;YACR,YAAY;YACZ,cAAc,EAAE,aAAa;YAC7B,iBAAiB,EAAE,wBAAwB;YAC3C,QAAQ,EAAE;gBACR,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;aACrB;SACF;KACF,CAAC,CAAA;IAEF,oCAAoC;IACpC,IAAI,aAAa,IAAI,wBAAwB,EAAE,CAAC;QAC9C,yCAAyC;QACzC,kBAAkB,CAAC,YAAY,CAAC,YAAY,CAAC,CAAA;QAC7C,cAAc,CAAC,UAAU,GAAG,IAAI,CAAA;QAChC,cAAc,CAAC,WAAW,GAAG,IAAI,IAAI,EAAE,CAAA;QAEvC,4BAA4B;QAC5B,MAAM,cAAc,GAAG,gBAAgB;aACpC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;aACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAA;QAC9B,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE;YACnD,UAAU,EAAE,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YACrC,YAAY,EAAE,UAAU;YACxB,WAAW,EAAE,4BAA4B,aAAa,wBAAwB,KAAK,CAAC,WAAW,IAAI,EAAE,EAAE;SACxG,CAAC,CAAA;QAEF,iBAAiB;QACjB,WAAW,CAAC,GAAG,CAAC;YACd,UAAU,EAAE,oCAAoC;YAChD,KAAK,EAAE,UAAU;YACjB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE;gBACR,YAAY;gBACZ,SAAS,EAAE,gBAAgB;qBACxB,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;qBACxC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACX,UAAU,EAAE,CAAC,CAAC,UAAU;oBACxB,KAAK,EAAE,CAAC,CAAC,aAAa;oBACtB,UAAU,EAAE,CAAC,CAAC,SAAS;iBACxB,CAAC,CAAC;aACN;SACF,CAAC,CAAA;QAEF,OAAO;YACL,OAAO,EAAE,IAAI;YACb,QAAQ,EAAE,IAAI;YACd,OAAO;YACP,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,YAAY,EAAE,SAAS,IAAI,KAAK;YAC3C,QAAQ,EAAE;gBACR,0DAA0D;gBAC1D,gBAAgB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;aAC5C;YACD,UAAU,EAAE;gBACV,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,WAAW,EAAE,OAAO,CAAC,WAAW;aACjC;YACD,mBAAmB,EAAE,cAAc;SACpC,CAAA;IACH,CAAC;IAED,sBAAsB;IACtB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,KAAK;QACf,OAAO;QACP,QAAQ,EAAE,WAAW;QACrB,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE;YACR,+BAA+B,aAAa,IAAI,wBAAwB,qBAAqB;YAC7F,YAAY,wBAAwB,GAAG,aAAa,mBAAmB;SACxE;QACD,UAAU,EAAE;YACV,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC;QACD,mBAAmB,EAAE,cAAc;KACpC,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACtC,YAAoB,EACpB,SAOE;IAEF,MAAM,gBAAgB,GAAqB,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/D,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,aAAa,EAAE,CAAC,CAAC,aAAa;QAC9B,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACjC,KAAK,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;KAC7B,CAAC,CAAC,CAAA;IAEH,MAAM,SAAS,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAA;IACtF,MAAM,UAAU,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;IACtD,MAAM,cAAc,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAA;IAE3D,OAAO;QACL,YAAY;QACZ,iBAAiB,EAAE,wBAAwB;QAC3C,gBAAgB;QAChB,UAAU;QACV,SAAS;QACT,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,WAAY,CAAC,CAAC,CAAC,CAAC,SAAS;KAChF,CAAA;AACH,CAAC"}

package/dist/services/quarantine/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * SMI-2269: Quarantine Service Module
+ *
+ * Authenticated quarantine operations with multi-approval workflow.
+ *
+ * @module @skillsmith/core/services/quarantine
+ */
+export { QuarantineService } from './QuarantineService.js';
+export { type QuarantinePermission, type AuthenticatedSession, type ApprovalRecord, type MultiApprovalStatus, type AuthenticatedReviewInput, type AuthenticatedReviewResult, type QuarantineServiceErrorCode, QuarantineServiceError, hasPermission, isSessionValid, requirePermission, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/services/quarantine/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/quarantine/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO,EAEL,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,wBAAwB,EAC7B,KAAK,yBAAyB,EAC9B,KAAK,0BAA0B,EAE/B,sBAAsB,EAEtB,aAAa,EACb,cAAc,EACd,iBAAiB,GAClB,MAAM,YAAY,CAAA"}

