@skillsmith/core 0.9.0 → 0.11.0

package/dist/src/paywall-triggers/path.js

@@ -0,0 +1,73 @@
+/**
+ * Trigger-state file layout (SMI-5456 Wave 1 Step 5, QD-3).
+ *
+ * `~/.skillsmith/paywall-triggers/<triggerId>.json` — one file per trigger,
+ * mirroring the per-resource-directory convention already used by
+ * `journal/path.ts` (`~/.skillsmith/journal/`) and
+ * `telemetry/agent-marker.ts` (`~/.skillsmith/agent-markers/`). Named
+ * `paywall-triggers` (not `triggers`) both in the module path and the
+ * on-disk directory to avoid any collision with the PRE-EXISTING, unrelated
+ * `packages/core/src/triggers/` module (`TriggerDetector`/`ContextScorer` —
+ * proactive skill-suggestion detection, nothing to do with PRD §8.1's T1-T4
+ * paywall triggers).
+ *
+ * Format compatibility with the SessionStart hook's nudge cooldown
+ * (the per-harness `hooks/<harness>/session-start.sh` script, generated by
+ * the — locked for this step — `agent-pack/hooks.ts`): that hook writes a
+ * PLAIN epoch-seconds integer to
+ * `~/.skillsmith/agent-nudge.state` (`SKILLSMITH_AGENT_NUDGE_STATE`
+ * override), because it is self-contained POSIX sh with no JSON tooling
+ * available. This module's {@link getNudgeCooldownState} reads that EXACT
+ * file/format/override so a future consumer (a report, a diagnostic) can
+ * inspect the onboarding-nudge cooldown through the same TS surface as the
+ * T1-T4 paywall triggers, without asking the hook to change its wire format.
+ * The T1-T4 trigger files themselves are independent, JSON-shaped, and own
+ * their own directory — see the module header of `store.ts` for why.
+ *
+ * @module @skillsmith/core/paywall-triggers/path
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { getConfigDir } from '../config/index.js';
+/** Env var overriding the trigger-state directory (test isolation). */
+export const TRIGGER_STATE_DIR_ENV_VAR = 'SKILLSMITH_TRIGGER_STATE_DIR';
+function getTriggerStateDir() {
+    const override = process.env[TRIGGER_STATE_DIR_ENV_VAR];
+    return override && override.length > 0 ? override : join(getConfigDir(), 'paywall-triggers');
+}
+export function getTriggerStateFilePath(triggerId) {
+    return join(getTriggerStateDir(), `${triggerId}.json`);
+}
+export function getTriggerStateDirForTests() {
+    return getTriggerStateDir();
+}
+/**
+ * Read the onboarding SessionStart hook's nudge-cooldown stamp — the SAME
+ * file (`~/.skillsmith/agent-nudge.state`, override
+ * `SKILLSMITH_AGENT_NUDGE_STATE`) `hooks.ts`'s `renderSessionStartHook`
+ * writes a bare epoch-seconds integer into. Read-only: this module never
+ * writes this file — that stays the hook's job.
+ *
+ * @returns the last-nudge epoch-seconds, or null if the file is absent,
+ *   empty, or not a valid non-negative integer (matches the hook's own
+ *   tolerant `case "" | *[!0-9]*) last=0` parsing — malformed content is
+ *   treated as "no prior nudge", never an error).
+ */
+export function getNudgeCooldownState() {
+    const override = process.env.SKILLSMITH_AGENT_NUDGE_STATE;
+    const path = override && override.length > 0 ? override : join(getConfigDir(), 'agent-nudge.state');
+    if (!existsSync(path))
+        return null;
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf-8').trim();
+    }
+    catch {
+        return null;
+    }
+    if (!/^[0-9]+$/.test(raw))
+        return null;
+    const value = Number(raw);
+    return Number.isSafeInteger(value) ? value : null;
+}
+//# sourceMappingURL=path.js.map

package/dist/src/paywall-triggers/path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path.js","sourceRoot":"","sources":["../../../src/paywall-triggers/path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAGjD,uEAAuE;AACvE,MAAM,CAAC,MAAM,yBAAyB,GAAG,8BAA8B,CAAA;AAEvE,SAAS,kBAAkB;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;IACvD,OAAO,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,kBAAkB,CAAC,CAAA;AAC9F,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,SAAoB;IAC1D,OAAO,IAAI,CAAC,kBAAkB,EAAE,EAAE,GAAG,SAAS,OAAO,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,0BAA0B;IACxC,OAAO,kBAAkB,EAAE,CAAA;AAC7B,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB;IACnC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;IACzD,MAAM,IAAI,GACR,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,mBAAmB,CAAC,CAAA;IACxF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAClC,IAAI,GAAW,CAAA;IACf,IAAI,CAAC;QACH,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAA;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AACnD,CAAC"}

