@skillsmith/core 0.7.2 → 0.8.1

package/dist/src/provenance/git-config.js

@@ -0,0 +1,117 @@
+/**
+ * @fileoverview Recover a skill's GitHub source from its `.git/config` origin.
+ * @module @skillsmith/core/provenance/git-config
+ * @see SMI-5407
+ *
+ * Offline only. No git binary, no network: we parse the INI-style config file
+ * directly. Normalizes both scp-like (`git@github.com:owner/repo.git`) and URL
+ * (`https://github.com/owner/repo.git`) remotes. Non-github hosts return null.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+const GITHUB_HOSTS = new Set(['github.com', 'www.github.com']);
+/**
+ * Strip a trailing `.git` and any trailing slashes from a repo segment.
+ * Uses string iteration rather than a `/\/+$/`-style regex to avoid CodeQL
+ * `js/polynomial-redos` on the user-controlled `.git/config` content. SMI-5407.
+ */
+function stripGitSuffix(repo) {
+    let end = repo.length;
+    while (end > 0 && repo[end - 1] === '/')
+        end--;
+    const trimmed = repo.slice(0, end);
+    if (trimmed.length >= 4 && trimmed.slice(-4).toLowerCase() === '.git') {
+        return trimmed.slice(0, -4);
+    }
+    return trimmed;
+}
+/**
+ * A safe GitHub owner/repo segment: ASCII alphanumeric plus `.`/`_`/`-`, and
+ * never `.`/`..`. Without this, a crafted `.git/config`
+ * `url = git@github.com:../evil` yields owner `..`, corrupting the stored
+ * `owner/repo` id + URL. SMI-5407 governance.
+ */
+function isSafeSegment(s) {
+    return /^[A-Za-z0-9._-]+$/.test(s) && s !== '.' && s !== '..';
+}
+/**
+ * Normalize a raw git remote URL into a canonical {@link RecoveredSource}.
+ * Returns null for non-github hosts or unparseable shapes.
+ */
+export function normalizeGitHubRemote(rawUrl) {
+    const trimmed = rawUrl.trim();
+    if (!trimmed)
+        return null;
+    let owner;
+    let repo;
+    // scp-like syntax: git@github.com:owner/repo(.git)
+    const scp = /^[^@]+@([^:]+):(.+)$/.exec(trimmed);
+    if (scp && !trimmed.includes('://')) {
+        if (!GITHUB_HOSTS.has(scp[1].toLowerCase()))
+            return null;
+        const segments = scp[2].split('/').filter(Boolean);
+        if (segments.length < 2)
+            return null;
+        owner = segments[0];
+        repo = stripGitSuffix(segments[1]);
+    }
+    else {
+        let parsed;
+        try {
+            parsed = new URL(trimmed);
+        }
+        catch {
+            return null;
+        }
+        if (!GITHUB_HOSTS.has(parsed.hostname.toLowerCase()))
+            return null;
+        const segments = parsed.pathname.split('/').filter(Boolean);
+        if (segments.length < 2)
+            return null;
+        owner = segments[0];
+        repo = stripGitSuffix(segments[1]);
+    }
+    if (!owner || !repo)
+        return null;
+    if (!isSafeSegment(owner) || !isSafeSegment(repo))
+        return null;
+    return { owner, repo, url: `https://github.com/${owner}/${repo}` };
+}
+/** Extract the `url` of the `[remote "origin"]` section from a git config. */
+function extractOriginUrl(config) {
+    let inOrigin = false;
+    for (const line of config.split('\n')) {
+        const trimmed = line.trim();
+        const section = /^\[(.+)\]$/.exec(trimmed);
+        if (section) {
+            inOrigin = /^remote\s+"origin"$/.test(section[1].trim());
+            continue;
+        }
+        if (inOrigin) {
+            const match = /^url\s*=\s*(.+)$/.exec(trimmed);
+            if (match)
+                return match[1].trim();
+        }
+    }
+    return null;
+}
+/**
+ * Read `<skillDir>/.git/config` and recover the origin remote's GitHub source.
+ * Returns null when the file is missing, has no origin url, or the remote is
+ * not a github.com repository.
+ */
+export function parseGitConfigRemote(skillDir) {
+    const configPath = path.join(skillDir, '.git', 'config');
+    let content;
+    try {
+        content = fs.readFileSync(configPath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    const url = extractOriginUrl(content);
+    if (!url)
+        return null;
+    return normalizeGitHubRemote(url);
+}
+//# sourceMappingURL=git-config.js.map

package/dist/src/provenance/git-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-config.js","sourceRoot":"","sources":["../../../src/provenance/git-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAI5B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC,CAAA;AAE9D;;;;GAIG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;IACrB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,EAAE,CAAA;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAClC,IAAI,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;QACtE,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,CAAS;IAC9B,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAA;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,MAAc;IAClD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAA;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAEzB,IAAI,KAAyB,CAAA;IAC7B,IAAI,IAAwB,CAAA;IAE5B,mDAAmD;IACnD,MAAM,GAAG,GAAG,sBAAsB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACxD,MAAM,QAAQ,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAClD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACpC,CAAC;SAAM,CAAC;QACN,IAAI,MAAW,CAAA;QACf,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAA;QACb,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;YAAE,OAAO,IAAI,CAAA;QACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAA;QACnB,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;IACpC,CAAC;IAED,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IAChC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC9D,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,sBAAsB,KAAK,IAAI,IAAI,EAAE,EAAE,CAAA;AACpE,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC1C,IAAI,OAAO,EAAE,CAAC;YACZ,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;YACxD,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC9C,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;QACnC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IACxD,IAAI,OAAe,CAAA;IACnB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAA;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAA;AACnC,CAAC"}

