@skillsmith/core 0.8.0 → 0.8.1

package/dist/tests/integration/QuarantineService.concurrency.test.js

@@ -0,0 +1,280 @@
+/**
+ * SMI-5358: QuarantineService Concurrency / Race Tests
+ *
+ * Existing coverage (QuarantineService.test.ts) only exercises single, strictly
+ * sequential reviews. These tests model OVERLAPPING reviewer/writer operations
+ * against the SAME quarantine entry and assert the concurrency invariants that
+ * protect against lost updates and illegal state transitions:
+ *
+ *   1. Two reviewers racing to decide one SUSPICIOUS entry (approve vs reject)
+ *      -> exactly one wins, the loser is rejected as ALREADY_REVIEWED, and the
+ *         persisted DB state reflects the winner's decision (no lost update).
+ *   2. A stale-snapshot ("optimistic version") writer whose read predates another
+ *      reviewer's decision -> the stale write is rejected, persisted state is
+ *      unchanged from the winner.
+ *   3. MALICIOUS double-approval by the SAME reviewer -> the second is rejected,
+ *      only one approval row exists, and the entry does NOT illegally transition.
+ *   4. MALICIOUS approval by two DISTINCT reviewers reaching the required count
+ *      -> the entry transitions to approved EXACTLY once with exactly two
+ *         approval rows (no double-count, no double-transition).
+ *
+ * HONESTY NOTE: better-sqlite3 is fully SYNCHRONOUS, so genuine OS-thread
+ * interleaving is not achievable in-process. `Promise.all` / `Promise.allSettled`
+ * here schedule each synchronous `service.review()` as a microtask; each call
+ * therefore runs to completion atomically rather than truly interleaving. We are
+ * NOT faking parallelism. What we test is the REAL concurrency invariant: the
+ * read-then-act guard (`reviewStatus !== 'pending'`), the per-reviewer guard
+ * (`hasReviewerApproved`), and the approval-count check are what prevent lost
+ * updates / illegal transitions when overlapping operations target the same
+ * entry. All assertions read the PERSISTED DB state after the race, never a mock
+ * return value. Removing any of those guards makes the persisted state
+ * inconsistent and fails these tests.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { QuarantineService } from '../../src/services/quarantine/QuarantineService.js';
+import { QuarantineServiceError } from '../../src/services/quarantine/types.js';
+import { QuarantineRepository } from '../../src/repositories/quarantine/index.js';
+import { ApprovalRepository } from '../../src/repositories/quarantine/index.js';
+import { AuditLogger } from '../../src/security/AuditLogger.js';
+import { createDatabaseSync } from '../../src/db/createDatabase.js';
+// ============================================================================
+// Test Helpers
+// ============================================================================
+const REVIEW_PERMS = ['quarantine:read', 'quarantine:review'];
+const MALICIOUS_PERMS = [
+    'quarantine:read',
+    'quarantine:review',
+    'quarantine:review_malicious',
+];
+function makeSession(overrides = {}) {
+    return {
+        userId: 'user-123',
+        email: 'reviewer@example.com',
+        displayName: 'Test Reviewer',
+        permissions: REVIEW_PERMS,
+        sessionId: 'session-456',
+        expiresAt: new Date(Date.now() + 3600000),
+        ...overrides,
+    };
+}
+/** Run `fn` on a fresh microtask so overlapping calls are scheduled together. */
+function defer(fn) {
+    return Promise.resolve().then(fn);
+}
+function fulfilled(results) {
+    return results.filter((r) => r.status === 'fulfilled');
+}
+function rejectedWith(results) {
+    return results.filter((r) => r.status === 'rejected');
+}
+// ============================================================================
+// Test Suite
+// ============================================================================
+describe('SMI-5358: QuarantineService concurrency / race invariants', () => {
+    let db;
+    let repository;
+    let approvalRepository;
+    let auditLogger;
+    let service;
+    beforeEach(() => {
+        db = createDatabaseSync(':memory:');
+        auditLogger = new AuditLogger(db);
+        repository = new QuarantineRepository(db, auditLogger);
+        approvalRepository = new ApprovalRepository(db);
+        service = new QuarantineService(repository, approvalRepository, auditLogger);
+    });
+    afterEach(() => {
+        db.close();
+    });
+    // ==========================================================================
+    // SUSPICIOUS: approve vs reject race on the same entry
+    // ==========================================================================
+    describe('SUSPICIOUS approve-vs-reject race', () => {
+        it('lets exactly one reviewer win; the loser is rejected ALREADY_REVIEWED and no update is lost', async () => {
+            const approver = makeSession({ userId: 'user-approve', email: 'approve@example.com' });
+            const rejecter = makeSession({ userId: 'user-reject', email: 'reject@example.com' });
+            const entry = repository.create({
+                skillId: 'test/race-skill',
+                source: 'test',
+                quarantineReason: 'Overlapping reviews',
+                severity: 'SUSPICIOUS',
+            });
+            const results = await Promise.allSettled([
+                defer(() => service.review(approver, entry.id, {
+                    reviewStatus: 'approved',
+                    reviewNotes: 'approve path',
+                })),
+                defer(() => service.review(rejecter, entry.id, {
+                    reviewStatus: 'rejected',
+                    reviewNotes: 'reject path',
+                })),
+            ]);
+            const winners = fulfilled(results);
+            const losers = rejectedWith(results);
+            // Exactly one decision succeeds, exactly one is blocked.