package/dist/services/quarantine/index.js

@@ -0,0 +1,14 @@
+/**
+ * SMI-2269: Quarantine Service Module
+ *
+ * Authenticated quarantine operations with multi-approval workflow.
+ *
+ * @module @skillsmith/core/services/quarantine
+ */
+export { QuarantineService } from './QuarantineService.js';
+export { 
+// Error class
+QuarantineServiceError, 
+// Helper functions
+hasPermission, isSessionValid, requirePermission, } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/services/quarantine/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/services/quarantine/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAC1D,OAAO;AASL,cAAc;AACd,sBAAsB;AACtB,mBAAmB;AACnB,aAAa,EACb,cAAc,EACd,iBAAiB,GAClB,MAAM,YAAY,CAAA"}

package/dist/services/quarantine/types.d.ts

@@ -0,0 +1,127 @@
+/**
+ * SMI-2269: Quarantine Service Types
+ *
+ * Authentication and authorization types for quarantine review operations.
+ * Part of QUA-002 security fix: No authentication on quarantine review.
+ *
+ * @module @skillsmith/core/services/quarantine/types
+ */
+import type { QuarantineSeverity, QuarantineReviewStatus } from '../../db/quarantine-schema.js';
+/**
+ * User permissions for quarantine operations
+ */
+export type QuarantinePermission = 'quarantine:read' | 'quarantine:create' | 'quarantine:review' | 'quarantine:review_malicious' | 'quarantine:delete' | 'quarantine:admin';
+/**
+ * Authenticated session for quarantine operations
+ *
+ * All quarantine review operations require a valid session with
+ * appropriate permissions. This ensures audit trails contain
+ * verified reviewer identities.
+ */
+export interface AuthenticatedSession {
+    /** Unique user identifier (from auth provider) */
+    userId: string;
+    /** User's email address (verified) */
+    email: string;
+    /** User's display name */
+    displayName: string;
+    /** User's assigned permissions */
+    permissions: QuarantinePermission[];
+    /** Session token ID for audit logging */
+    sessionId: string;
+    /** Session expiration timestamp */
+    expiresAt: Date;
+    /** Organization/team ID (for team-based permissions) */
+    organizationId?: string;
+}
+/**
+ * Approval record for multi-approval workflow
+ */
+export interface ApprovalRecord {
+    /** Reviewer user ID */
+    reviewerId: string;
+    /** Reviewer email */
+    reviewerEmail: string;
+    /** Timestamp of approval */
+    approvedAt: Date;
+    /** Optional notes from reviewer */
+    notes?: string;
+}
+/**
+ * Multi-approval status for MALICIOUS severity reviews
+ */
+export interface MultiApprovalStatus {
+    /** Quarantine entry ID */
+    quarantineId: string;
+    /** Required number of approvals */
+    requiredApprovals: number;
+    /** Current approvals received */
+    currentApprovals: ApprovalRecord[];
+    /** Whether all required approvals have been received */
+    isComplete: boolean;
+    /** Timestamp when first approval was received */
+    startedAt: Date;
+    /** Timestamp when approval completed (if complete) */
+    completedAt?: Date;
+}
+/**
+ * Input for authenticated review operation
+ */
+export interface AuthenticatedReviewInput {
+    /** Review status decision */
+    reviewStatus: QuarantineReviewStatus;
+    /** Optional review notes */
+    reviewNotes?: string;
+}
+/**
+ * Result from authenticated review operation
+ */
+export interface AuthenticatedReviewResult {
+    /** Whether the review was successful */
+    success: boolean;
+    /** Whether the skill is approved for import */
+    approved: boolean;
+    /** Skill ID that was reviewed */
+    skillId: string;
+    /** Severity of the quarantined skill */
+    severity: QuarantineSeverity;
+    /** Whether the skill can be imported */
+    canImport: boolean;
+    /** Any warnings about the skill */
+    warnings: string[];
+    /** Verified reviewer identity */
+    reviewedBy: {
+        userId: string;
+        email: string;
+        displayName: string;
+    };
+    /** For MALICIOUS severity: multi-approval status */
+    multiApprovalStatus?: MultiApprovalStatus;
+}
+/**
+ * Error codes for quarantine service operations
+ */
+export type QuarantineServiceErrorCode = 'UNAUTHORIZED' | 'FORBIDDEN' | 'SESSION_EXPIRED' | 'INSUFFICIENT_PERMISSIONS' | 'MULTI_APPROVAL_REQUIRED' | 'ALREADY_REVIEWED' | 'NOT_FOUND' | 'INVALID_INPUT';
+/**
+ * Service error with typed error codes
+ */
+export declare class QuarantineServiceError extends Error {
+    readonly code: QuarantineServiceErrorCode;
+    readonly details?: Record<string, unknown> | undefined;
+    constructor(message: string, code: QuarantineServiceErrorCode, details?: Record<string, unknown> | undefined);
+}
+/**
+ * Check if session has a specific permission
+ */
+export declare function hasPermission(session: AuthenticatedSession, permission: QuarantinePermission): boolean;
+/**
+ * Check if session is valid (not expired)
+ */
+export declare function isSessionValid(session: AuthenticatedSession): boolean;
+/**
+ * Validate session and check permission
+ *
+ * @throws QuarantineServiceError if session is invalid or lacks permission
+ */
+export declare function requirePermission(session: AuthenticatedSession, permission: QuarantinePermission): void;
+//# sourceMappingURL=types.d.ts.map