package/dist/src/provenance/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview Public surface of the skill source provenance recovery module.
+ * @module @skillsmith/core/provenance
+ * @see SMI-5407
+ */
+export { parseGitConfigRemote, normalizeGitHubRemote } from './git-config.js';
+export { parsePluginManifestRepository } from './plugin-manifest.js';
+export { scanLocalSkills, type LocalSkillEntry } from './local-skill-scan.js';
+export { SourceRecoveryService, defaultSkillsRoot, type RecoverSourcesOptions, type RecoverOneOptions, } from './SourceRecoveryService.js';
+export { backfillManifest, type BackfillOptions, type BackfillOutcome } from './backfill.js';
+export { METHOD_LABELS, type RecoveryMethod, type RecoveryConfidence, type RecoveredSource, type RecoveryCandidate, type SkillRecoveryStatus, type SkillRecoveryResult, type RecoverySummary, type RecoveryReport, type RecoveryDeps, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/src/provenance/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/provenance/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AACpE,OAAO,EAAE,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EACL,qBAAqB,EACrB,iBAAiB,EACjB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,GACvB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,gBAAgB,EAAE,KAAK,eAAe,EAAE,KAAK,eAAe,EAAE,MAAM,eAAe,CAAA;AAC5F,OAAO,EACL,aAAa,EACb,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACpB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,GAClB,MAAM,YAAY,CAAA"}

package/dist/src/provenance/index.js

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview Public surface of the skill source provenance recovery module.
+ * @module @skillsmith/core/provenance
+ * @see SMI-5407
+ */
+export { parseGitConfigRemote, normalizeGitHubRemote } from './git-config.js';
+export { parsePluginManifestRepository } from './plugin-manifest.js';
+export { scanLocalSkills } from './local-skill-scan.js';
+export { SourceRecoveryService, defaultSkillsRoot, } from './SourceRecoveryService.js';
+export { backfillManifest } from './backfill.js';
+export { METHOD_LABELS, } from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/src/provenance/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/provenance/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,oBAAoB,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAC7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAA;AACpE,OAAO,EAAE,eAAe,EAAwB,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EACL,qBAAqB,EACrB,iBAAiB,GAGlB,MAAM,4BAA4B,CAAA;AACnC,OAAO,EAAE,gBAAgB,EAA8C,MAAM,eAAe,CAAA;AAC5F,OAAO,EACL,aAAa,GAUd,MAAM,YAAY,CAAA"}

package/dist/src/provenance/local-skill-scan.d.ts

@@ -0,0 +1,35 @@
+/**
+ * @fileoverview Enumerate locally-installed skill directories for recovery.
+ * @module @skillsmith/core/provenance/local-skill-scan
+ * @see SMI-5407
+ *
+ * Enumeration guard: directories only; names not starting with `.` (skips
+ * `.backups/`); non-backup dirs must contain SKILL.md; dirs matching
+ * `<base>.backup-YYYYMMDD-*` are listed but flagged `isBackup` (not scanned).
+ */
+/** One enumerated skill directory. */
+export interface LocalSkillEntry {
+    /** Directory basename. */
+    skillName: string;
+    /** Absolute path to the skill directory. */
+    dir: string;
+    /** Absolute path to `<dir>/SKILL.md`. */
+    skillMdPath: string;
+    /** SKILL.md content, or null when a backup (not scanned) or unreadable. */
+    skillMd: string | null;
+    /** `name` from SKILL.md frontmatter, or null. */
+    frontmatterName: string | null;
+    /** `author` from SKILL.md frontmatter, or null. */
+    frontmatterAuthor: string | null;
+    /** True when the directory is a `*.backup-*` snapshot. */
+    isBackup: boolean;
+}
+/**
+ * Enumerate skill directories under `skillsRoot`.
+ *
+ * Backup directories are returned with `isBackup: true` and `skillMd: null`
+ * (still listed, never scanned). Non-backup directories without a readable
+ * SKILL.md are excluded. Returns `[]` when the root is absent.
+ */
+export declare function scanLocalSkills(skillsRoot: string): Promise<LocalSkillEntry[]>;
+//# sourceMappingURL=local-skill-scan.d.ts.map

package/dist/src/provenance/local-skill-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-skill-scan.d.ts","sourceRoot":"","sources":["../../../src/provenance/local-skill-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,sCAAsC;AACtC,MAAM,WAAW,eAAe;IAC9B,0BAA0B;IAC1B,SAAS,EAAE,MAAM,CAAA;IACjB,4CAA4C;IAC5C,GAAG,EAAE,MAAM,CAAA;IACX,yCAAyC;IACzC,WAAW,EAAE,MAAM,CAAA;IACnB,2EAA2E;IAC3E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,iDAAiD;IACjD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,mDAAmD;IACnD,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAA;IAChC,0DAA0D;IAC1D,QAAQ,EAAE,OAAO,CAAA;CAClB;AAYD;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAmDpF"}