package/dist/src/paywall-triggers/store.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Paywall trigger-state store (SMI-5456 Wave 1 Step 5, QD-3).
+ *
+ * PRD §8.1 defines four paywall triggers (T1 version currency, T2 quota
+ * forecast, T3 sharing, T4 security-depth disclosure) with two frequency
+ * rules: at most one upgrade prompt per session, and two dismissals of the
+ * same trigger suppress it for 30 days. This module persists the state those
+ * rules need — per-trigger last-shown session id, dismissal count, and mute
+ * expiry — under `~/.skillsmith/paywall-triggers/` (deliberately NOT
+ * `~/.skillsmith/triggers/` — see `path.ts`'s header for the pre-existing,
+ * unrelated `packages/core/src/triggers/` module this avoids colliding with).
+ *
+ * WAVE-1 SCOPE LIMITATION (read before wiring this into anything):
+ * The trigger RULES live in the pack's prompt wording (PRD §6 change 6) —
+ * the agent, running inside whatever harness's model, decides in
+ * conversation whether to mention a trigger, and the user's response
+ * ("no thanks") is plain conversational text the agent sees, not a
+ * structured tool call. There is currently NO MCP tool or CLI command that
+ * reports a T1/T2/T4 dismissal from that conversation into this store — no
+ * Wave-1 exclusion-9 tool covers it (PRD §10 exclusion 9's only two
+ * acknowledged exceptions are the undo tool and the Wave-2 stats surface).
+ * That means: {@link recordTriggerDismissal} is real, tested infrastructure
+ * with NO live caller in Wave 1. This is intentional staged infrastructure
+ * (the same shape the change-journal module shipped in — Step 3, before the
+ * apply tools became its first real caller in a later step) — NOT an
+ * "unconsumed dismissal-recording pathway" in the house anti-pattern sense,
+ * because nothing in this codebase currently calls it as if dismissals were
+ * being captured. Do not present in-conversation dismissal tracking as a
+ * shipped product behavior (docs, marketing copy, the eval-matrix report)
+ * until a real consumer exists. What DOES already work end-to-end in Wave 1:
+ * the session-cap half via {@link canShowTrigger}/{@link recordImpression} —
+ * though even that has no live caller yet either, since trigger *display*
+ * also currently lives entirely in the pack's prompt wording. Both halves
+ * are ready for whichever surface (a future tool, or a CLI diagnostic) needs
+ * them; the eval-matrix worker (Step 6) should treat "trigger frequency cap
+ * enforced server-side" as NOT YET TRUE for the published Tier badges.
+ *
+ * Single-writer-per-trigger-file note: like the journal (P-5), each trigger
+ * file is read-modify-written directly (not append-only, since there's only
+ * ever one live state per trigger, not a growing log) — concurrent writers
+ * to the SAME trigger id are not expected in Wave 1 (no live caller), so no
+ * write-queue serialization is implemented here; add one if/when a consumer
+ * with real concurrency (e.g. two parallel MCP requests) lands.
+ *
+ * @module @skillsmith/core/paywall-triggers/store
+ */
+import { type TriggerId, type TriggerState } from './types.js';
+/** Load a trigger's persisted state, or a fresh empty state if none exists or it is corrupt. */
+export declare function loadTriggerState(triggerId: TriggerId): TriggerState;
+/**
+ * Is `triggerId` currently muted (30-day suppression after
+ * {@link TRIGGER_DISMISSAL_THRESHOLD} dismissals)?
+ *
+ * @param now - injectable clock for tests.
+ */
+export declare function isTriggerMuted(state: TriggerState, now?: number): boolean;
+/**
+ * P-5 "one prompt per session enforced from persisted state, not memory":
+ * true when `triggerId` has NOT already been shown in `sessionId` AND is not
+ * currently muted. Concurrent sessions may each independently see `true` and
+ * both prompt once — accepted, documented (P-5 table).
+ */
+export declare function canShowTrigger(triggerId: TriggerId, sessionId: string, now?: number): boolean;
+/** Record that `triggerId` was shown in `sessionId` (persisted — the session cap). */
+export declare function recordImpression(triggerId: TriggerId, sessionId: string): TriggerState;
+/**
+ * Record a dismissal. On reaching {@link TRIGGER_DISMISSAL_THRESHOLD}
+ * dismissals, sets a {@link TRIGGER_MUTE_DAYS}-day mute from `now`.
+ *
+ * See the module header: no Wave-1 caller reports a real in-conversation
+ * dismissal today. This function is correct, tested library code — not an
+ * inert stub — for whichever surface becomes that caller.
+ */
+export declare function recordTriggerDismissal(triggerId: TriggerId, now?: number): TriggerState;
+//# sourceMappingURL=store.d.ts.map