+            expect(winners.length).toBe(1);
+            expect(losers.length).toBe(1);
+            expect(losers[0].reason).toBeInstanceOf(QuarantineServiceError);
+            expect(losers[0].reason.code).toBe('ALREADY_REVIEWED');
+            // Persisted state reflects the WINNER, not a half-written / overwritten row.
+            const persisted = repository.findById(entry.id);
+            expect(persisted).not.toBeNull();
+            expect(persisted.reviewStatus).not.toBe('pending');
+            const winner = winners[0].value;
+            if (winner.approved) {
+                expect(persisted.reviewStatus).toBe('approved');
+                expect(persisted.reviewedBy).toBe(approver.email);
+            }
+            else {
+                expect(persisted.reviewStatus).toBe('rejected');
+                expect(persisted.reviewedBy).toBe(rejecter.email);
+            }
+        });
+        it('rejects a stale-snapshot writer whose read predates the winning decision (no lost update)', () => {
+            const winner = makeSession({ userId: 'user-winner', email: 'winner@example.com' });
+            const staleWriter = makeSession({ userId: 'user-stale', email: 'stale@example.com' });
+            const entry = repository.create({
+                skillId: 'test/stale-skill',
+                source: 'test',
+                quarantineReason: 'Stale snapshot write',
+                severity: 'SUSPICIOUS',
+            });
+            // staleWriter captures a snapshot while the entry is still pending.
+            const snapshot = service.findById(staleWriter, entry.id);
+            expect(snapshot).not.toBeNull();
+            expect(snapshot.reviewStatus).toBe('pending');
+            // winner commits a decision first.
+            service.review(winner, entry.id, {
+                reviewStatus: 'approved',
+                reviewNotes: 'committed first',
+            });
+            // staleWriter now tries to write based on its stale (pending) view.
+            expect(() => service.review(staleWriter, entry.id, {
+                reviewStatus: 'rejected',
+                reviewNotes: 'based on stale read',
+            })).toThrow(QuarantineServiceError);
+            // The winner's decision survives untouched: the stale reject did not overwrite it.
+            const persisted = repository.findById(entry.id);
+            expect(persisted.reviewStatus).toBe('approved');
+            expect(persisted.reviewedBy).toBe(winner.email);
+        });
+    });
+    // ==========================================================================
+    // MALICIOUS: same-reviewer double-approval (per-reviewer guard)
+    // ==========================================================================
+    describe('MALICIOUS same-reviewer double-approval', () => {
+        it('does not double-count or illegally transition when one reviewer approves twice', async () => {
+            const reviewer = makeSession({
+                userId: 'user-dup',
+                email: 'dup@example.com',
+                permissions: MALICIOUS_PERMS,
+            });
+            const entry = repository.create({
+                skillId: 'test/malicious-dup',
+                source: 'test',
+                quarantineReason: 'Malicious code detected',
+                severity: 'MALICIOUS',
+            });
+            const results = await Promise.allSettled([
+                defer(() => service.review(reviewer, entry.id, {
+                    reviewStatus: 'approved',
+                    reviewNotes: 'first',
+                })),
+                defer(() => service.review(reviewer, entry.id, {
+                    reviewStatus: 'approved',
+                    reviewNotes: 'second (duplicate)',
+                })),
+            ]);
+            const winners = fulfilled(results);
+            const losers = rejectedWith(results);
+            // One approval recorded, the duplicate rejected.
+            expect(winners.length).toBe(1);
+            expect(losers.length).toBe(1);
+            expect(losers[0].reason.code).toBe('ALREADY_REVIEWED');
+            // The single accepted approval did NOT complete the workflow.
+            expect(winners[0].value.approved).toBe(false);
+            // Persisted: exactly ONE approval row, and the entry stays pending.
+            const pending = approvalRepository.getPendingApprovals(entry.id);
+            expect(pending.length).toBe(1);
+            expect(pending[0].reviewerId).toBe('user-dup');
+            const persisted = repository.findById(entry.id);
+            expect(persisted.reviewStatus).toBe('pending');
+            expect(persisted.reviewedBy).toBeNull();
+        });
+    });
+    // ==========================================================================
+    // MALICIOUS: two distinct reviewers reaching the required count
+    // ==========================================================================
+    describe('MALICIOUS two-reviewer approval completion', () => {
+        it('transitions to approved exactly once with exactly two approval rows (no double-count)', async () => {
+            const reviewerA = makeSession({
+                userId: 'user-A',
+                email: 'a@example.com',
+                permissions: MALICIOUS_PERMS,
+            });
+            const reviewerB = makeSession({
+                userId: 'user-B',
+                email: 'b@example.com',
+                permissions: MALICIOUS_PERMS,
+            });
+            const entry = repository.create({
+                skillId: 'test/malicious-two',
+                source: 'test',
+                quarantineReason: 'Malicious code detected',
+                severity: 'MALICIOUS',
+            });
+            const results = await Promise.allSettled([
+                defer(() => service.review(reviewerA, entry.id, {
+                    reviewStatus: 'approved',
+                    reviewNotes: 'approval A',
+                })),
+                defer(() => service.review(reviewerB, entry.id, {
+                    reviewStatus: 'approved',
+                    reviewNotes: 'approval B',
+                })),
+            ]);
+            const winners = fulfilled(results);
+            // Both distinct reviewers are accepted.