package/dist/src/provenance/local-skill-scan.js

@@ -0,0 +1,79 @@
+/**
+ * @fileoverview Enumerate locally-installed skill directories for recovery.
+ * @module @skillsmith/core/provenance/local-skill-scan
+ * @see SMI-5407
+ *
+ * Enumeration guard: directories only; names not starting with `.` (skips
+ * `.backups/`); non-backup dirs must contain SKILL.md; dirs matching
+ * `<base>.backup-YYYYMMDD-*` are listed but flagged `isBackup` (not scanned).
+ */
+import * as fs from 'fs/promises';
+import * as path from 'path';
+import { SkillParser } from '../indexer/SkillParser.js';
+/** Matches a backup directory suffix, e.g. `linear.backup-20260419-124019`. */
+const BACKUP_DIR_RE = /\.backup-\d{8}-/;
+const parser = new SkillParser({ requireName: false });
+/** Parse a SKILL.md's frontmatter name/author defensively. */
+function readFrontmatter(content) {
+    const fm = parser.extractFrontmatter(content);
+    const name = typeof fm?.name === 'string' && fm.name.trim() ? fm.name.trim() : null;
+    const author = typeof fm?.author === 'string' && fm.author.trim() ? fm.author.trim() : null;
+    return { name, author };
+}
+/**
+ * Enumerate skill directories under `skillsRoot`.
+ *
+ * Backup directories are returned with `isBackup: true` and `skillMd: null`
+ * (still listed, never scanned). Non-backup directories without a readable
+ * SKILL.md are excluded. Returns `[]` when the root is absent.
+ */
+export async function scanLocalSkills(skillsRoot) {
+    let dirents;
+    try {
+        dirents = await fs.readdir(skillsRoot, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const entries = [];
+    for (const dirent of dirents) {
+        if (!dirent.isDirectory())
+            continue;
+        const name = dirent.name;
+        if (name.startsWith('.'))
+            continue; // skips `.backups/` and other dotdirs
+        const dir = path.join(skillsRoot, name);
+        const skillMdPath = path.join(dir, 'SKILL.md');
+        if (BACKUP_DIR_RE.test(name)) {
+            entries.push({
+                skillName: name,
+                dir,
+                skillMdPath,
+                skillMd: null,
+                frontmatterName: null,
+                frontmatterAuthor: null,
+                isBackup: true,
+            });
+            continue;
+        }
+        let skillMd;
+        try {
+            skillMd = await fs.readFile(skillMdPath, 'utf-8');
+        }
+        catch {
+            continue; // non-backup dir without a readable SKILL.md is excluded
+        }
+        const { name: fmName, author: fmAuthor } = readFrontmatter(skillMd);
+        entries.push({
+            skillName: name,
+            dir,
+            skillMdPath,
+            skillMd,
+            frontmatterName: fmName,
+            frontmatterAuthor: fmAuthor,
+            isBackup: false,
+        });
+    }
+    return entries;
+}
+//# sourceMappingURL=local-skill-scan.js.map

package/dist/src/provenance/local-skill-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-skill-scan.js","sourceRoot":"","sources":["../../../src/provenance/local-skill-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD,+EAA+E;AAC/E,MAAM,aAAa,GAAG,iBAAiB,CAAA;AAoBvC,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;AAEtD,8DAA8D;AAC9D,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,EAAE,GAAG,MAAM,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAC7C,MAAM,IAAI,GAAG,OAAO,EAAE,EAAE,IAAI,KAAK,QAAQ,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IACnF,MAAM,MAAM,GAAG,OAAO,EAAE,EAAE,MAAM,KAAK,QAAQ,IAAI,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3F,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB;IACtD,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,OAAO,GAAsB,EAAE,CAAA;IAErC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;YAAE,SAAQ;QACnC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAA;QACxB,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ,CAAC,sCAAsC;QAEzE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QACvC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;QAE9C,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS,EAAE,IAAI;gBACf,GAAG;gBACH,WAAW;gBACX,OAAO,EAAE,IAAI;gBACb,eAAe,EAAE,IAAI;gBACrB,iBAAiB,EAAE,IAAI;gBACvB,QAAQ,EAAE,IAAI;aACf,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QAED,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ,CAAC,yDAAyD;QACpE,CAAC;QAED,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;QACnE,OAAO,CAAC,IAAI,CAAC;YACX,SAAS,EAAE,IAAI;YACf,GAAG;YACH,WAAW;YACX,OAAO;YACP,eAAe,EAAE,MAAM;YACvB,iBAAiB,EAAE,QAAQ;YAC3B,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAA;IACJ,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/src/provenance/plugin-manifest.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @fileoverview Recover a skill's GitHub source from a Claude plugin manifest.
+ * @module @skillsmith/core/provenance/plugin-manifest
+ * @see SMI-5407
+ *
+ * Offline only. Reads `<dir>/.claude-plugin/plugin.json` and normalizes the
+ * `repository` field (string or `{ url }`) into a canonical source.
+ */
+import type { RecoveredSource } from './types.js';
+/**
+ * Read `<skillDir>/.claude-plugin/plugin.json` and recover its repository
+ * source. Returns null when the file is missing, malformed, lacks a
+ * `repository`, or the repository is not a github.com URL.
+ */
+export declare function parsePluginManifestRepository(skillDir: string): RecoveredSource | null;
+//# sourceMappingURL=plugin-manifest.d.ts.map

package/dist/src/provenance/plugin-manifest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-manifest.d.ts","sourceRoot":"","sources":["../../../src/provenance/plugin-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAcjD;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAmBtF"}