package/dist/src/paywall-triggers/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/paywall-triggers/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAMH,OAAO,EAIL,KAAK,SAAS,EACd,KAAK,YAAY,EAClB,MAAM,YAAY,CAAA;AAInB,gGAAgG;AAChG,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,GAAG,YAAY,CAiBnE;AAQD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,YAAY,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAErF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,SAAS,EAAE,SAAS,EACpB,SAAS,EAAE,MAAM,EACjB,GAAG,GAAE,MAAmB,GACvB,OAAO,CAIT;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,GAAG,YAAY,CAKtF;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,SAAS,EACpB,GAAG,GAAE,MAAmB,GACvB,YAAY,CAQd"}

package/dist/src/paywall-triggers/store.js

@@ -0,0 +1,122 @@
+/**
+ * Paywall trigger-state store (SMI-5456 Wave 1 Step 5, QD-3).
+ *
+ * PRD §8.1 defines four paywall triggers (T1 version currency, T2 quota
+ * forecast, T3 sharing, T4 security-depth disclosure) with two frequency
+ * rules: at most one upgrade prompt per session, and two dismissals of the
+ * same trigger suppress it for 30 days. This module persists the state those
+ * rules need — per-trigger last-shown session id, dismissal count, and mute
+ * expiry — under `~/.skillsmith/paywall-triggers/` (deliberately NOT
+ * `~/.skillsmith/triggers/` — see `path.ts`'s header for the pre-existing,
+ * unrelated `packages/core/src/triggers/` module this avoids colliding with).
+ *
+ * WAVE-1 SCOPE LIMITATION (read before wiring this into anything):
+ * The trigger RULES live in the pack's prompt wording (PRD §6 change 6) —
+ * the agent, running inside whatever harness's model, decides in
+ * conversation whether to mention a trigger, and the user's response
+ * ("no thanks") is plain conversational text the agent sees, not a
+ * structured tool call. There is currently NO MCP tool or CLI command that
+ * reports a T1/T2/T4 dismissal from that conversation into this store — no
+ * Wave-1 exclusion-9 tool covers it (PRD §10 exclusion 9's only two
+ * acknowledged exceptions are the undo tool and the Wave-2 stats surface).
+ * That means: {@link recordTriggerDismissal} is real, tested infrastructure
+ * with NO live caller in Wave 1. This is intentional staged infrastructure
+ * (the same shape the change-journal module shipped in — Step 3, before the
+ * apply tools became its first real caller in a later step) — NOT an
+ * "unconsumed dismissal-recording pathway" in the house anti-pattern sense,
+ * because nothing in this codebase currently calls it as if dismissals were
+ * being captured. Do not present in-conversation dismissal tracking as a
+ * shipped product behavior (docs, marketing copy, the eval-matrix report)
+ * until a real consumer exists. What DOES already work end-to-end in Wave 1:
+ * the session-cap half via {@link canShowTrigger}/{@link recordImpression} —
+ * though even that has no live caller yet either, since trigger *display*
+ * also currently lives entirely in the pack's prompt wording. Both halves
+ * are ready for whichever surface (a future tool, or a CLI diagnostic) needs
+ * them; the eval-matrix worker (Step 6) should treat "trigger frequency cap
+ * enforced server-side" as NOT YET TRUE for the published Tier badges.
+ *
+ * Single-writer-per-trigger-file note: like the journal (P-5), each trigger
+ * file is read-modify-written directly (not append-only, since there's only
+ * ever one live state per trigger, not a growing log) — concurrent writers
+ * to the SAME trigger id are not expected in Wave 1 (no live caller), so no
+ * write-queue serialization is implemented here; add one if/when a consumer
+ * with real concurrency (e.g. two parallel MCP requests) lands.
+ *
+ * @module @skillsmith/core/paywall-triggers/store
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { getTriggerStateFilePath } from './path.js';
+import { TRIGGER_DISMISSAL_THRESHOLD, TRIGGER_MUTE_DAYS, emptyTriggerState, } from './types.js';
+const MUTE_DURATION_MS = TRIGGER_MUTE_DAYS * 24 * 60 * 60 * 1000;
+/** Load a trigger's persisted state, or a fresh empty state if none exists or it is corrupt. */
+export function loadTriggerState(triggerId) {
+    const path = getTriggerStateFilePath(triggerId);
+    if (!existsSync(path))
+        return emptyTriggerState(triggerId);
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf-8'));
+        if (parsed.triggerId !== triggerId)
+            return emptyTriggerState(triggerId);
+        return {
+            schema: 1,
+            triggerId,
+            lastSessionShown: typeof parsed.lastSessionShown === 'string' ? parsed.lastSessionShown : null,
+            dismissalCount: typeof parsed.dismissalCount === 'number' ? parsed.dismissalCount : 0,
+            mutedUntil: typeof parsed.mutedUntil === 'number' ? parsed.mutedUntil : null,
+        };
+    }
+    catch {
+        return emptyTriggerState(triggerId);
+    }
+}
+function saveTriggerState(state) {
+    const path = getTriggerStateFilePath(state.triggerId);
+    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+    writeFileSync(path, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
+}
+/**
+ * Is `triggerId` currently muted (30-day suppression after
+ * {@link TRIGGER_DISMISSAL_THRESHOLD} dismissals)?
+ *
+ * @param now - injectable clock for tests.
+ */
+export function isTriggerMuted(state, now = Date.now()) {
+    return state.mutedUntil !== null && now < state.mutedUntil;
+}
+/**
+ * P-5 "one prompt per session enforced from persisted state, not memory":
+ * true when `triggerId` has NOT already been shown in `sessionId` AND is not
+ * currently muted. Concurrent sessions may each independently see `true` and
+ * both prompt once — accepted, documented (P-5 table).
+ */
+export function canShowTrigger(triggerId, sessionId, now = Date.now()) {
+    const state = loadTriggerState(triggerId);
+    if (isTriggerMuted(state, now))
+        return false;
+    return state.lastSessionShown !== sessionId;
+}
+/** Record that `triggerId` was shown in `sessionId` (persisted — the session cap). */
+export function recordImpression(triggerId, sessionId) {
+    const state = loadTriggerState(triggerId);
+    const next = { ...state, lastSessionShown: sessionId };
+    saveTriggerState(next);
+    return next;
+}
+/**
+ * Record a dismissal. On reaching {@link TRIGGER_DISMISSAL_THRESHOLD}
+ * dismissals, sets a {@link TRIGGER_MUTE_DAYS}-day mute from `now`.
+ *
+ * See the module header: no Wave-1 caller reports a real in-conversation
+ * dismissal today. This function is correct, tested library code — not an
+ * inert stub — for whichever surface becomes that caller.
+ */
+export function recordTriggerDismissal(triggerId, now = Date.now()) {
+    const state = loadTriggerState(triggerId);
+    const dismissalCount = state.dismissalCount + 1;
+    const mutedUntil = dismissalCount >= TRIGGER_DISMISSAL_THRESHOLD ? now + MUTE_DURATION_MS : state.mutedUntil;
+    const next = { ...state, dismissalCount, mutedUntil };
+    saveTriggerState(next);
+    return next;
+}
+//# sourceMappingURL=store.js.map

