@skillsmith/mcp-server 0.4.13 → 0.5.0

package/dist/src/audit/run-inventory-audit.d.ts

@@ -0,0 +1,95 @@
+/**
+ * @fileoverview Shared `runInventoryAudit` composition helper (SMI-4590 Wave 4 PR 4).
+ * @module @skillsmith/mcp-server/audit/run-inventory-audit
+ *
+ * Composes Wave 1 (scan + detect + history) + Wave 2 (rename suggestions)
+ * + Wave 3 (recommended edits) + Wave 4 PR 3 (exclusions filter) into a
+ * single entry-point used by both the `skill_inventory_audit` MCP tool
+ * (this PR) and the `sklx audit collisions` CLI command (PR 5).
+ *
+ * Plan: docs/internal/implementation/smi-4590-cli-mcp-framework-adapter.md §1.
+ *
+ * Pipeline:
+ *   1. `scanLocalInventory` (Wave 1)             — scan the inventory.
+ *   2. `detectCollisions`     (Wave 1)           — three-pass detector.
+ *   3. Build `RenameSuggestion[]` (Wave 2 types) — one per exact collision,
+ *      using `generateSuggestionChain` to pick a non-colliding name and
+ *      mtime-descending tiebreak to pick which entry to rename.
+ *   4. `runEditSuggester`     (Wave 3)           — recommended prose edits.
+ *   5. Apply `~/.skillsmith/audit-exclusions.json` filter (Wave 4 PR 3)
+ *      when `applyExclusions !== false`.
+ *   6. `writeAuditHistory`    (Wave 1)           — persist `result.json`.
+ *   7. `writeAuditSuggestions` (this PR)          — persist `suggestions.json`
+ *      (so PR 4's apply-tools can look up rename + edit by collisionId).
+ *   8. Build + return the response shape.
+ *
+ * Tier defaults to `'community'` (cheapest fail-safe). Callers (the MCP
+ * tool, the CLI) pass through their resolved tier; the session-start
+ * audit hook (PR 6) passes the user's resolved tier from license info.
+ */
+import type { Tier } from '@skillsmith/core/config/audit-mode';
+import type { InventoryEntry } from '../utils/local-inventory.types.js';
+import type { ExactCollisionFlag, GenericTokenFlag, SemanticCollisionFlag } from './collision-detector.types.js';
+import type { RecommendedEdit } from './edit-suggester.types.js';
+import type { RenameSuggestion } from './rename-engine.types.js';
+/**
+ * Input for {@link runInventoryAudit}. All fields optional — the MCP tool
+ * input schema rejects unknowns and home-dir traversal at the boundary.
+ */
+export interface RunInventoryAuditOptions {
+    /** Gate the semantic-overlap pass (Wave 1). Defaults to `false`. */
+    deep?: boolean;
+    /** Override `os.homedir()`. Caller (MCP tool) Zod-validates the path. */
+    homeDir?: string;
+    /** Optional project CLAUDE.md to scan in addition to the user one. */
+    projectDir?: string;
+    /**
+     * Filter collision flags whose entries match
+     * `~/.skillsmith/audit-exclusions.json`. Defaults to `true`. Enterprise
+     * scheduled-scan runner (PR 6) passes `false` so the governance pass
+     * sees un-filtered findings for policy enforcement.
+     */
+    applyExclusions?: boolean;
+    /**
+     * Subscription tier of the caller — gates the semantic pass per the
+     * audit-mode resolver. Defaults to `'community'` (preventative mode →
+     * exact + generic only). The MCP tool resolves the caller tier from
+     * license info before invoking; the CLI command passes through the same.
+     */
+    tier?: Tier;
+}
+/** Response shape returned to MCP / CLI callers. */
+export interface RunInventoryAuditResult {
+    auditId: string;
+    inventory: InventoryEntry[];
+    exactCollisions: ExactCollisionFlag[];
+    /**
+     * Wave 1's `genericFlags` (typed `GenericTokenFlag[]`). Plan §99–108
+     * referenced this field as `TriggerQualityEntry[]`; the canonical Wave 1
+     * type is `GenericTokenFlag`. Field name preserved per spec.