package/dist/src/provenance/plugin-manifest.js

@@ -0,0 +1,52 @@
+/**
+ * @fileoverview Recover a skill's GitHub source from a Claude plugin manifest.
+ * @module @skillsmith/core/provenance/plugin-manifest
+ * @see SMI-5407
+ *
+ * Offline only. Reads `<dir>/.claude-plugin/plugin.json` and normalizes the
+ * `repository` field (string or `{ url }`) into a canonical source.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { normalizeGitHubRemote } from './git-config.js';
+/** Pull a repository URL string out of a parsed plugin.json `repository` field. */
+function extractRepositoryUrl(parsed) {
+    if (!parsed || typeof parsed !== 'object')
+        return null;
+    const repository = parsed.repository;
+    if (typeof repository === 'string')
+        return repository;
+    if (repository && typeof repository === 'object') {
+        const url = repository.url;
+        if (typeof url === 'string')
+            return url;
+    }
+    return null;
+}
+/**
+ * Read `<skillDir>/.claude-plugin/plugin.json` and recover its repository
+ * source. Returns null when the file is missing, malformed, lacks a
+ * `repository`, or the repository is not a github.com URL.
+ */
+export function parsePluginManifestRepository(skillDir) {
+    const manifestPath = path.join(skillDir, '.claude-plugin', 'plugin.json');
+    let raw;
+    try {
+        raw = fs.readFileSync(manifestPath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const repositoryUrl = extractRepositoryUrl(parsed);
+    if (!repositoryUrl)
+        return null;
+    return normalizeGitHubRemote(repositoryUrl);
+}
+//# sourceMappingURL=plugin-manifest.js.map

package/dist/src/provenance/plugin-manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-manifest.js","sourceRoot":"","sources":["../../../src/provenance/plugin-manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAE5B,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAA;AAGvD,mFAAmF;AACnF,SAAS,oBAAoB,CAAC,MAAe;IAC3C,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IACtD,MAAM,UAAU,GAAI,MAAkC,CAAC,UAAU,CAAA;IACjE,IAAI,OAAO,UAAU,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAA;IACrD,IAAI,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACjD,MAAM,GAAG,GAAI,UAAsC,CAAC,GAAG,CAAA;QACvD,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAA;IACzC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,6BAA6B,CAAC,QAAgB;IAC5D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,EAAE,aAAa,CAAC,CAAA;IACzE,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,aAAa,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAClD,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAA;IAC/B,OAAO,qBAAqB,CAAC,aAAa,CAAC,CAAA;AAC7C,CAAC"}

package/dist/src/provenance/types.d.ts

@@ -0,0 +1,86 @@
+/**
+ * @fileoverview Types for skill source provenance recovery.
+ * @module @skillsmith/core/provenance/types
+ * @see SMI-5407: Skill Source Provenance Recovery
+ *
+ * Recovers the canonical GitHub source of locally-installed skills so that
+ * "Check for updates" (skill_outdated) and "View Changes" (skill_diff) can
+ * resolve. All network/registry access is injected via {@link RecoveryDeps};
+ * the core service performs no network I/O.
+ */
+/**
+ * How a skill's source was recovered. Tiers are tried in confidence order.
+ */
+export type RecoveryMethod = 'git-remote' | 'plugin-json' | 'registry-name' | 'registry-embedding' | 'author-hint' | 'catalog-db' | 'user-specified';
+/**
+ * Confidence in a recovered source. Only `exact`, `high`, and `user-specified`
+ * auto-backfill; `medium`/`low` are review-only.
+ */
+export type RecoveryConfidence = 'exact' | 'high' | 'medium' | 'low' | 'user-specified' | 'unknown';
+/** A recovered canonical GitHub source. `url` is always `https://github.com/<owner>/<repo>`. */
+export interface RecoveredSource {
+    owner: string;
+    repo: string;
+    url: string;
+}
+/** A candidate registry match for an ambiguous (multi-result) name lookup. */
+export interface RecoveryCandidate {
+    /** Registry UUID (skills.id). */
+    id: string;
+    name: string;
+    owner: string;
+    repo: string;
+    /** `https://github.com/<owner>/<repo>` (buildRawUrl-compatible). */
+    url: string;
+    qualityScore: number;
+}
+/** Outcome status for a single skill. */
+export type SkillRecoveryStatus = 'recovered' | 'already_tracked' | 'unknown' | 'skipped_backup';
+/** Result of attempting to recover one skill's source. */
+export interface SkillRecoveryResult {
+    /** Skill directory basename. */
+    skillName: string;
+    /** Absolute install path (the skill directory). */
+    installPath: string;
+    /** Recovered source, or null when unresolved / ambiguous. */
+    recoveredSource: RecoveredSource | null;
+    /** Registry UUID when a registry tier resolved a single match, else null. */
+    registryId: string | null;
+    /** Method that produced the result, or null when unknown / skipped. */
+    method: RecoveryMethod | null;
+    confidence: RecoveryConfidence;
+    /** Populated only for ambiguous registry matches (> 1 candidate). */
+    candidates: RecoveryCandidate[];
+    status: SkillRecoveryStatus;
+}
+/** Aggregate counts over a recovery run. */
+export interface RecoverySummary {
+    total: number;
+    recovered: number;
+    already_tracked: number;
+    unknown: number;
+    skipped_backup: number;
+}
+/** Full recovery report. */
+export interface RecoveryReport {
+    skills: SkillRecoveryResult[];
+    summary: RecoverySummary;
+}
+/**
+ * Injected dependencies for the recovery service. Keeping these injected lets
+ * unit tests run fully offline with mocks and keeps SearchService / the API
+ * client out of the core module (CLI / MCP layers wire the real impls).
+ */
+export interface RecoveryDeps {
+    /** SHA-256 of SKILL.md content (reuse `hashContent`). */
+    hashContent: (content: string) => string;
+    /** Registry name lookup. Returns 0+ candidates for an exact/prefix name. */
+    findCandidatesByName: (name: string) => Promise<RecoveryCandidate[]>;
+    /** Opt-in embedding tiebreak; returns candidates reranked best-first. */
+    rankByEmbedding?: (skillName: string, skillMd: string, candidates: RecoveryCandidate[]) => Promise<RecoveryCandidate[]>;
+    /** Opt-in local catalog hint; returns a GitHub repo_url or null. */
+    lookupCatalogRepoUrl?: (name: string) => Promise<string | null>;
+}
+/** Human-readable label per recovery method (CLI rendering). */
+export declare const METHOD_LABELS: Record<RecoveryMethod, string>;
+//# sourceMappingURL=types.d.ts.map