package/dist/src/paywall-triggers/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/paywall-triggers/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EACL,2BAA2B,EAC3B,iBAAiB,EACjB,iBAAiB,GAGlB,MAAM,YAAY,CAAA;AAEnB,MAAM,gBAAgB,GAAG,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;AAEhE,gGAAgG;AAChG,MAAM,UAAU,gBAAgB,CAAC,SAAoB;IACnD,MAAM,IAAI,GAAG,uBAAuB,CAAC,SAAS,CAAC,CAAA;IAC/C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAA;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAA0B,CAAA;QAC/E,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS;YAAE,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAA;QACvE,OAAO;YACL,MAAM,EAAE,CAAC;YACT,SAAS;YACT,gBAAgB,EACd,OAAO,MAAM,CAAC,gBAAgB,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI;YAC9E,cAAc,EAAE,OAAO,MAAM,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YACrF,UAAU,EAAE,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;SAC7E,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC,SAAS,CAAC,CAAA;IACrC,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAmB;IAC3C,MAAM,IAAI,GAAG,uBAAuB,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACrD,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;AAC7E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAmB,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IAC1E,OAAO,KAAK,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,GAAG,KAAK,CAAC,UAAU,CAAA;AAC5D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC5B,SAAoB,EACpB,SAAiB,EACjB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACzC,IAAI,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,OAAO,KAAK,CAAC,gBAAgB,KAAK,SAAS,CAAA;AAC7C,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,gBAAgB,CAAC,SAAoB,EAAE,SAAiB;IACtE,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACzC,MAAM,IAAI,GAAiB,EAAE,GAAG,KAAK,EAAE,gBAAgB,EAAE,SAAS,EAAE,CAAA;IACpE,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACtB,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACpC,SAAoB,EACpB,MAAc,IAAI,CAAC,GAAG,EAAE;IAExB,MAAM,KAAK,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACzC,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,GAAG,CAAC,CAAA;IAC/C,MAAM,UAAU,GACd,cAAc,IAAI,2BAA2B,CAAC,CAAC,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAA;IAC3F,MAAM,IAAI,GAAiB,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,CAAA;IACnE,gBAAgB,CAAC,IAAI,CAAC,CAAA;IACtB,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/src/paywall-triggers/store.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=store.test.d.ts.map