+     */
+    genericFlags: GenericTokenFlag[];
+    semanticCollisions: SemanticCollisionFlag[];
+    renameSuggestions: RenameSuggestion[];
+    recommendedEdits: RecommendedEdit[];
+    /** Absolute path to the rendered `report.md` for this audit. */
+    reportPath: string;
+    summary: {
+        totalEntries: number;
+        totalFlags: number;
+        errorCount: number;
+        warningCount: number;
+        durationMs: number;
+    };
+}
+/**
+ * Run the full inventory audit pipeline. Single entrypoint shared by the
+ * MCP `skill_inventory_audit` tool and the CLI `sklx audit collisions`
+ * command.
+ *
+ * Stateless — every call generates a fresh `auditId` (via the detector's
+ * default ULID generator) and writes the corresponding history +
+ * suggestions files to `~/.skillsmith/audits/<auditId>/`.
+ */
+export declare function runInventoryAudit(opts?: RunInventoryAuditOptions): Promise<RunInventoryAuditResult>;
+//# sourceMappingURL=run-inventory-audit.d.ts.map

package/dist/src/audit/run-inventory-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-inventory-audit.d.ts","sourceRoot":"","sources":["../../../src/audit/run-inventory-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAUH,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oCAAoC,CAAA;AAG9D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAEvE,OAAO,KAAK,EACV,kBAAkB,EAClB,gBAAgB,EAEhB,qBAAqB,EACtB,MAAM,+BAA+B,CAAA;AAKtC,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAA;AAEhE,OAAO,KAAK,EAAgB,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAG9E;;;GAGG;AACH,MAAM,WAAW,wBAAwB;IACvC,oEAAoE;IACpE,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,yEAAyE;IACzE,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;;OAKG;IACH,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB;;;;;OAKG;IACH,IAAI,CAAC,EAAE,IAAI,CAAA;CACZ;AAED,oDAAoD;AACpD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,cAAc,EAAE,CAAA;IAC3B,eAAe,EAAE,kBAAkB,EAAE,CAAA;IACrC;;;;OAIG;IACH,YAAY,EAAE,gBAAgB,EAAE,CAAA;IAChC,kBAAkB,EAAE,qBAAqB,EAAE,CAAA;IAC3C,iBAAiB,EAAE,gBAAgB,EAAE,CAAA;IACrC,gBAAgB,EAAE,eAAe,EAAE,CAAA;IACnC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;IAClB,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,UAAU,EAAE,MAAM,CAAA;QAClB,YAAY,EAAE,MAAM,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;KACnB,CAAA;CACF;AAED;;;;;;;;GAQG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,GAAE,wBAA6B,GAClC,OAAO,CAAC,uBAAuB,CAAC,CAgFlC"}

package/dist/src/audit/run-inventory-audit.js

@@ -0,0 +1,245 @@
+/**
+ * @fileoverview Shared `runInventoryAudit` composition helper (SMI-4590 Wave 4 PR 4).
+ * @module @skillsmith/mcp-server/audit/run-inventory-audit
+ *
+ * Composes Wave 1 (scan + detect + history) + Wave 2 (rename suggestions)
+ * + Wave 3 (recommended edits) + Wave 4 PR 3 (exclusions filter) into a
+ * single entry-point used by both the `skill_inventory_audit` MCP tool
+ * (this PR) and the `sklx audit collisions` CLI command (PR 5).
+ *
+ * Plan: docs/internal/implementation/smi-4590-cli-mcp-framework-adapter.md §1.
+ *
+ * Pipeline:
+ *   1. `scanLocalInventory` (Wave 1)             — scan the inventory.
+ *   2. `detectCollisions`     (Wave 1)           — three-pass detector.
+ *   3. Build `RenameSuggestion[]` (Wave 2 types) — one per exact collision,
+ *      using `generateSuggestionChain` to pick a non-colliding name and
+ *      mtime-descending tiebreak to pick which entry to rename.
+ *   4. `runEditSuggester`     (Wave 3)           — recommended prose edits.