package/dist/src/provenance/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/provenance/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;GAEG;AACH,MAAM,MAAM,cAAc,GACtB,YAAY,GACZ,aAAa,GACb,eAAe,GACf,oBAAoB,GACpB,aAAa,GACb,YAAY,GACZ,gBAAgB,CAAA;AAEpB;;;GAGG;AACH,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,gBAAgB,GAAG,SAAS,CAAA;AAEnG,gGAAgG;AAChG,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,GAAG,EAAE,MAAM,CAAA;CACZ;AAED,8EAA8E;AAC9E,MAAM,WAAW,iBAAiB;IAChC,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;IACZ,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAA;IACX,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,yCAAyC;AACzC,MAAM,MAAM,mBAAmB,GAAG,WAAW,GAAG,iBAAiB,GAAG,SAAS,GAAG,gBAAgB,CAAA;AAEhG,0DAA0D;AAC1D,MAAM,WAAW,mBAAmB;IAClC,gCAAgC;IAChC,SAAS,EAAE,MAAM,CAAA;IACjB,mDAAmD;IACnD,WAAW,EAAE,MAAM,CAAA;IACnB,6DAA6D;IAC7D,eAAe,EAAE,eAAe,GAAG,IAAI,CAAA;IACvC,6EAA6E;IAC7E,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,uEAAuE;IACvE,MAAM,EAAE,cAAc,GAAG,IAAI,CAAA;IAC7B,UAAU,EAAE,kBAAkB,CAAA;IAC9B,qEAAqE;IACrE,UAAU,EAAE,iBAAiB,EAAE,CAAA;IAC/B,MAAM,EAAE,mBAAmB,CAAA;CAC5B;AAED,4CAA4C;AAC5C,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,cAAc,EAAE,MAAM,CAAA;CACvB;AAED,4BAA4B;AAC5B,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,mBAAmB,EAAE,CAAA;IAC7B,OAAO,EAAE,eAAe,CAAA;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,YAAY;IAC3B,yDAAyD;IACzD,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAA;IACxC,4EAA4E;IAC5E,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACpE,yEAAyE;IACzE,eAAe,CAAC,EAAE,CAChB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,iBAAiB,EAAE,KAC5B,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAA;IACjC,oEAAoE;IACpE,oBAAoB,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAA;CAChE;AAED,gEAAgE;AAChE,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,CAQxD,CAAA"}

package/dist/src/provenance/types.js

@@ -0,0 +1,21 @@
+/**
+ * @fileoverview Types for skill source provenance recovery.
+ * @module @skillsmith/core/provenance/types
+ * @see SMI-5407: Skill Source Provenance Recovery
+ *
+ * Recovers the canonical GitHub source of locally-installed skills so that
+ * "Check for updates" (skill_outdated) and "View Changes" (skill_diff) can
+ * resolve. All network/registry access is injected via {@link RecoveryDeps};
+ * the core service performs no network I/O.
+ */
+/** Human-readable label per recovery method (CLI rendering). */
+export const METHOD_LABELS = {
+    'git-remote': 'git remote',
+    'plugin-json': 'plugin manifest',
+    'registry-name': 'registry name match',
+    'registry-embedding': 'registry embedding match',
+    'author-hint': 'frontmatter author hint',
+    'catalog-db': 'catalog repo_url',
+    'user-specified': 'user specified',
+};
+//# sourceMappingURL=types.js.map

package/dist/src/provenance/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/provenance/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AA+FH,gEAAgE;AAChE,MAAM,CAAC,MAAM,aAAa,GAAmC;IAC3D,YAAY,EAAE,YAAY;IAC1B,aAAa,EAAE,iBAAiB;IAChC,eAAe,EAAE,qBAAqB;IACtC,oBAAoB,EAAE,0BAA0B;IAChD,aAAa,EAAE,yBAAyB;IACxC,YAAY,EAAE,kBAAkB;IAChC,gBAAgB,EAAE,gBAAgB;CACnC,CAAA"}

package/dist/src/repositories/SkillRepository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SkillRepository.d.ts","sourceRoot":"","sources":["../../../src/repositories/SkillRepository.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE3E,OAAO,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAyBpG;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,EAAE,CAAc;gBAEZ,EAAE,EAAE,YAAY;IAK5B,OAAO,CAAC,KAAK,CAYZ;IAED,OAAO,CAAC,iBAAiB;IAoDzB;;OAEG;IACH,OAAO,CAAC,UAAU;IA8BlB;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK;IA4BtC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,KAAK,EAAE;IA6ChD;;OAEG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAKlC;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAK5C;;;OAGG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAC/E,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC;IA+BjE;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,KAAK,GAAG,IAAI;IA4BzD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAK3B;;OAEG;IACH,SAAS,IAAI,MAAM;IAKnB;;OAEG;IACH,KAAK,IAAI,MAAM;IAKf;;OAEG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC;IAI9B;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAK3B;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK;CASvC"}
+{"version":3,"file":"SkillRepository.d.ts","sourceRoot":"","sources":["../../../src/repositories/SkillRepository.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,6BAA6B,CAAA;AAE3E,OAAO,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAyBpG;;GAEG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,EAAE,CAAc;gBAEZ,EAAE,EAAE,YAAY;IAK5B,OAAO,CAAC,KAAK,CAYZ;IAED,OAAO,CAAC,iBAAiB;IAoDzB;;OAEG;IACH,OAAO,CAAC,UAAU;IAgClB;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK;IA4BtC;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,GAAG,KAAK,EAAE;IA6ChD;;OAEG;IACH,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAKlC;;OAEG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI;IAK5C;;;OAGG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC;IAC/E,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC;IA+BjE;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,GAAG,KAAK,GAAG,IAAI;IA4BzD;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAK3B;;OAEG;IACH,SAAS,IAAI,MAAM;IAKnB;;OAEG;IACH,KAAK,IAAI,MAAM;IAKf;;OAEG;IACH,WAAW,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC;IAI9B;;OAEG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO;IAK3B;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK;CASvC"}