package/dist/src/paywall-triggers/store.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.test.d.ts","sourceRoot":"","sources":["../../../src/paywall-triggers/store.test.ts"],"names":[],"mappings":""}

package/dist/src/paywall-triggers/store.test.js

@@ -0,0 +1,121 @@
+/**
+ * @fileoverview Tests for the paywall trigger-state store (SMI-5456 Wave 1
+ *               Step 5, QD-3). Covers the P-5 "Trigger state" invariant:
+ *               "One prompt per session enforced from persisted state, not
+ *               memory" (cap) + "30-day mute expiry" test.
+ * @module @skillsmith/core/paywall-triggers/store.test
+ */
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { afterEach, beforeEach, describe, expect, it } from 'vitest';
+import { canShowTrigger, getNudgeCooldownState, isTriggerMuted, loadTriggerState, recordImpression, recordTriggerDismissal, TRIGGER_DISMISSAL_THRESHOLD, TRIGGER_MUTE_DAYS, TRIGGER_STATE_DIR_ENV_VAR, } from './index.js';
+let stateDir;
+let prevEnv;
+let prevNudgeEnv;
+beforeEach(() => {
+    stateDir = mkdtempSync(join(tmpdir(), 'skillsmith-paywall-triggers-'));
+    prevEnv = process.env[TRIGGER_STATE_DIR_ENV_VAR];
+    process.env[TRIGGER_STATE_DIR_ENV_VAR] = stateDir;
+    prevNudgeEnv = process.env.SKILLSMITH_AGENT_NUDGE_STATE;
+});
+afterEach(() => {
+    rmSync(stateDir, { recursive: true, force: true });
+    if (prevEnv !== undefined)
+        process.env[TRIGGER_STATE_DIR_ENV_VAR] = prevEnv;
+    else
+        delete process.env[TRIGGER_STATE_DIR_ENV_VAR];
+    if (prevNudgeEnv !== undefined)
+        process.env.SKILLSMITH_AGENT_NUDGE_STATE = prevNudgeEnv;
+    else
+        delete process.env.SKILLSMITH_AGENT_NUDGE_STATE;
+});
+describe('session cap (persisted, not memory)', () => {
+    it('allows showing a trigger the first time in a session', () => {
+        expect(canShowTrigger('T1', 'session-a')).toBe(true);
+    });
+    it('blocks a second impression of the same trigger in the same session', () => {
+        recordImpression('T1', 'session-a');
+        expect(canShowTrigger('T1', 'session-a')).toBe(false);
+    });
+    it('the cap is read from persisted state, not in-memory — a fresh loadTriggerState call after recordImpression reflects it', () => {
+        recordImpression('T2', 'session-x');
+        const state = loadTriggerState('T2');
+        expect(state.lastSessionShown).toBe('session-x');
+    });
+    it('allows the SAME trigger again in a DIFFERENT session (documented: concurrent sessions may each prompt once)', () => {
+        recordImpression('T1', 'session-a');
+        expect(canShowTrigger('T1', 'session-b')).toBe(true);
+    });
+    it('caps are independent per trigger id', () => {
+        recordImpression('T1', 'session-a');
+        expect(canShowTrigger('T3', 'session-a')).toBe(true);
+    });
+});
+describe('30-day mute expiry', () => {
+    it('does not mute after one dismissal', () => {
+        const state = recordTriggerDismissal('T4');
+        expect(state.dismissalCount).toBe(1);
+        expect(isTriggerMuted(state)).toBe(false);
+    });
+    it(`mutes after ${TRIGGER_DISMISSAL_THRESHOLD} dismissals`, () => {
+        recordTriggerDismissal('T4');
+        const state = recordTriggerDismissal('T4');
+        expect(state.dismissalCount).toBe(TRIGGER_DISMISSAL_THRESHOLD);
+        expect(isTriggerMuted(state)).toBe(true);
+    });
+    it('a muted trigger cannot be shown, even in a session it was never shown in', () => {
+        recordTriggerDismissal('T1');
+        recordTriggerDismissal('T1');
+        expect(canShowTrigger('T1', 'brand-new-session')).toBe(false);
+    });
+    it(`is still muted 1ms before ${TRIGGER_MUTE_DAYS} days elapse`, () => {
+        const now = 1_000_000;
+        recordTriggerDismissal('T2', now);
+        recordTriggerDismissal('T2', now);
+        const almostExpired = now + TRIGGER_MUTE_DAYS * 24 * 60 * 60 * 1000 - 1;
+        const state = loadTriggerState('T2');
+        expect(isTriggerMuted(state, almostExpired)).toBe(true);
+    });
+    it(`the mute has expired exactly at ${TRIGGER_MUTE_DAYS} days`, () => {
+        const now = 1_000_000;
+        recordTriggerDismissal('T2', now);
+        recordTriggerDismissal('T2', now);
+        const exactlyExpired = now + TRIGGER_MUTE_DAYS * 24 * 60 * 60 * 1000;
+        const state = loadTriggerState('T2');
+        expect(isTriggerMuted(state, exactlyExpired)).toBe(false);
+    });
+    it('canShowTrigger allows the trigger again once the mute has expired', () => {
+        const now = 1_000_000;
+        recordTriggerDismissal('T3', now);
+        recordTriggerDismissal('T3', now);
+        const afterMute = now + TRIGGER_MUTE_DAYS * 24 * 60 * 60 * 1000 + 1;
+        expect(canShowTrigger('T3', 'any-session', afterMute)).toBe(true);
+    });
+    it('dismissal count keeps accumulating past the threshold (never resets)', () => {
+        recordTriggerDismissal('T1');
+        recordTriggerDismissal('T1');
+        const state = recordTriggerDismissal('T1');
+        expect(state.dismissalCount).toBe(3);
+    });
+});
+describe('getNudgeCooldownState — format compatibility with the SessionStart hook', () => {
+    it('returns null when the nudge-state file does not exist', () => {
+        const nudgeFile = join(stateDir, 'agent-nudge.state');
+        process.env.SKILLSMITH_AGENT_NUDGE_STATE = nudgeFile;
+        expect(getNudgeCooldownState()).toBeNull();
+    });
+    it('reads a plain epoch-seconds integer written by the hook (no JSON, no wrapper)', () => {
+        const nudgeFile = join(stateDir, 'agent-nudge.state');
+        process.env.SKILLSMITH_AGENT_NUDGE_STATE = nudgeFile;
+        writeFileSync(nudgeFile, '1735689600');
+        expect(getNudgeCooldownState()).toBe(1735689600);
+    });
+    it('treats malformed content as "no prior nudge" (matches the hook\'s own tolerant parsing)', () => {
+        const nudgeFile = join(stateDir, 'agent-nudge.state');
+        process.env.SKILLSMITH_AGENT_NUDGE_STATE = nudgeFile;
+        writeFileSync(nudgeFile, 'not-a-number');
+        expect(getNudgeCooldownState()).toBeNull();
+    });
+});
+//# sourceMappingURL=store.test.js.map