+ *   5. Apply `~/.skillsmith/audit-exclusions.json` filter (Wave 4 PR 3)
+ *      when `applyExclusions !== false`.
+ *   6. `writeAuditHistory`    (Wave 1)           — persist `result.json`.
+ *   7. `writeAuditSuggestions` (this PR)          — persist `suggestions.json`
+ *      (so PR 4's apply-tools can look up rename + edit by collisionId).
+ *   8. Build + return the response shape.
+ *
+ * Tier defaults to `'community'` (cheapest fail-safe). Callers (the MCP
+ * tool, the CLI) pass through their resolved tier; the session-start
+ * audit hook (PR 6) passes the user's resolved tier from license info.
+ */
+import * as os from 'node:os';
+import { loadExclusions, isExcluded as isExcludedCore, } from '@skillsmith/core/audit';
+import { scanLocalInventory } from '../utils/local-inventory.js';
+import { detectCollisions } from './collision-detector.js';
+import { writeAuditHistory } from './audit-history.js';
+import { writeAuditReport } from './audit-report-writer.js';
+import { writeAuditSuggestions } from './audit-suggestions.js';
+import { runEditSuggester } from './edit-suggester.js';
+import { generateSuggestionChain } from './suggestion-chain.js';
+import { FIELD_LIMITS } from '../tools/validate.types.js';
+/**
+ * Run the full inventory audit pipeline. Single entrypoint shared by the
+ * MCP `skill_inventory_audit` tool and the CLI `sklx audit collisions`
+ * command.
+ *
+ * Stateless — every call generates a fresh `auditId` (via the detector's
+ * default ULID generator) and writes the corresponding history +
+ * suggestions files to `~/.skillsmith/audits/<auditId>/`.
+ */
+export async function runInventoryAudit(opts = {}) {
+    const startedAt = process.hrtime.bigint();
+    // Step 1: scan the local inventory.
+    const homeDir = opts.homeDir ?? os.homedir();
+    const scan = await scanLocalInventory({
+        homeDir,
+        ...(opts.projectDir !== undefined ? { projectDir: opts.projectDir } : {}),
+    });
+    // Step 2: run the three-pass detector. Tier resolves the audit-mode
+    // (preventative → exact + generic; power_user / governance → +semantic).
+    // `deep: true` opts into the semantic pass via the `auditModeOverride`
+    // path so callers don't need to know about tier semantics.
+    const tier = opts.tier ?? 'community';
+    const detectorOpts = { tier };
+    if (opts.deep) {
+        detectorOpts.auditModeOverride = 'power_user';
+    }
+    const detectorResult = await detectCollisions(scan.entries, detectorOpts);
+    // Step 3: build rename suggestions for each exact collision.
+    const renameSuggestions = buildRenameSuggestions(detectorResult, scan.entries);
+    // Step 4: run the edit suggester (Wave 3 — semantic-collision path).
+    // Returns an empty array when `semanticCollisions.length === 0`.
+    const recommendedEdits = await runEditSuggester(detectorResult);
+    // Step 5: apply exclusions filter when requested. Defaults to `true`;
+    // Enterprise scheduled-scan (PR 6) passes `false`.
+    const applyExclusions = opts.applyExclusions !== false;
+    let filtered = detectorResult;
+    let filteredRenames = renameSuggestions;
+    let filteredEdits = recommendedEdits;
+    if (applyExclusions) {
+        const exclusions = await loadExclusions();
+        filtered = applyExclusionsFilter(detectorResult, exclusions);
+        filteredRenames = renameSuggestions.filter((s) => filtered.exactCollisions.some((f) => f.collisionId === s.collisionId));
+        const keptCollisionIds = new Set([
+            ...filtered.exactCollisions.map((f) => f.collisionId),
+            ...filtered.genericFlags.map((f) => f.collisionId),
+            ...filtered.semanticCollisions.map((f) => f.collisionId),
+        ]);
+        filteredEdits = recommendedEdits.filter((e) => keptCollisionIds.has(e.collisionId));
+    }
+    // Step 6: persist `result.json` + `report.md`. The history writer
+    // creates the per-audit directory; the report writer reuses it.