+            expect(winners.length).toBe(2);
+            // Exactly ONE result reports completion (approved), the other in-progress.
+            const completed = winners.filter((r) => r.value.approved === true);
+            const inProgress = winners.filter((r) => r.value.approved === false);
+            expect(completed.length).toBe(1);
+            expect(inProgress.length).toBe(1);
+            // Persisted: exactly two approval rows, both approvals, all marked complete.
+            const allApprovals = approvalRepository.getApprovals(entry.id);
+            expect(allApprovals.length).toBe(2);
+            expect(allApprovals.filter((a) => a.decision === 'approved').length).toBe(2);
+            expect(allApprovals.every((a) => a.isComplete)).toBe(true);
+            const reviewerIds = allApprovals.map((a) => a.reviewerId).sort();
+            expect(reviewerIds).toEqual(['user-A', 'user-B']);
+            // No pending approvals remain, and the entry transitioned to approved once.
+            expect(approvalRepository.getPendingApprovals(entry.id).length).toBe(0);
+            const persisted = repository.findById(entry.id);
+            expect(persisted.reviewStatus).toBe('approved');
+        });
+        it('keeps the entry pending after a single approval (count guard holds)', () => {
+            const reviewerA = makeSession({
+                userId: 'user-solo',
+                email: 'solo@example.com',
+                permissions: MALICIOUS_PERMS,
+            });
+            const entry = repository.create({
+                skillId: 'test/malicious-solo',
+                source: 'test',
+                quarantineReason: 'Malicious code detected',
+                severity: 'MALICIOUS',
+            });
+            const result = service.review(reviewerA, entry.id, {
+                reviewStatus: 'approved',
+                reviewNotes: 'only approval',
+            });
+            // A single approval must NOT unilaterally unquarantine a MALICIOUS skill.
+            expect(result.approved).toBe(false);
+            const persisted = repository.findById(entry.id);
+            expect(persisted.reviewStatus).toBe('pending');
+            expect(approvalRepository.getPendingApprovals(entry.id).length).toBe(1);
+        });
+    });
+});
+//# sourceMappingURL=QuarantineService.concurrency.test.js.map

package/dist/tests/integration/QuarantineService.concurrency.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"QuarantineService.concurrency.test.js","sourceRoot":"","sources":["../../../tests/integration/QuarantineService.concurrency.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,oDAAoD,CAAA;AACtF,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAA;AAK/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4CAA4C,CAAA;AACjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4CAA4C,CAAA;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAA;AAGnE,+EAA+E;AAC/E,eAAe;AACf,+EAA+E;AAE/E,MAAM,YAAY,GAAwC,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;AAElG,MAAM,eAAe,GAAwC;IAC3D,iBAAiB;IACjB,mBAAmB;IACnB,6BAA6B;CAC9B,CAAA;AAED,SAAS,WAAW,CAAC,YAA2C,EAAE;IAChE,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,sBAAsB;QAC7B,WAAW,EAAE,eAAe;QAC5B,WAAW,EAAE,YAAY;QACzB,SAAS,EAAE,aAAa;QACxB,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC;QACzC,GAAG,SAAS;KACb,CAAA;AACH,CAAC;AAED,iFAAiF;AACjF,SAAS,KAAK,CAAI,EAAW;IAC3B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;AACnC,CAAC;AAED,SAAS,SAAS,CAAI,OAAkC;IACtD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAkC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC,CAAA;AACxF,CAAC;AAED,SAAS,YAAY,CAAC,OAAwC;IAC5D,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,UAAU,CAAC,CAAA;AACnF,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E,QAAQ,CAAC,2DAA2D,EAAE,GAAG,EAAE;IACzE,IAAI,EAAY,CAAA;IAChB,IAAI,UAAgC,CAAA;IACpC,IAAI,kBAAsC,CAAA;IAC1C,IAAI,WAAwB,CAAA;IAC5B,IAAI,OAA0B,CAAA;IAE9B,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAA;QACnC,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,CAAC,CAAA;QACjC,UAAU,GAAG,IAAI,oBAAoB,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QACtD,kBAAkB,GAAG,IAAI,kBAAkB,CAAC,EAAE,CAAC,CAAA;QAC/C,OAAO,GAAG,IAAI,iBAAiB,CAAC,UAAU,EAAE,kBAAkB,EAAE,WAAW,CAAC,CAAA;IAC9E,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,KAAK,EAAE,CAAA;IACZ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,uDAAuD;IACvD,6EAA6E;IAE7E,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE;QACjD,EAAE,CAAC,6FAA6F,EAAE,KAAK,IAAI,EAAE;YAC3G,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,cAAc,EAAE,KAAK,EAAE,qBAAqB,EAAE,CAAC,CAAA;YACtF,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;YAEpF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC9B,OAAO,EAAE,iBAAiB;gBAC1B,MAAM,EAAE,MAAM;gBACd,gBAAgB,EAAE,qBAAqB;gBACvC,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,GAAG,EAAE,CACT,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE;oBACjC,YAAY,EAAE,UAAU;oBACxB,WAAW,EAAE,cAAc;iBAC5B,CAAC,CACH;gBACD,KAAK,CAAC,GAAG,EAAE,CACT,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE;oBACjC,YAAY,EAAE,UAAU;oBACxB,WAAW,EAAE,aAAa;iBAC3B,CAAC,CACH;aACF,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,SAAS,CAA4B,OAAO,CAAC,CAAA;YAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;YAEpC,yDAAyD;YACzD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAA;YAC/D,MAAM,CAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAiC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;YAElF,6EAA6E;YAC7E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC/C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;YAChC,MAAM,CAAC,SAAU,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YAC/B,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACpB,MAAM,CAAC,SAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAChD,MAAM,CAAC,SAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,SAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;gBAChD,MAAM,CAAC,SAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YACpD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,2FAA2F,EAAE,GAAG,EAAE;YACnG,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC,CAAA;YAClF,MAAM,WAAW,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,CAAA;YAErF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC9B,OAAO,EAAE,kBAAkB;gBAC3B,MAAM,EAAE,MAAM;gBACd,gBAAgB,EAAE,sBAAsB;gBACxC,QAAQ,EAAE,YAAY;aACvB,CAAC,CAAA;YAEF,oEAAoE;YACpE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,CAAC,CAAA;YACxD,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAA;YAC/B,MAAM,CAAC,QAAS,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAE9C,mCAAmC;YACnC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE;gBAC/B,YAAY,EAAE,UAAU;gBACxB,WAAW,EAAE,iBAAiB;aAC/B,CAAC,CAAA;YAEF,oEAAoE;YACpE,MAAM,CAAC,GAAG,EAAE,CACV,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,EAAE,EAAE;gBACpC,YAAY,EAAE,UAAU;gBACxB,WAAW,EAAE,qBAAqB;aACnC,CAAC,CACH,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA;YAEjC,mFAAmF;YACnF,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC/C,MAAM,CAAC,SAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAChD,MAAM,CAAC,SAAU,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAE7E,QAAQ,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACvD,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;YAC9F,MAAM,QAAQ,GAAG,WAAW,CAAC;gBAC3B,MAAM,EAAE,UAAU;gBAClB,KAAK,EAAE,iBAAiB;gBACxB,WAAW,EAAE,eAAe;aAC7B,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC9B,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE,MAAM;gBACd,gBAAgB,EAAE,yBAAyB;gBAC3C,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,GAAG,EAAE,CACT,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE;oBACjC,YAAY,EAAE,UAAU;oBACxB,WAAW,EAAE,OAAO;iBACrB,CAAC,CACH;gBACD,KAAK,CAAC,GAAG,EAAE,CACT,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE;oBACjC,YAAY,EAAE,UAAU;oBACxB,WAAW,EAAE,oBAAoB;iBAClC,CAAC,CACH;aACF,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,SAAS,CAA4B,OAAO,CAAC,CAAA;YAC7D,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;YAEpC,iDAAiD;YACjD,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC9B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC7B,MAAM,CAAE,MAAM,CAAC,CAAC,CAAC,CAAC,MAAiC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;YAElF,8DAA8D;YAC9D,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAE7C,oEAAoE;YACpE,MAAM,OAAO,GAAG,kBAAkB,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAChE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC9B,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;YAE9C,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC/C,MAAM,CAAC,SAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC/C,MAAM,CAAC,SAAU,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC1C,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;IAEF,6EAA6E;IAC7E,gEAAgE;IAChE,6EAA6E;IAE7E,QAAQ,CAAC,4CAA4C,EAAE,GAAG,EAAE;QAC1D,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;YACrG,MAAM,SAAS,GAAG,WAAW,CAAC;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,eAAe;aAC7B,CAAC,CAAA;YACF,MAAM,SAAS,GAAG,WAAW,CAAC;gBAC5B,MAAM,EAAE,QAAQ;gBAChB,KAAK,EAAE,eAAe;gBACtB,WAAW,EAAE,eAAe;aAC7B,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC9B,OAAO,EAAE,oBAAoB;gBAC7B,MAAM,EAAE,MAAM;gBACd,gBAAgB,EAAE,yBAAyB;gBAC3C,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;gBACvC,KAAK,CAAC,GAAG,EAAE,CACT,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE;oBAClC,YAAY,EAAE,UAAU;oBACxB,WAAW,EAAE,YAAY;iBAC1B,CAAC,CACH;gBACD,KAAK,CAAC,GAAG,EAAE,CACT,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE;oBAClC,YAAY,EAAE,UAAU;oBACxB,WAAW,EAAE,YAAY;iBAC1B,CAAC,CACH;aACF,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,SAAS,CAA4B,OAAO,CAAC,CAAA;YAE7D,wCAAwC;YACxC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAE9B,2EAA2E;YAC3E,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAA;YAClE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;YACpE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAChC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAEjC,6EAA6E;YAC7E,MAAM,YAAY,GAAG,kBAAkB,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC9D,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACnC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC5E,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC1D,MAAM,WAAW,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;YAChE,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;YAEjD,4EAA4E;YAC5E,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACvE,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC/C,MAAM,CAAC,SAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;QAEF,EAAE,CAAC,qEAAqE,EAAE,GAAG,EAAE;YAC7E,MAAM,SAAS,GAAG,WAAW,CAAC;gBAC5B,MAAM,EAAE,WAAW;gBACnB,KAAK,EAAE,kBAAkB;gBACzB,WAAW,EAAE,eAAe;aAC7B,CAAC,CAAA;YAEF,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,CAAC;gBAC9B,OAAO,EAAE,qBAAqB;gBAC9B,MAAM,EAAE,MAAM;gBACd,gBAAgB,EAAE,yBAAyB;gBAC3C,QAAQ,EAAE,WAAW;aACtB,CAAC,CAAA;YAEF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE;gBACjD,YAAY,EAAE,UAAU;gBACxB,WAAW,EAAE,eAAe;aAC7B,CAAC,CAAA;YAEF,0EAA0E;YAC1E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YACnC,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC/C,MAAM,CAAC,SAAU,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YAC/C,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACzE,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/integration/openapi-contract.test.d.ts

@@ -0,0 +1,16 @@
+/**
+ * SMI-5213 / Wave 1 BARRIER: OpenAPI contract enforcement test.