package/dist/src/paywall-triggers/store.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.test.js","sourceRoot":"","sources":["../../../src/paywall-triggers/store.test.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC5D,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEpE,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,2BAA2B,EAC3B,iBAAiB,EACjB,yBAAyB,GAC1B,MAAM,YAAY,CAAA;AAEnB,IAAI,QAAgB,CAAA;AACpB,IAAI,OAA2B,CAAA;AAC/B,IAAI,YAAgC,CAAA;AAEpC,UAAU,CAAC,GAAG,EAAE;IACd,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,8BAA8B,CAAC,CAAC,CAAA;IACtE,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;IAChD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,QAAQ,CAAA;IACjD,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;AACzD,CAAC,CAAC,CAAA;AAEF,SAAS,CAAC,GAAG,EAAE;IACb,MAAM,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAClD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,OAAO,CAAA;;QACtE,OAAO,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAA;IAClD,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,YAAY,CAAA;;QAClF,OAAO,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAA;AACtD,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,qCAAqC,EAAE,GAAG,EAAE;IACnD,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,oEAAoE,EAAE,GAAG,EAAE;QAC5E,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACnC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IACvD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wHAAwH,EAAE,GAAG,EAAE;QAChI,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACnC,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6GAA6G,EAAE,GAAG,EAAE;QACrH,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACnC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAA;QACnC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtD,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,eAAe,2BAA2B,aAAa,EAAE,GAAG,EAAE;QAC/D,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;QAC9D,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,GAAG,EAAE;QAClF,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5B,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,6BAA6B,iBAAiB,cAAc,EAAE,GAAG,EAAE;QACpE,MAAM,GAAG,GAAG,SAAS,CAAA;QACrB,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACjC,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,aAAa,GAAG,GAAG,GAAG,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,CAAA;QACvE,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mCAAmC,iBAAiB,OAAO,EAAE,GAAG,EAAE;QACnE,MAAM,GAAG,GAAG,SAAS,CAAA;QACrB,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACjC,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,cAAc,GAAG,GAAG,GAAG,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA;QACpE,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAA;QACpC,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC3D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,mEAAmE,EAAE,GAAG,EAAE;QAC3E,MAAM,GAAG,GAAG,SAAS,CAAA;QACrB,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACjC,sBAAsB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QACjC,MAAM,SAAS,GAAG,GAAG,GAAG,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,CAAA;QACnE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC9E,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5B,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC5B,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAA;QAC1C,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA;AAEF,QAAQ,CAAC,yEAAyE,EAAE,GAAG,EAAE;IACvF,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,SAAS,CAAA;QACpD,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC5C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,+EAA+E,EAAE,GAAG,EAAE;QACvF,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,SAAS,CAAA;QACpD,aAAa,CAAC,SAAS,EAAE,YAAY,CAAC,CAAA;QACtC,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAClD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yFAAyF,EAAE,GAAG,EAAE;QACjG,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAAA;QACrD,OAAO,CAAC,GAAG,CAAC,4BAA4B,GAAG,SAAS,CAAA;QACpD,aAAa,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;QACxC,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAA;IAC5C,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/paywall-triggers/types.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Trigger-state types (SMI-5456 Wave 1 Step 5, QD-3).
+ *
+ * @module @skillsmith/core/paywall-triggers/types
+ */
+/** Paywall trigger IDs from PRD §8.1 (T1 version currency, T2 quota forecast, T3 sharing, T4 security depth). */
+export type TriggerId = 'T1' | 'T2' | 'T3' | 'T4';
+/** Days a trigger stays muted after its dismissal threshold is reached (PRD §8.1 principle 2). */
+export declare const TRIGGER_MUTE_DAYS = 30;
+/** Dismissals before a trigger is muted (PRD §8.1: "two dismissals... suppress it for 30 days"). */
+export declare const TRIGGER_DISMISSAL_THRESHOLD = 2;
+/** On-disk per-trigger state (`~/.skillsmith/paywall-triggers/<id>.json`). */
+export interface TriggerState {
+    schema: 1;
+    triggerId: TriggerId;
+    /** Session id of the last session this trigger was shown in, or null. */
+    lastSessionShown: string | null;
+    /** Total dismissal count (never resets, even after a mute expires). */
+    dismissalCount: number;
+    /** Epoch-ms the mute lifts, or null when not currently muted. */
+    mutedUntil: number | null;
+}
+export declare function emptyTriggerState(triggerId: TriggerId): TriggerState;
+//# sourceMappingURL=types.d.ts.map