package/dist/src/repositories/SkillRepository.js

@@ -75,7 +75,9 @@ export class SkillRepository {
             qualityScore: row.quality_score,
             trustTier: row.trust_tier,
             tags: JSON.parse(row.tags || '[]'),
-            installable: row.installable ?? false,
+            // SMI-5178: when the installable column is NULL, derive from repo_url
+            // (rows created before the column existed are installable iff repo_url is set).
+            installable: row.installable !== null ? row.installable : row.repo_url !== null,
             // SMI-825: Security scan fields
             riskScore: row.risk_score,
             securityFindingsCount: row.security_findings_count ?? 0,

package/dist/src/repositories/SkillRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"SkillRepository.js","sourceRoot":"","sources":["../../../src/repositories/SkillRepository.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AA0BnC;;GAEG;AACH,MAAM,OAAO,eAAe;IAClB,EAAE,CAAc;IAExB,YAAY,EAAgB;QAC1B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAA;IAC1B,CAAC;IAEO,KAAK,CAYZ;IAEO,iBAAiB;QACvB,4DAA4D;QAC5D,IAAI,CAAC,KAAK,GAAG;YACX,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;OAGvB,CAAwC;YAEzC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAE3B,CAA4C;YAE7C,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAEhC,CAAiD;YAElD,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAE1B,CAA2C;YAE5C,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAE5B,CAA6C;YAE9C,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;OAgBvB,CAAwC;YAEzC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAEvB,CAAwC;YAEzC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAE1B,CAA2C;SAC7C,CAAA;IACH,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAa;QAC9B,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,SAAS,EAAE,GAAG,CAAC,UAAgC;YAC/C,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;YAClC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,KAAK;YACrC,gCAAgC;YAChC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,qBAAqB,EAAE,GAAG,CAAC,uBAAuB,IAAI,CAAC;YACvD,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;YAC1C,cAAc,EAAE,GAAG,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC;YAC/E,+BAA+B;YAC/B,aAAa,EACX,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;gBAC7C,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAc;gBAC7C,CAAC,CAAC,SAAS;YACf,sEAAsE;YACtE,qEAAqE;YACrE,+CAA+C;YAC/C,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YACrD,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAA;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAuB;QAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE,CAAA;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;QAE7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CACnB,EAAE,EACF,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,WAAW,IAAI,IAAI,EACzB,KAAK,CAAC,MAAM,IAAI,IAAI,EACpB,KAAK,CAAC,OAAO,IAAI,IAAI,EACrB,KAAK,CAAC,YAAY,IAAI,IAAI,EAC1B,KAAK,CAAC,SAAS,IAAI,SAAS,EAC5B,IAAI;QACJ,gCAAgC;QAChC,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,qBAAqB,IAAI,CAAC,EAChC,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAC/B,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,+BAA+B;QAC/B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;QACzC,gEAAgE;QAChE,KAAK,CAAC,MAAM,IAAI,UAAU,CAC3B,CAAA;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAa,CAAA;QACrD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAA0B;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,MAA0B,EAAE,EAAE;YACpE,MAAM,OAAO,GAAY,EAAE,CAAA;YAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE,CAAA;gBACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;gBAE7C,IAAI,CAAC;oBACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CACnB,EAAE,EACF,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,WAAW,IAAI,IAAI,EACzB,KAAK,CAAC,MAAM,IAAI,IAAI,EACpB,KAAK,CAAC,OAAO,IAAI,IAAI,EACrB,KAAK,CAAC,YAAY,IAAI,IAAI,EAC1B,KAAK,CAAC,SAAS,IAAI,SAAS,EAC5B,IAAI;oBACJ,gCAAgC;oBAChC,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,qBAAqB,IAAI,CAAC,EAChC,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAC/B,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACxE,+BAA+B;oBAC/B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;oBACzC,gEAAgE;oBAChE,KAAK,CAAC,MAAM,IAAI,UAAU,CAC3B,CAAA;oBAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAa,CAAA;oBACrD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;gBACpC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,+CAA+C;oBAC/C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;wBAClE,MAAM,KAAK,CAAA;oBACb,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC,CAAA;QAEF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,EAAU;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAyB,CAAA;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAe;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAA;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAQD,OAAO,CACL,cAA6D,EAC7D,WAAoB;QAEpB,kCAAkC;QAClC,IAAI,KAAa,CAAA;QACjB,IAAI,MAAc,CAAA;QAElB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAClE,oDAAoD;YACpD,KAAK,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAA;YAClC,MAAM,GAAG,cAAc,CAAC,MAAM,IAAI,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,iDAAiD;YACjD,KAAK,GAAG,cAAc,IAAI,EAAE,CAAA;YAC5B,MAAM,GAAG,WAAW,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAe,CAAA;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAuB,CAAA;QAEnE,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9C,KAAK,EAAE,KAAK;YACZ,KAAK;YACL,MAAM;YACN,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK;SACtC,CAAA;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAU,EAAE,KAAuB;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAE3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAClC,KAAK,CAAC,IAAI,IAAI,IAAI,EAClB,KAAK,CAAC,WAAW,IAAI,IAAI,EACzB,KAAK,CAAC,MAAM,IAAI,IAAI,EACpB,KAAK,CAAC,OAAO,IAAI,IAAI,EACrB,KAAK,CAAC,YAAY,IAAI,IAAI,EAC1B,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,IAAI;QACJ,gCAAgC;QAChC,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,qBAAqB,IAAI,IAAI,EACnC,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAC/B,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,+BAA+B;QAC/B,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAC9E,EAAE,CACH,CAAA;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxC,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,SAAS;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,CAAA;QACzC,OAAO,MAAM,CAAC,OAAO,CAAA;IACvB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAuB,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IACH,WAAW,CAAI,EAAW;QACxB,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAA;IAClC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAU;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzC,OAAO,CAAC,CAAC,GAAG,CAAA;IACd,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAuB;QAC5B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAA;YACpD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;CACF"}