+    const history = await writeAuditHistory(filtered);
+    await writeAuditReport(filtered, {
+        auditDir: history.reportPath.replace(/\/report\.md$/, ''),
+        renameSuggestions: filteredRenames,
+        recommendedEdits: filteredEdits,
+    });
+    // Step 7: persist `suggestions.json` (this PR — for the apply-tools).
+    await writeAuditSuggestions(filtered.auditId, filteredRenames, filteredEdits);
+    const durationMs = Number(process.hrtime.bigint() - startedAt) / 1_000_000;
+    // Step 8: build the response.
+    return {
+        auditId: filtered.auditId,
+        inventory: filtered.inventory,
+        exactCollisions: filtered.exactCollisions,
+        genericFlags: filtered.genericFlags,
+        semanticCollisions: filtered.semanticCollisions,
+        renameSuggestions: filteredRenames,
+        recommendedEdits: filteredEdits,
+        reportPath: history.reportPath,
+        summary: {
+            totalEntries: filtered.summary.totalEntries,
+            totalFlags: filtered.summary.totalFlags,
+            errorCount: filtered.summary.errorCount,
+            warningCount: filtered.summary.warningCount,
+            durationMs,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+/**
+ * Build a `RenameSuggestion[]` from each `ExactCollisionFlag`. We pick the
+ * **most-recently-installed** entry (mtime descending) as the rename
+ * target — matches plan §259 default-entry tiebreak. Falls back to the
+ * first entry when mtime is missing.
+ *
+ * Author / packDomain are left null for v1 — chain falls through to the
+ * `local-` prefix path (`local-foo`, `local-foo-<shortHash>`). Wave 4 PR 5
+ * extends this with manifest lookups for richer prefixes.
+ */
+function buildRenameSuggestions(result, fullInventory) {
+    const suggestions = [];
+    for (const flag of result.exactCollisions) {
+        if (flag.entries.length === 0)
+            continue;
+        // mtime-descending tiebreak; missing mtime sinks to the bottom.
+        const sorted = [...flag.entries].sort((a, b) => (b.mtime ?? 0) - (a.mtime ?? 0));
+        const target = sorted[0];
+        const action = inventoryKindToRenameAction(target);
+        if (action === null)
+            continue; // claude_md_rule entries can't be renamed.
+        // SMI-4737: defensive cap on filesystem-derived identifier. Filesystem
+        // entries with > 128-char names produce no rename suggestion; the
+        // collision is still surfaced via `result.exactCollisions`.
+        const rawToken = stripLeadingSlash(target.identifier);
+        if (rawToken.length > FIELD_LIMITS.token) {
+            continue;
+        }
+        const chain = generateSuggestionChain({
+            token: rawToken,
+            author: target.meta?.author ?? null,
+            packDomain: null,
+            tagFallback: target.meta?.tags?.[0] ?? null,
+            authorPath: target.source_path,
+            existingInventory: fullInventory,
+        });
+        const lowercaseInventory = new Set(fullInventory.map((e) => e.identifier.toLowerCase()));
+        const firstFree = chain.candidates.find((c) => !lowercaseInventory.has(c.toLowerCase()));
+        const suggested = firstFree ?? chain.candidates[0] ?? target.identifier;
+        suggestions.push({
+            collisionId: flag.collisionId,
+            entry: target,
+            currentName: target.identifier,
+            suggested,
+            applyAction: action,
+            reason: flag.reason,
+        });
+    }
+    return suggestions;
+}
+function stripLeadingSlash(identifier) {
+    return identifier.startsWith('/') ? identifier.slice(1) : identifier;
+}
+/** Map an `InventoryEntry.kind` to a `RenameAction`, or `null` for unrenamable kinds. */
+function inventoryKindToRenameAction(entry) {
+    switch (entry.kind) {
+        case 'command':
+            return 'rename_command_file';
+        case 'agent':
+            return 'rename_agent_file';
+        case 'skill':
+            return 'rename_skill_dir_and_frontmatter';
+        case 'claude_md_rule':
+            return null;
+        default:
+            return null;
+    }
+}
+/**
+ * Drop a collision flag iff ANY involved entry matches an exclusion. The
+ * intent of an exclusion is "I deliberately keep this entry around" —
+ * once the user marks one side acceptable, the rename suggestion against
+ * that pair is moot.