package/dist/src/paywall-triggers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/paywall-triggers/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,iHAAiH;AACjH,MAAM,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAA;AAEjD,kGAAkG;AAClG,eAAO,MAAM,iBAAiB,KAAK,CAAA;AAEnC,oGAAoG;AACpG,eAAO,MAAM,2BAA2B,IAAI,CAAA;AAE5C,8EAA8E;AAC9E,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,CAAC,CAAA;IACT,SAAS,EAAE,SAAS,CAAA;IACpB,yEAAyE;IACzE,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,uEAAuE;IACvE,cAAc,EAAE,MAAM,CAAA;IACtB,iEAAiE;IACjE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B;AAED,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,GAAG,YAAY,CAEpE"}

package/dist/src/paywall-triggers/types.js

@@ -0,0 +1,13 @@
+/**
+ * Trigger-state types (SMI-5456 Wave 1 Step 5, QD-3).
+ *
+ * @module @skillsmith/core/paywall-triggers/types
+ */
+/** Days a trigger stays muted after its dismissal threshold is reached (PRD §8.1 principle 2). */
+export const TRIGGER_MUTE_DAYS = 30;
+/** Dismissals before a trigger is muted (PRD §8.1: "two dismissals... suppress it for 30 days"). */
+export const TRIGGER_DISMISSAL_THRESHOLD = 2;
+export function emptyTriggerState(triggerId) {
+    return { schema: 1, triggerId, lastSessionShown: null, dismissalCount: 0, mutedUntil: null };
+}
+//# sourceMappingURL=types.js.map

package/dist/src/paywall-triggers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/paywall-triggers/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,kGAAkG;AAClG,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAA;AAEnC,oGAAoG;AACpG,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAA;AAc5C,MAAM,UAAU,iBAAiB,CAAC,SAAoB;IACpD,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAA;AAC9F,CAAC"}