package/dist/services/quarantine/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/quarantine/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAA;AAM/F;;GAEG;AACH,MAAM,MAAM,oBAAoB,GAC5B,iBAAiB,GACjB,mBAAmB,GACnB,mBAAmB,GACnB,6BAA6B,GAC7B,mBAAmB,GACnB,kBAAkB,CAAA;AAEtB;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,kDAAkD;IAClD,MAAM,EAAE,MAAM,CAAA;IAEd,sCAAsC;IACtC,KAAK,EAAE,MAAM,CAAA;IAEb,0BAA0B;IAC1B,WAAW,EAAE,MAAM,CAAA;IAEnB,kCAAkC;IAClC,WAAW,EAAE,oBAAoB,EAAE,CAAA;IAEnC,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IAEjB,mCAAmC;IACnC,SAAS,EAAE,IAAI,CAAA;IAEf,wDAAwD;IACxD,cAAc,CAAC,EAAE,MAAM,CAAA;CACxB;AAMD;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,uBAAuB;IACvB,UAAU,EAAE,MAAM,CAAA;IAElB,qBAAqB;IACrB,aAAa,EAAE,MAAM,CAAA;IAErB,4BAA4B;IAC5B,UAAU,EAAE,IAAI,CAAA;IAEhB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,0BAA0B;IAC1B,YAAY,EAAE,MAAM,CAAA;IAEpB,mCAAmC;IACnC,iBAAiB,EAAE,MAAM,CAAA;IAEzB,iCAAiC;IACjC,gBAAgB,EAAE,cAAc,EAAE,CAAA;IAElC,wDAAwD;IACxD,UAAU,EAAE,OAAO,CAAA;IAEnB,iDAAiD;IACjD,SAAS,EAAE,IAAI,CAAA;IAEf,sDAAsD;IACtD,WAAW,CAAC,EAAE,IAAI,CAAA;CACnB;AAMD;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,6BAA6B;IAC7B,YAAY,EAAE,sBAAsB,CAAA;IAEpC,4BAA4B;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,yBAAyB;IACxC,wCAAwC;IACxC,OAAO,EAAE,OAAO,CAAA;IAEhB,+CAA+C;IAC/C,QAAQ,EAAE,OAAO,CAAA;IAEjB,iCAAiC;IACjC,OAAO,EAAE,MAAM,CAAA;IAEf,wCAAwC;IACxC,QAAQ,EAAE,kBAAkB,CAAA;IAE5B,wCAAwC;IACxC,SAAS,EAAE,OAAO,CAAA;IAElB,mCAAmC;IACnC,QAAQ,EAAE,MAAM,EAAE,CAAA;IAElB,iCAAiC;IACjC,UAAU,EAAE;QACV,MAAM,EAAE,MAAM,CAAA;QACd,KAAK,EAAE,MAAM,CAAA;QACb,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;IAED,oDAAoD;IACpD,mBAAmB,CAAC,EAAE,mBAAmB,CAAA;CAC1C;AAMD;;GAEG;AACH,MAAM,MAAM,0BAA0B,GAClC,cAAc,GACd,WAAW,GACX,iBAAiB,GACjB,0BAA0B,GAC1B,yBAAyB,GACzB,kBAAkB,GAClB,WAAW,GACX,eAAe,CAAA;AAEnB;;GAEG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAG7B,IAAI,EAAE,0BAA0B;aAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;gBAFjD,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,0BAA0B,EAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,YAAA;CAKpD;AAMD;;GAEG;AACH,wBAAgB,aAAa,CAC3B,OAAO,EAAE,oBAAoB,EAC7B,UAAU,EAAE,oBAAoB,GAC/B,OAAO,CAMT;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAErE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,oBAAoB,EAC7B,UAAU,EAAE,oBAAoB,GAC/B,IAAI,CAiBN"}