+{"version":3,"file":"SkillRepository.js","sourceRoot":"","sources":["../../../src/repositories/SkillRepository.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAA;AA0BnC;;GAEG;AACH,MAAM,OAAO,eAAe;IAClB,EAAE,CAAc;IAExB,YAAY,EAAgB;QAC1B,IAAI,CAAC,EAAE,GAAG,EAAE,CAAA;QACZ,IAAI,CAAC,iBAAiB,EAAE,CAAA;IAC1B,CAAC;IAEO,KAAK,CAYZ;IAEO,iBAAiB;QACvB,4DAA4D;QAC5D,IAAI,CAAC,KAAK,GAAG;YACX,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;OAGvB,CAAwC;YAEzC,UAAU,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAE3B,CAA4C;YAE7C,eAAe,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAEhC,CAAiD;YAElD,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAE1B,CAA2C;YAE5C,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAE5B,CAA6C;YAE9C,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;;;;;;;;;;;;;;;OAgBvB,CAAwC;YAEzC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAEvB,CAAwC;YAEzC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC;;OAE1B,CAA2C;SAC7C,CAAA;IACH,CAAC;IAED;;OAEG;IACK,UAAU,CAAC,GAAa;QAC9B,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,OAAO,EAAE,GAAG,CAAC,QAAQ;YACrB,YAAY,EAAE,GAAG,CAAC,aAAa;YAC/B,SAAS,EAAE,GAAG,CAAC,UAAgC;YAC/C,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;YAClC,sEAAsE;YACtE,gFAAgF;YAChF,WAAW,EAAE,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,KAAK,IAAI;YAC/E,gCAAgC;YAChC,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,qBAAqB,EAAE,GAAG,CAAC,uBAAuB,IAAI,CAAC;YACvD,iBAAiB,EAAE,GAAG,CAAC,mBAAmB;YAC1C,cAAc,EAAE,GAAG,CAAC,eAAe,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC;YAC/E,+BAA+B;YAC/B,aAAa,EACX,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,aAAa,KAAK,IAAI;gBAC7C,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAc;gBAC7C,CAAC,CAAC,SAAS;YACf,sEAAsE;YACtE,qEAAqE;YACrE,+CAA+C;YAC/C,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YACrD,SAAS,EAAE,GAAG,CAAC,UAAU;YACzB,SAAS,EAAE,GAAG,CAAC,UAAU;SAC1B,CAAA;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAuB;QAC5B,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE,CAAA;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;QAE7C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CACnB,EAAE,EACF,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,WAAW,IAAI,IAAI,EACzB,KAAK,CAAC,MAAM,IAAI,IAAI,EACpB,KAAK,CAAC,OAAO,IAAI,IAAI,EACrB,KAAK,CAAC,YAAY,IAAI,IAAI,EAC1B,KAAK,CAAC,SAAS,IAAI,SAAS,EAC5B,IAAI;QACJ,gCAAgC;QAChC,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,qBAAqB,IAAI,CAAC,EAChC,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAC/B,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,+BAA+B;QAC/B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;QACzC,gEAAgE;QAChE,KAAK,CAAC,MAAM,IAAI,UAAU,CAC3B,CAAA;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAa,CAAA;QACrD,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IAC7B,CAAC;IAED;;OAEG;IACH,WAAW,CAAC,MAA0B;QACpC,MAAM,UAAU,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,MAA0B,EAAE,EAAE;YACpE,MAAM,OAAO,GAAY,EAAE,CAAA;YAE3B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;gBAC3B,MAAM,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,UAAU,EAAE,CAAA;gBACnC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAA;gBAE7C,IAAI,CAAC;oBACH,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CACnB,EAAE,EACF,KAAK,CAAC,IAAI,EACV,KAAK,CAAC,WAAW,IAAI,IAAI,EACzB,KAAK,CAAC,MAAM,IAAI,IAAI,EACpB,KAAK,CAAC,OAAO,IAAI,IAAI,EACrB,KAAK,CAAC,YAAY,IAAI,IAAI,EAC1B,KAAK,CAAC,SAAS,IAAI,SAAS,EAC5B,IAAI;oBACJ,gCAAgC;oBAChC,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,qBAAqB,IAAI,CAAC,EAChC,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAC/B,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;oBACxE,+BAA+B;oBAC/B,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;oBACzC,gEAAgE;oBAChE,KAAK,CAAC,MAAM,IAAI,UAAU,CAC3B,CAAA;oBAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAa,CAAA;oBACrD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;gBACpC,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,+CAA+C;oBAC/C,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;wBAClE,MAAM,KAAK,CAAA;oBACb,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,OAAO,CAAA;QAChB,CAAC,CAAC,CAAA;QAEF,OAAO,UAAU,CAAC,MAAM,CAAC,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,EAAU;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAyB,CAAA;QACjE,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,OAAe;QAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAyB,CAAA;QAC3E,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAQD,OAAO,CACL,cAA6D,EAC7D,WAAoB;QAEpB,kCAAkC;QAClC,IAAI,KAAa,CAAA;QACjB,IAAI,MAAc,CAAA;QAElB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAClE,oDAAoD;YACpD,KAAK,GAAG,cAAc,CAAC,KAAK,IAAI,EAAE,CAAA;YAClC,MAAM,GAAG,cAAc,CAAC,MAAM,IAAI,CAAC,CAAA;QACrC,CAAC;aAAM,CAAC;YACN,iDAAiD;YACjD,KAAK,GAAG,cAAc,IAAI,EAAE,CAAA;YAC5B,MAAM,GAAG,WAAW,IAAI,CAAC,CAAA;QAC3B,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAe,CAAA;QAClE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAuB,CAAA;QAEnE,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YAC9C,KAAK,EAAE,KAAK;YACZ,KAAK;YACL,MAAM;YACN,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK;SACtC,CAAA;IACH,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAU,EAAE,KAAuB;QACxC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QAE3D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAClC,KAAK,CAAC,IAAI,IAAI,IAAI,EAClB,KAAK,CAAC,WAAW,IAAI,IAAI,EACzB,KAAK,CAAC,MAAM,IAAI,IAAI,EACpB,KAAK,CAAC,OAAO,IAAI,IAAI,EACrB,KAAK,CAAC,YAAY,IAAI,IAAI,EAC1B,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,IAAI;QACJ,gCAAgC;QAChC,KAAK,CAAC,SAAS,IAAI,IAAI,EACvB,KAAK,CAAC,qBAAqB,IAAI,IAAI,EACnC,KAAK,CAAC,iBAAiB,IAAI,IAAI,EAC/B,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,+BAA+B;QAC/B,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,IAAI,EAC9E,EAAE,CACH,CAAA;QAED,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAC1B,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAU;QACf,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACxC,OAAO,MAAM,CAAC,OAAO,GAAG,CAAC,CAAA;IAC3B,CAAC;IAED;;OAEG;IACH,SAAS;QACP,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,EAAE,CAAA;QACzC,OAAO,MAAM,CAAC,OAAO,CAAA;IACvB,CAAC;IAED;;OAEG;IACH,KAAK;QACH,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,EAAuB,CAAA;QACnE,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;OAEG;IACH,WAAW,CAAI,EAAW;QACxB,OAAO,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,EAAE,CAAA;IAClC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,EAAU;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;QACzC,OAAO,CAAC,CAAC,GAAG,CAAA;IACd,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAuB;QAC5B,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;YAClD,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,QAAQ,CAAA;YACpD,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;CACF"}