package/dist/src/security/index.d.ts

@@ -9,6 +9,8 @@
  */
 export { SecurityScanner } from './scanner/index.js';
 export type { SecurityFinding, SecurityFindingType, SecuritySeverity, ScanReport, ScannerOptions, RiskScoreBreakdown, } from './scanner/index.js';
+export { compareScanReports, DEFAULT_RISK_THRESHOLD } from './scanner/index.js';
+export type { HostileUpdateVerdict } from './scanner/index.js';
 export { sanitizeHtml, sanitizeFileName, sanitizePath, sanitizeUrl, sanitizeText, isValidStripeId, sanitizeStripeCustomerId, sanitizeStripeSubscriptionId, sanitizeStripePriceId, sanitizeStripeInvoiceId, sanitizeStripeEventId, } from './sanitization.js';
 export { validateDbPath, validateDbPathOrThrow, isPathSafe, DEFAULT_ALLOWED_DIRS, } from './pathValidation.js';
 export type { PathValidationOptions, PathValidationResult } from './pathValidation.js';

package/dist/src/security/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAG3B,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY,EAEZ,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAGtF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,YAAY,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGtD,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtF,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AACpD,YAAY,EACV,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAI3B,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAC/E,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAG9D,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY,EAEZ,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAA;AAG1B,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAC5B,YAAY,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAGtF,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAC9C,YAAY,EACV,aAAa,EACb,cAAc,EACd,UAAU,EACV,WAAW,EACX,gBAAgB,EAChB,UAAU,GACX,MAAM,kBAAkB,CAAA;AAGzB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAChC,YAAY,EACV,eAAe,EACf,eAAe,EACf,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,yBAAyB,CAAA;AAGhC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGtD,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AACtF,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/src/security/index.js

@@ -9,6 +9,10 @@
  */
 // Scanner module
 export { SecurityScanner } from './scanner/index.js';
+// SMI-5535 R0 Wave 2A: the hostile-update (rug-pull) comparator is a public
+// feature; surface it (+ its default threshold + verdict type) through the
+// security barrel so it is reachable from `@skillsmith/core`.
+export { compareScanReports, DEFAULT_RISK_THRESHOLD } from './scanner/index.js';
 // Sanitization
 export { sanitizeHtml, sanitizeFileName, sanitizePath, sanitizeUrl, sanitizeText, 
 // SMI-1062: Stripe ID validators

package/dist/src/security/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iBAAiB;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AAUpD,eAAe;AACf,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY;AACZ,iCAAiC;AACjC,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAA;AAE1B,kBAAkB;AAClB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAG5B,eAAe;AACf,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAU9C,sBAAsB;AACtB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAQhC,iCAAiC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGjD,0CAA0C;AAC1C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,iBAAiB;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAA;AASpD,4EAA4E;AAC5E,2EAA2E;AAC3E,8DAA8D;AAC9D,OAAO,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAA;AAG/E,eAAe;AACf,OAAO,EACL,YAAY,EACZ,gBAAgB,EAChB,YAAY,EACZ,WAAW,EACX,YAAY;AACZ,iCAAiC;AACjC,eAAe,EACf,wBAAwB,EACxB,4BAA4B,EAC5B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,GACtB,MAAM,mBAAmB,CAAA;AAE1B,kBAAkB;AAClB,OAAO,EACL,cAAc,EACd,qBAAqB,EACrB,UAAU,EACV,oBAAoB,GACrB,MAAM,qBAAqB,CAAA;AAG5B,eAAe;AACf,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAU9C,sBAAsB;AACtB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,kBAAkB,EAClB,2BAA2B,EAC3B,0BAA0B,EAC1B,uBAAuB,GACxB,MAAM,yBAAyB,CAAA;AAQhC,iCAAiC;AACjC,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAGjD,0CAA0C;AAC1C,OAAO,EAAE,YAAY,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/src/security/scanner/SecurityScanner.compound.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Security Scanner — compound chmod+fetch signal detector
+ * @module @skillsmith/core/security/scanner/SecurityScanner.compound
+ *
+ * SMI-5434: Section 2 of SecurityScanner.scanners.ts extracted so that the
+ * upcoming SMI-5433 regex widening (~40 lines) can land without breaching the
+ * 500-line audit:standards gate. Pure functions of (content, alreadyFlaggedLines,
+ * lineContexts) — no scanner instance state.
+ */
+import type { SecurityFinding } from './types.js';
+import type { LineContext } from './SecurityScanner.helpers.js';
+export declare function scanChmodFetchCompound(content: string, alreadyFlaggedLines: ReadonlySet<number>, lineContexts?: LineContext[]): SecurityFinding[];
+//# sourceMappingURL=SecurityScanner.compound.d.ts.map

package/dist/src/security/scanner/SecurityScanner.compound.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.compound.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.compound.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAiE/D,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,MAAM,EACf,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,EACxC,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAyDnB"}