package/dist/services/quarantine/types.js

@@ -0,0 +1,59 @@
+/**
+ * SMI-2269: Quarantine Service Types
+ *
+ * Authentication and authorization types for quarantine review operations.
+ * Part of QUA-002 security fix: No authentication on quarantine review.
+ *
+ * @module @skillsmith/core/services/quarantine/types
+ */
+/**
+ * Service error with typed error codes
+ */
+export class QuarantineServiceError extends Error {
+    code;
+    details;
+    constructor(message, code, details) {
+        super(message);
+        this.code = code;
+        this.details = details;
+        this.name = 'QuarantineServiceError';
+    }
+}
+// ============================================================================
+// Permission Helpers
+// ============================================================================
+/**
+ * Check if session has a specific permission
+ */
+export function hasPermission(session, permission) {
+    // Admin has all permissions
+    if (session.permissions.includes('quarantine:admin')) {
+        return true;
+    }
+    return session.permissions.includes(permission);
+}
+/**
+ * Check if session is valid (not expired)
+ */
+export function isSessionValid(session) {
+    return session.expiresAt > new Date();
+}
+/**
+ * Validate session and check permission
+ *
+ * @throws QuarantineServiceError if session is invalid or lacks permission
+ */
+export function requirePermission(session, permission) {
+    if (!isSessionValid(session)) {
+        throw new QuarantineServiceError('Session has expired', 'SESSION_EXPIRED', {
+            expiresAt: session.expiresAt.toISOString(),
+        });
+    }
+    if (!hasPermission(session, permission)) {
+        throw new QuarantineServiceError(`Permission denied: ${permission} required`, 'INSUFFICIENT_PERMISSIONS', {
+            required: permission,
+            available: session.permissions,
+        });
+    }
+}
+//# sourceMappingURL=types.js.map

package/dist/services/quarantine/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/quarantine/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA8JH;;GAEG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG7B;IACA;IAHlB,YACE,OAAe,EACC,IAAgC,EAChC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAA;QAHE,SAAI,GAAJ,IAAI,CAA4B;QAChC,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,+EAA+E;AAC/E,qBAAqB;AACrB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,aAAa,CAC3B,OAA6B,EAC7B,UAAgC;IAEhC,4BAA4B;IAC5B,IAAI,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACrD,OAAO,IAAI,CAAA;IACb,CAAC;IACD,OAAO,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AACjD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,OAA6B;IAC1D,OAAO,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,CAAA;AACvC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAA6B,EAC7B,UAAgC;IAEhC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,sBAAsB,CAAC,qBAAqB,EAAE,iBAAiB,EAAE;YACzE,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,WAAW,EAAE;SAC3C,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,CAAC;QACxC,MAAM,IAAI,sBAAsB,CAC9B,sBAAsB,UAAU,WAAW,EAC3C,0BAA0B,EAC1B;YACE,QAAQ,EAAE,UAAU;YACpB,SAAS,EAAE,OAAO,CAAC,WAAW;SAC/B,CACF,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/services/skill-config-schema.d.ts