+ *
+ * Guards the three-way consistency between:
+ *   1. docs/internal/api/openapi.yaml  (source of truth)
+ *   2. packages/core/src/api/types.ts  (API_TRUST_TIERS, API_CATEGORIES)
+ *   3. supabase/config.toml            (verify_jwt = false function registrations)
+ *
+ * Skip-gated: the entire suite is skipped when docs/internal/api/openapi.yaml
+ * is absent (external contributors / CI without the docs/internal submodule).
+ *
+ * verify_jwt=false (21 fns) ⊋ documented-public (12 paths).
+ * The allowlist below is the positive source of truth for the public surface.
+ */
+export {};
+//# sourceMappingURL=openapi-contract.test.d.ts.map

package/dist/tests/integration/openapi-contract.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-contract.test.d.ts","sourceRoot":"","sources":["../../../tests/integration/openapi-contract.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}

package/dist/tests/integration/openapi-contract.test.js

@@ -0,0 +1,231 @@
+/**
+ * SMI-5213 / Wave 1 BARRIER: OpenAPI contract enforcement test.
+ *
+ * Guards the three-way consistency between:
+ *   1. docs/internal/api/openapi.yaml  (source of truth)
+ *   2. packages/core/src/api/types.ts  (API_TRUST_TIERS, API_CATEGORIES)
+ *   3. supabase/config.toml            (verify_jwt = false function registrations)
+ *
+ * Skip-gated: the entire suite is skipped when docs/internal/api/openapi.yaml
+ * is absent (external contributors / CI without the docs/internal submodule).
+ *
+ * verify_jwt=false (21 fns) ⊋ documented-public (12 paths).
+ * The allowlist below is the positive source of truth for the public surface.
+ */
+import { describe, it, expect } from 'vitest';
+import { existsSync, readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import path from 'node:path';
+import { parse } from 'yaml';
+import { API_TRUST_TIERS, API_CATEGORIES } from '../../src/api/types.js';
+// ---------------------------------------------------------------------------
+// Locate files relative to this test file
+// ---------------------------------------------------------------------------
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+// packages/core/tests/integration/ → up 4 dirs to repo root
+const REPO_ROOT = path.resolve(__dirname, '..', '..', '..', '..');
+const OPENAPI_PATH = path.join(REPO_ROOT, 'docs', 'internal', 'api', 'openapi.yaml');
+const SUPABASE_CONFIG_PATH = path.join(REPO_ROOT, 'supabase', 'config.toml');
+// SMI-5226: the spec is committed to the website's public/ dir so Vercel's
+// remote rebuild serves it at /openapi.yaml (the deploy can't see the private
+// docs/internal submodule). This committed copy must stay byte-identical to the
+// source. The dedicated PR check openapi-spec-sync.yml is the enforced guard
+// (the vitest CI job does not fetch docs/internal); this is local-dev signal.
+const WEBSITE_SPEC_PATH = path.join(REPO_ROOT, 'packages', 'website', 'public', 'openapi.yaml');
+// ---------------------------------------------------------------------------
+// Allowlist of the 12 documented public endpoints (positive source of truth)
+// ---------------------------------------------------------------------------
+const DOCUMENTED_ENDPOINTS = [
+    '/skills-search',
+    '/skills-get',
+    '/skills-recommend',
+    '/events',
+    '/health',
+    '/stats',
+    '/early-access-signup',
+    '/contact-submit',
+    '/checkout',
+    '/stripe-webhook',
+    '/auth-device-code',
+    '/auth-device-token',
+];
+// Gateway-verified functions (deploy WITHOUT --no-verify-jwt); they appear in
+// config.toml with verify_jwt = true and are NOT in the allowlist above but
+// may be reachable via other surfaces.