package/dist/src/scripts/__tests__/scan-imported-skills.test.js

@@ -72,6 +72,8 @@ describe('SMI-864: Scan Imported Skills', () => {
                     aiDefence: 0, // SMI-1532
                     ssrf: 0, // SMI-3509
                     pii: 0, // SMI-3864
+                    codeExecution: 0, // SMI-5359 Wave 4.2
+                    obfuscatedDirective: 0, // SMI-5359 Wave 4.2
                 },
             };
             expect(shouldQuarantine(report)).toBe(false);
@@ -121,6 +123,8 @@ describe('SMI-864: Scan Imported Skills', () => {
                     aiDefence: 0, // SMI-1532
                     ssrf: 0, // SMI-3509
                     pii: 0, // SMI-3864
+                    codeExecution: 0, // SMI-5359 Wave 4.2
+                    obfuscatedDirective: 0, // SMI-5359 Wave 4.2
                 },
             };
             expect(shouldQuarantine(report, { quarantineThreshold: 40 })).toBe(true);
@@ -145,6 +149,8 @@ describe('SMI-864: Scan Imported Skills', () => {
                     aiDefence: 0, // SMI-1532
                     ssrf: 0, // SMI-3509
                     pii: 0, // SMI-3864
+                    codeExecution: 0, // SMI-5359 Wave 4.2
+                    obfuscatedDirective: 0, // SMI-5359 Wave 4.2
                 },
             };
             expect(shouldQuarantine(report)).toBe(true);
@@ -169,6 +175,8 @@ describe('SMI-864: Scan Imported Skills', () => {
                     aiDefence: 0, // SMI-1532
                     ssrf: 0, // SMI-3509
                     pii: 0, // SMI-3864
+                    codeExecution: 0, // SMI-5359 Wave 4.2
+                    obfuscatedDirective: 0, // SMI-5359 Wave 4.2
                 },
             };
             expect(shouldQuarantine(report)).toBe(true);
@@ -193,6 +201,8 @@ describe('SMI-864: Scan Imported Skills', () => {
                     aiDefence: 0, // SMI-1532
                     ssrf: 0, // SMI-3509
                     pii: 0, // SMI-3864
+                    codeExecution: 0, // SMI-5359 Wave 4.2
+                    obfuscatedDirective: 0, // SMI-5359 Wave 4.2
                 },
             };
             expect(shouldQuarantine(report)).toBe(false);