@@ -0,0 +1,68 @@
+/**
+ * @fileoverview Zod schema for skill config.json validation
+ * @module @skillsmith/core/services/skill-config-schema
+ * @see SMI-3870: Config.json Schema Validation
+ *
+ * Validates config.json files fetched during skill installation.
+ * v1 uses .passthrough() — logs unknown keys as warnings but does not reject.
+ */
+import { z } from 'zod';
+/**
+ * Schema for skill config.json files.
+ * v1: passthrough mode — unknown keys logged as warnings, not rejected.
+ * Switch to .strict() after publishing the schema spec.
+ */
+export declare const SkillConfigSchema: z.ZodObject<{
+    /** Skill display name override */
+    displayName: z.ZodOptional<z.ZodString>;
+    /** Version constraint */
+    version: z.ZodOptional<z.ZodString>;
+    /** Configuration presets (values must be primitives) */
+    presets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    /** Custom settings (values must be primitives) */
+    settings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    /** MCP server requirements */
+    mcpServers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Minimum Claude Code version */
+    minClaudeCodeVersion: z.ZodOptional<z.ZodString>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    /** Skill display name override */
+    displayName: z.ZodOptional<z.ZodString>;
+    /** Version constraint */
+    version: z.ZodOptional<z.ZodString>;
+    /** Configuration presets (values must be primitives) */
+    presets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    /** Custom settings (values must be primitives) */
+    settings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    /** MCP server requirements */
+    mcpServers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Minimum Claude Code version */
+    minClaudeCodeVersion: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    /** Skill display name override */
+    displayName: z.ZodOptional<z.ZodString>;
+    /** Version constraint */
+    version: z.ZodOptional<z.ZodString>;
+    /** Configuration presets (values must be primitives) */
+    presets: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    /** Custom settings (values must be primitives) */
+    settings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodString, z.ZodNumber, z.ZodBoolean]>>>;
+    /** MCP server requirements */
+    mcpServers: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    /** Minimum Claude Code version */
+    minClaudeCodeVersion: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>;
+export type SkillConfig = z.infer<typeof SkillConfigSchema>;
+export interface ConfigValidationResult {
+    valid: boolean;
+    errors: string[];
+    warnings: string[];
+    /** Sanitized config (only if valid) */
+    config?: SkillConfig;
+}
+/**
+ * Validate a config.json string against the skill config schema.
+ * Returns validation result with errors and warnings for unknown keys.
+ */
+export declare function validateSkillConfig(content: string): ConfigValidationResult;
+//# sourceMappingURL=skill-config-schema.d.ts.map

package/dist/services/skill-config-schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-config-schema.d.ts","sourceRoot":"","sources":["../../src/services/skill-config-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;IAE1B,kCAAkC;;IAElC,yBAAyB;;IAEzB,wDAAwD;;IAIxD,kDAAkD;;IAIlD,8BAA8B;;IAE9B,kCAAkC;;;IAdlC,kCAAkC;;IAElC,yBAAyB;;IAEzB,wDAAwD;;IAIxD,kDAAkD;;IAIlD,8BAA8B;;IAE9B,kCAAkC;;;IAdlC,kCAAkC;;IAElC,yBAAyB;;IAEzB,wDAAwD;;IAIxD,kDAAkD;;IAIlD,8BAA8B;;IAE9B,kCAAkC;;gCAGtB,CAAA;AAEhB,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAW3D,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,OAAO,CAAA;IACd,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,uCAAuC;IACvC,MAAM,CAAC,EAAE,WAAW,CAAA;CACrB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,sBAAsB,CA+B3E"}

package/dist/services/skill-config-schema.js

@@ -0,0 +1,76 @@
+/**
+ * @fileoverview Zod schema for skill config.json validation
+ * @module @skillsmith/core/services/skill-config-schema
+ * @see SMI-3870: Config.json Schema Validation
+ *
+ * Validates config.json files fetched during skill installation.
+ * v1 uses .passthrough() — logs unknown keys as warnings but does not reject.
+ */
+import { z } from 'zod';
+/**
+ * Schema for skill config.json files.
+ * v1: passthrough mode — unknown keys logged as warnings, not rejected.
+ * Switch to .strict() after publishing the schema spec.
+ */
+export const SkillConfigSchema = z
+    .object({
+    /** Skill display name override */
+    displayName: z.string().max(100).optional(),
+    /** Version constraint */
+    version: z.string().max(20).optional(),
+    /** Configuration presets (values must be primitives) */
+    presets: z
+        .record(z.string(), z.union([z.string().max(500), z.number(), z.boolean()]))
+        .optional(),
+    /** Custom settings (values must be primitives) */
+    settings: z
+        .record(z.string().max(50), z.union([z.string().max(500), z.number(), z.boolean()]))
+        .optional(),
+    /** MCP server requirements */
+    mcpServers: z.array(z.string().max(100)).max(10).optional(),
+    /** Minimum Claude Code version */
+    minClaudeCodeVersion: z.string().max(20).optional(),
+})
+    .passthrough();
+const KNOWN_KEYS = [
+    'displayName',
+    'version',
+    'presets',
+    'settings',
+    'mcpServers',
+    'minClaudeCodeVersion',
+];
+/**
+ * Validate a config.json string against the skill config schema.
+ * Returns validation result with errors and warnings for unknown keys.
+ */
+export function validateSkillConfig(content) {
+    try {
+        const parsed = JSON.parse(content);
+        const result = SkillConfigSchema.safeParse(parsed);
+        if (!result.success) {
+            return {
+                valid: false,
+                errors: result.error.issues.map((i) => i.path.join('.') + ': ' + i.message),
+                warnings: [],
+            };
+        }
+        // v1 passthrough: log unknown keys as warnings
+        const warnings = [];
+        if (parsed !== null && typeof parsed === 'object') {
+            const unknownKeys = Object.keys(parsed).filter((k) => !KNOWN_KEYS.includes(k));
+            if (unknownKeys.length > 0) {
+                warnings.push('config.json contains unknown keys: ' + unknownKeys.join(', ') + '. These are ignored.');
+            }
+        }
+        return { valid: true, errors: [], warnings, config: result.data };
+    }
+    catch (e) {
+        return {
+            valid: false,
+            errors: ['Invalid JSON: ' + (e instanceof Error ? e.message : 'parse error')],
+            warnings: [],
+        };
+    }
+}
+//# sourceMappingURL=skill-config-schema.js.map