+const GATEWAY_VERIFIED_EXCEPTIONS = new Set([
+    'webhook-dlq',
+    'auth-device-approve',
+    'auth-device-preview',
+    'indexer-dispatch',
+    'team-invite-send',
+    'sync-stripe-email',
+    'sync-oauth-email',
+]);
+function collectEnums(node, breadcrumb) {
+    if (!node || typeof node !== 'object')
+        return [];
+    const results = [];
+    if (Array.isArray(node)) {
+        for (let i = 0; i < node.length; i++) {
+            results.push(...collectEnums(node[i], `${breadcrumb}[${i}]`));
+        }
+        return results;
+    }
+    const obj = node;
+    // Parameter-style: { name: 'trust_tier', schema: { enum: [...] } }
+    if (typeof obj['name'] === 'string' &&
+        obj['schema'] &&
+        typeof obj['schema'] === 'object' &&
+        !Array.isArray(obj['schema'])) {
+        const schema = obj['schema'];
+        if (Array.isArray(schema['enum'])) {
+            results.push({
+                fieldName: obj['name'],
+                enumValues: schema['enum'],
+                location: `${breadcrumb}(param:${obj['name']}).schema.enum`,
+            });
+        }
+    }
+    // Schema-property style: { properties: { trust_tier: { enum: [...] } } }
+    if (obj['properties'] &&
+        typeof obj['properties'] === 'object' &&
+        !Array.isArray(obj['properties'])) {
+        const props = obj['properties'];
+        for (const [propName, propVal] of Object.entries(props)) {
+            if (propVal &&
+                typeof propVal === 'object' &&
+                !Array.isArray(propVal) &&
+                Array.isArray(propVal['enum'])) {
+                results.push({
+                    fieldName: propName,
+                    enumValues: propVal['enum'],
+                    location: `${breadcrumb}.properties.${propName}.enum`,
+                });
+            }
+            // Recurse into the property value
+            results.push(...collectEnums(propVal, `${breadcrumb}.properties.${propName}`));
+        }
+    }
+    // Recurse into all other keys (skipping 'properties' already handled and 'schema'
+    // only if we didn't already collect from it above — but recurse always to find nested)
+    for (const [key, val] of Object.entries(obj)) {
+        if (key === 'properties')
+            continue; // already handled above
+        results.push(...collectEnums(val, `${breadcrumb}.${key}`));
+    }
+    return results;
+}
+// ---------------------------------------------------------------------------
+// Deduplicate by (fieldName, location) to avoid double-counting from recursion
+// ---------------------------------------------------------------------------
+function deduplicateEnums(occurrences) {
+    const seen = new Set();
+    return occurrences.filter((o) => {
+        const key = `${o.fieldName}::${o.location}`;
+        if (seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+// ---------------------------------------------------------------------------
+// Parse config.toml: collect function names with verify_jwt = false
+// ---------------------------------------------------------------------------
+function collectNoJwtFunctions(tomlContent) {
+    const result = new Set();
+    // Match [functions.<name>] blocks followed by verify_jwt = false
+    const blockRegex = /\[functions\.([^\]]+)\][^[]*verify_jwt\s*=\s*false/g;
+    let match;
+    while ((match = blockRegex.exec(tomlContent)) !== null) {
+        result.add(match[1].trim());
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Conditionally skip when submodule is absent
+// ---------------------------------------------------------------------------
+const specExists = existsSync(OPENAPI_PATH);
+describe.skipIf(!specExists)('SMI-5213: OpenAPI contract', () => {
+    // Parse once per suite
+    const specContent = specExists ? readFileSync(OPENAPI_PATH, 'utf-8') : '';
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const spec = specExists ? parse(specContent) : null;
+    // -------------------------------------------------------------------------
+    // Top-level metadata assertions
+    // -------------------------------------------------------------------------
+    it('license is Elastic License 2.0', () => {
+        expect(spec.info.license.name).toBe('Elastic License 2.0');
+    });
+    it('production server URL is https://api.skillsmith.app', () => {
+        const servers = spec.servers ?? [];
+        const prodServer = servers.find((s) => s.description?.toLowerCase().includes('production'));
+        expect(prodServer, 'No production server entry found').toBeDefined();
+        expect(prodServer.url).toBe('https://api.skillsmith.app');
+    });
+    it('contact.url includes smith-horn', () => {
+        expect(spec.info.contact.url).toContain('smith-horn');
+    });
+    // -------------------------------------------------------------------------
+    // Enum consistency: trust_tier
+    // -------------------------------------------------------------------------
+    it('all trust_tier enum occurrences match API_TRUST_TIERS', () => {
+        const all = deduplicateEnums(collectEnums(spec, 'spec'));
+        const trustTierOccurrences = all.filter((o) => o.fieldName === 'trust_tier');
+        expect(trustTierOccurrences.length, `Expected ≥2 trust_tier enum occurrences, found ${trustTierOccurrences.length}: ${trustTierOccurrences.map((o) => o.location).join(', ')}`).toBeGreaterThanOrEqual(2);
+        for (const occurrence of trustTierOccurrences) {
+            expect(occurrence.enumValues, `trust_tier enum mismatch at ${occurrence.location}`).toEqual([