package/dist/services/skill-config-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-config-schema.js","sourceRoot":"","sources":["../../src/services/skill-config-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,kCAAkC;IAClC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3C,yBAAyB;IACzB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtC,wDAAwD;IACxD,OAAO,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;SAC3E,QAAQ,EAAE;IACb,kDAAkD;IAClD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;SACnF,QAAQ,EAAE;IACb,8BAA8B;IAC9B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,kCAAkC;IAClC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;CACpD,CAAC;KACD,WAAW,EAAE,CAAA;AAIhB,MAAM,UAAU,GAAG;IACjB,aAAa;IACb,SAAS;IACT,SAAS;IACT,UAAU;IACV,YAAY;IACZ,sBAAsB;CACvB,CAAA;AAUD;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC3C,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO;gBACL,KAAK,EAAE,KAAK;gBACZ,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC;gBAC3E,QAAQ,EAAE,EAAE;aACb,CAAA;QACH,CAAC;QACD,+CAA+C;QAC/C,MAAM,QAAQ,GAAa,EAAE,CAAA;QAC7B,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAiC,CAAC,CAAC,MAAM,CACvE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC/B,CAAA;YACD,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,QAAQ,CAAC,IAAI,CACX,qCAAqC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,sBAAsB,CACxF,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAA;IACnE,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,CAAC,gBAAgB,GAAG,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;YAC7E,QAAQ,EAAE,EAAE;SACb,CAAA;IACH,CAAC;AACH,CAAC"}

package/dist/services/skill-installation.feedback.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @fileoverview AIDefence feedback + risk trend helpers for install pipeline
+ * @module @skillsmith/core/services/skill-installation.feedback
+ * @see SMI-3873: AIDefence Learning Loop
+ * @see SMI-3874: Risk Trend Detection
+ */
+import type { ScanReport } from '../security/index.js';
+import type { RiskScoreHistoryRepository } from '../repositories/RiskScoreHistoryRepository.js';
+import type { AiDefenceFeedback } from './skill-installation.types.js';
+/** SMI-3873: Record AIDefence learning feedback. Best-effort, non-blocking. */
+export declare function recordAiDefenceFeedback(params: {
+    feedback: AiDefenceFeedback | undefined;
+    skillMdContent: string;
+    scanReport: ScanReport | undefined;
+    blocked: boolean;
+}): void;
+/** SMI-3874: Collect risk trend warnings from scan history. */
+export declare function collectTrendWarnings(params: {
+    historyRepo: RiskScoreHistoryRepository | undefined;
+    skillId: string;
+    scanReport: ScanReport;
+    contentHash: string | null;
+}): string[];
+//# sourceMappingURL=skill-installation.feedback.d.ts.map

package/dist/services/skill-installation.feedback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.feedback.d.ts","sourceRoot":"","sources":["../../src/services/skill-installation.feedback.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAA;AAC/F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAGtE,+EAA+E;AAC/E,wBAAgB,uBAAuB,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAA;IACvC,cAAc,EAAE,MAAM,CAAA;IACtB,UAAU,EAAE,UAAU,GAAG,SAAS,CAAA;IAClC,OAAO,EAAE,OAAO,CAAA;CACjB,GAAG,IAAI,CAaP;AAED,+DAA+D;AAC/D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAC3C,WAAW,EAAE,0BAA0B,GAAG,SAAS,CAAA;IACnD,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,UAAU,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B,GAAG,MAAM,EAAE,CASX"}