+                ...API_TRUST_TIERS,
+            ]);
+        }
+    });
+    it('all category enum occurrences match API_CATEGORIES', () => {
+        const all = deduplicateEnums(collectEnums(spec, 'spec'));
+        const categoryOccurrences = all.filter((o) => o.fieldName === 'category');
+        expect(categoryOccurrences.length, `Expected ≥1 category enum occurrence, found ${categoryOccurrences.length}: ${categoryOccurrences.map((o) => o.location).join(', ')}`).toBeGreaterThanOrEqual(1);
+        for (const occurrence of categoryOccurrences) {
+            expect(occurrence.enumValues, `category enum mismatch at ${occurrence.location}`).toEqual([
+                ...API_CATEGORIES,
+            ]);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // Documented paths
+    // -------------------------------------------------------------------------
+    it('spec documents all 12 allowlisted paths', () => {
+        const specPaths = Object.keys(spec.paths ?? {});
+        for (const endpoint of DOCUMENTED_ENDPOINTS) {
+            expect(specPaths, `Spec is missing documented endpoint: ${endpoint}`).toContain(endpoint);
+        }
+    });
+    it('spec contains no undocumented paths beyond the allowlist', () => {
+        const specPaths = Object.keys(spec.paths ?? {});
+        const allowSet = new Set(DOCUMENTED_ENDPOINTS);
+        const extras = specPaths.filter((p) => !allowSet.has(p));
+        expect(extras, `Spec contains paths not in the documented allowlist: ${extras.join(', ')}`).toHaveLength(0);
+    });
+    // -------------------------------------------------------------------------
+    // config.toml surface alignment
+    // -------------------------------------------------------------------------
+    it("each documented endpoint's function name is registered as verify_jwt=false (or is a gateway-verified exception)", () => {
+        expect(existsSync(SUPABASE_CONFIG_PATH), 'supabase/config.toml not found').toBe(true);
+        const toml = readFileSync(SUPABASE_CONFIG_PATH, 'utf-8');
+        const noJwtFunctions = collectNoJwtFunctions(toml);
+        for (const endpoint of DOCUMENTED_ENDPOINTS) {
+            // Strip leading slash to get function name
+            const fnName = endpoint.replace(/^\//, '');
+            const isNoJwt = noJwtFunctions.has(fnName);
+            const isException = GATEWAY_VERIFIED_EXCEPTIONS.has(fnName);
+            expect(isNoJwt || isException, `${endpoint} (fn: ${fnName}) is neither in verify_jwt=false list nor in GATEWAY_VERIFIED_EXCEPTIONS`).toBe(true);
+        }
+    });
+    // -------------------------------------------------------------------------
+    // SMI-5226: committed website copy must match the source byte-for-byte
+    // -------------------------------------------------------------------------
+    it('committed packages/website/public/openapi.yaml is byte-identical to the source', () => {
+        expect(existsSync(WEBSITE_SPEC_PATH), 'packages/website/public/openapi.yaml is missing — run `npm run sync:openapi` in packages/website and commit').toBe(true);
+        const websiteCopy = readFileSync(WEBSITE_SPEC_PATH, 'utf-8');
+        expect(websiteCopy, 'public/openapi.yaml drifted from docs/internal/api/openapi.yaml — run `npm run sync:openapi` in packages/website and commit').toBe(specContent);
+    });
+});
+//# sourceMappingURL=openapi-contract.test.js.map

package/dist/tests/integration/openapi-contract.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi-contract.test.js","sourceRoot":"","sources":["../../../tests/integration/openapi-contract.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAA;AACxC,OAAO,IAAI,MAAM,WAAW,CAAA;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,MAAM,CAAA;AAC5B,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AAExE,8EAA8E;AAC9E,0CAA0C;AAC1C,8EAA8E;AAE9E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;AAE1C,4DAA4D;AAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAA;AACjE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,cAAc,CAAC,CAAA;AACpF,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC,CAAA;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAA;AAE/F,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG;IAC3B,gBAAgB;IAChB,aAAa;IACb,mBAAmB;IACnB,SAAS;IACT,SAAS;IACT,QAAQ;IACR,sBAAsB;IACtB,iBAAiB;IACjB,WAAW;IACX,iBAAiB;IACjB,mBAAmB;IACnB,oBAAoB;CACZ,CAAA;AAEV,8EAA8E;AAC9E,4EAA4E;AAC5E,uCAAuC;AACvC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,aAAa;IACb,qBAAqB;IACrB,qBAAqB;IACrB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,kBAAkB;CACnB,CAAC,CAAA;AAiBF,SAAS,YAAY,CAAC,IAAc,EAAE,UAAkB;IACtD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAA;IAEhD,MAAM,OAAO,GAAqB,EAAE,CAAA;IAEpC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC,CAAa,EAAE,GAAG,UAAU,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;QAC3E,CAAC;QACD,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,MAAM,GAAG,GAAG,IAA+B,CAAA;IAE3C,mEAAmE;IACnE,IACE,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ;QAC/B,GAAG,CAAC,QAAQ,CAAC;QACb,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,QAAQ;QACjC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,EAC7B,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,CAA4B,CAAA;QACvD,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC;gBACX,SAAS,EAAE,GAAG,CAAC,MAAM,CAAW;gBAChC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAa;gBACtC,QAAQ,EAAE,GAAG,UAAU,UAAU,GAAG,CAAC,MAAM,CAAC,eAAe;aAC5D,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,IACE,GAAG,CAAC,YAAY,CAAC;QACjB,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EACjC,CAAC;QACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAA4B,CAAA;QAC1D,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,IACE,OAAO;gBACP,OAAO,OAAO,KAAK,QAAQ;gBAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBACvB,KAAK,CAAC,OAAO,CAAE,OAAmC,CAAC,MAAM,CAAC,CAAC,EAC3D,CAAC;gBACD,OAAO,CAAC,IAAI,CAAC;oBACX,SAAS,EAAE,QAAQ;oBACnB,UAAU,EAAG,OAAmC,CAAC,MAAM,CAAa;oBACpE,QAAQ,EAAE,GAAG,UAAU,eAAe,QAAQ,OAAO;iBACtD,CAAC,CAAA;YACJ,CAAC;YACD,kCAAkC;YAClC,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,OAAmB,EAAE,GAAG,UAAU,eAAe,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC5F,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,uFAAuF;IACvF,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,IAAI,GAAG,KAAK,YAAY;YAAE,SAAQ,CAAC,wBAAwB;QAC3D,OAAO,CAAC,IAAI,CAAC,GAAG,YAAY,CAAC,GAAe,EAAE,GAAG,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC,CAAA;IACxE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAE9E,SAAS,gBAAgB,CAAC,WAA6B;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,QAAQ,EAAE,CAAA;QAC3C,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAA;QAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACb,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,8EAA8E;AAC9E,oEAAoE;AACpE,8EAA8E;AAE9E,SAAS,qBAAqB,CAAC,WAAmB;IAChD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;IAChC,iEAAiE;IACjE,MAAM,UAAU,GAAG,qDAAqD,CAAA;IACxE,IAAI,KAA6B,CAAA;IACjC,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,8EAA8E;AAC9E,8CAA8C;AAC9C,8EAA8E;AAE9E,MAAM,UAAU,GAAG,UAAU,CAAC,YAAY,CAAC,CAAA;AAE3C,QAAQ,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC,4BAA4B,EAAE,GAAG,EAAE;IAC9D,uBAAuB;IACvB,MAAM,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,8DAA8D;IAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAE,KAAK,CAAC,WAAW,CAAS,CAAC,CAAC,CAAC,IAAI,CAAA;IAE5D,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAE5E,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC7D,MAAM,OAAO,GAAiD,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;QAChF,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAA;QAC3F,MAAM,CAAC,UAAU,EAAE,kCAAkC,CAAC,CAAC,WAAW,EAAE,CAAA;QACpE,MAAM,CAAC,UAAW,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;IAC5D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,+BAA+B;IAC/B,4EAA4E;IAE5E,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,GAAG,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,MAAM,oBAAoB,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,YAAY,CAAC,CAAA;QAE5E,MAAM,CACJ,oBAAoB,CAAC,MAAM,EAC3B,kDAAkD,oBAAoB,CAAC,MAAM,KAAK,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3I,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;QAE3B,KAAK,MAAM,UAAU,IAAI,oBAAoB,EAAE,CAAC;YAC9C,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,+BAA+B,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC;gBAC1F,GAAG,eAAe;aACnB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,MAAM,GAAG,GAAG,gBAAgB,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;QACxD,MAAM,mBAAmB,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,UAAU,CAAC,CAAA;QAEzE,MAAM,CACJ,mBAAmB,CAAC,MAAM,EAC1B,+CAA+C,mBAAmB,CAAC,MAAM,KAAK,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtI,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAA;QAE3B,KAAK,MAAM,UAAU,IAAI,mBAAmB,EAAE,CAAC;YAC7C,MAAM,CAAC,UAAU,CAAC,UAAU,EAAE,6BAA6B,UAAU,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC;gBACxF,GAAG,cAAc;aAClB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,mBAAmB;IACnB,4EAA4E;IAE5E,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,SAAS,GAAa,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QACzD,KAAK,MAAM,QAAQ,IAAI,oBAAoB,EAAE,CAAC;YAC5C,MAAM,CAAC,SAAS,EAAE,wCAAwC,QAAQ,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,SAAS,GAAa,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAS,oBAAoB,CAAC,CAAA;QACtD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACxD,MAAM,CACJ,MAAM,EACN,wDAAwD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC5E,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,gCAAgC;IAChC,4EAA4E;IAE5E,EAAE,CAAC,iHAAiH,EAAE,GAAG,EAAE;QACzH,MAAM,CAAC,UAAU,CAAC,oBAAoB,CAAC,EAAE,gCAAgC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrF,MAAM,IAAI,GAAG,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAA;QACxD,MAAM,cAAc,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAA;QAElD,KAAK,MAAM,QAAQ,IAAI,oBAAoB,EAAE,CAAC;YAC5C,2CAA2C;YAC3C,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;YAC1C,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC1C,MAAM,WAAW,GAAG,2BAA2B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC3D,MAAM,CACJ,OAAO,IAAI,WAAW,EACtB,GAAG,QAAQ,SAAS,MAAM,0EAA0E,CACrG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACd,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAE5E,EAAE,CAAC,gFAAgF,EAAE,GAAG,EAAE;QACxF,MAAM,CACJ,UAAU,CAAC,iBAAiB,CAAC,EAC7B,6GAA6G,CAC9G,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACZ,MAAM,WAAW,GAAG,YAAY,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;QAC5D,MAAM,CACJ,WAAW,EACX,6HAA6H,CAC9H,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IACrB,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/tests/provenance/SourceRecoveryService.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=SourceRecoveryService.test.d.ts.map

package/dist/tests/provenance/SourceRecoveryService.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SourceRecoveryService.test.d.ts","sourceRoot":"","sources":["../../../tests/provenance/SourceRecoveryService.test.ts"],"names":[],"mappings":""}