+ *
+ * Inventory itself is NOT filtered — exclusions suppress findings, not
+ * inventory entries. The audit report still lists every entry under
+ * "Inventory" so the user has full context for their exclusion choices.
+ */
+function applyExclusionsFilter(result, config) {
+    if (config.exclusions.length === 0)
+        return result;
+    const exactCollisions = result.exactCollisions.filter((flag) => !flag.entries.some((entry) => isExcludedInventoryEntry(entry, config)));
+    const genericFlags = result.genericFlags.filter((flag) => !isExcludedInventoryEntry(flag.entry, config));
+    const semanticCollisions = result.semanticCollisions.filter((flag) => !isExcludedInventoryEntry(flag.entryA, config) &&
+        !isExcludedInventoryEntry(flag.entryB, config));
+    const errorCount = exactCollisions.length;
+    const warningCount = genericFlags.length + semanticCollisions.length;
+    return {
+        ...result,
+        exactCollisions,
+        genericFlags,
+        semanticCollisions,
+        summary: {
+            ...result.summary,
+            totalFlags: errorCount + warningCount,
+            errorCount,
+            warningCount,
+        },
+    };
+}
+/** Translate a Wave 1 `InventoryEntry` to the core `ExcludableEntry` shape. */
+function isExcludedInventoryEntry(entry, config) {
+    if (entry.kind === 'command') {
+        const candidate = {
+            kind: 'command',
+            commandIdentifier: entry.identifier.startsWith('/')
+                ? entry.identifier
+                : `/${entry.identifier}`,
+        };
+        return isExcludedCore(candidate, config);
+    }
+    if (entry.kind === 'skill') {
+        const author = entry.meta?.author;
+        // Skill exclusions are keyed by `<author>/<identifier>`. Without an
+        // author, fall back to bare identifier so a manually-edited
+        // exclusions file can still target unmanaged skills.
+        const skillId = author ? `${author}/${entry.identifier}` : entry.identifier;
+        const candidate = { kind: 'skill', skillId };
+        return isExcludedCore(candidate, config);
+    }
+    // agents + claude_md_rule have no v1 exclusion shape — never excluded.
+    return false;
+}
+//# sourceMappingURL=run-inventory-audit.js.map

package/dist/src/audit/run-inventory-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-inventory-audit.js","sourceRoot":"","sources":["../../../src/audit/run-inventory-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAE7B,OAAO,EAGL,cAAc,EACd,UAAU,IAAI,cAAc,GAC7B,MAAM,wBAAwB,CAAA;AAG/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAEhE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAO1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAA;AAE/D,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AAsDzD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAiC,EAAE;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAEzC,oCAAoC;IACpC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAA;IAC5C,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC;QACpC,OAAO;QACP,GAAG,CAAC,IAAI,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1E,CAAC,CAAA;IAEF,oEAAoE;IACpE,yEAAyE;IACzE,uEAAuE;IACvE,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAA;IACrC,MAAM,YAAY,GAA2C,EAAE,IAAI,EAAE,CAAA;IACrE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,YAAY,CAAC,iBAAiB,GAAG,YAAY,CAAA;IAC/C,CAAC;IACD,MAAM,cAAc,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IAEzE,6DAA6D;IAC7D,MAAM,iBAAiB,GAAG,sBAAsB,CAAC,cAAc,EAAE,IAAI,CAAC,OAAO,CAAC,CAAA;IAE9E,qEAAqE;IACrE,iEAAiE;IACjE,MAAM,gBAAgB,GAAG,MAAM,gBAAgB,CAAC,cAAc,CAAC,CAAA;IAE/D,sEAAsE;IACtE,mDAAmD;IACnD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,KAAK,KAAK,CAAA;IACtD,IAAI,QAAQ,GAAG,cAAc,CAAA;IAC7B,IAAI,eAAe,GAAG,iBAAiB,CAAA;IACvC,IAAI,aAAa,GAAG,gBAAgB,CAAA;IACpC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAA;QACzC,QAAQ,GAAG,qBAAqB,CAAC,cAAc,EAAE,UAAU,CAAC,CAAA;QAC5D,eAAe,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC/C,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,WAAW,CAAC,CACtE,CAAA;QACD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;YAC/B,GAAG,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;YACrD,GAAG,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;YAClD,GAAG,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;SACzD,CAAC,CAAA;QACF,aAAa,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAA;IACrF,CAAC;IAED,kEAAkE;IAClE,gEAAgE;IAChE,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACjD,MAAM,gBAAgB,CAAC,QAAQ,EAAE;QAC/B,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC;QACzD,iBAAiB,EAAE,eAAe;QAClC,gBAAgB,EAAE,aAAa;KAChC,CAAC,CAAA;IAEF,sEAAsE;IACtE,MAAM,qBAAqB,CAAC,QAAQ,CAAC,OAAO,EAAE,eAAe,EAAE,aAAa,CAAC,CAAA;IAE7E,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,SAAS,CAAA;IAE1E,8BAA8B;IAC9B,OAAO;QACL,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,eAAe,EAAE,QAAQ,CAAC,eAAe;QACzC,YAAY,EAAE,QAAQ,CAAC,YAAY;QACnC,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB;QAC/C,iBAAiB,EAAE,eAAe;QAClC,gBAAgB,EAAE,aAAa;QAC/B,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,OAAO,EAAE;YACP,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY;YAC3C,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;YACvC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU;YACvC,YAAY,EAAE,QAAQ,CAAC,OAAO,CAAC,YAAY;YAC3C,UAAU;SACX;KACF,CAAA;AACH,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,SAAS,sBAAsB,CAC7B,MAA4B,EAC5B,aAA4C;IAE5C,MAAM,WAAW,GAAuB,EAAE,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,SAAQ;QAEvC,gEAAgE;QAChE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAA;QAChF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;QACzB,MAAM,MAAM,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAA;QAClD,IAAI,MAAM,KAAK,IAAI;YAAE,SAAQ,CAAC,2CAA2C;QAEzE,uEAAuE;QACvE,kEAAkE;QAClE,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;QACrD,IAAI,QAAQ,CAAC,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC;YACzC,SAAQ;QACV,CAAC;QACD,MAAM,KAAK,GAAG,uBAAuB,CAAC;YACpC,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,IAAI,IAAI;YACnC,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI;YAC3C,UAAU,EAAE,MAAM,CAAC,WAAW;YAC9B,iBAAiB,EAAE,aAAa;SACjC,CAAC,CAAA;QACF,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACxF,MAAM,SAAS,GAAG,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAA;QACxF,MAAM,SAAS,GAAG,SAAS,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,UAAU,CAAA;QAEvE,WAAW,CAAC,IAAI,CAAC;YACf,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,MAAM,CAAC,UAAU;YAC9B,SAAS;YACT,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,IAAI,CAAC,MAAM;SACpB,CAAC,CAAA;IACJ,CAAC;IACD,OAAO,WAAW,CAAA;AACpB,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAA;AACtE,CAAC;AAED,yFAAyF;AACzF,SAAS,2BAA2B,CAAC,KAAqB;IACxD,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACZ,OAAO,qBAAqB,CAAA;QAC9B,KAAK,OAAO;YACV,OAAO,mBAAmB,CAAA;QAC5B,KAAK,OAAO;YACV,OAAO,kCAAkC,CAAA;QAC3C,KAAK,gBAAgB;YACnB,OAAO,IAAI,CAAA;QACb;YACE,OAAO,IAAI,CAAA;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB,CAC5B,MAA4B,EAC5B,MAAwB;IAExB,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAA;IAEjD,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,CACnD,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CACjF,CAAA;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAC7C,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CACxD,CAAA;IACD,MAAM,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC,MAAM,CACzD,CAAC,IAAI,EAAE,EAAE,CACP,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;QAC9C,CAAC,wBAAwB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CACjD,CAAA;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAA;IACzC,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAA;IACpE,OAAO;QACL,GAAG,MAAM;QACT,eAAe;QACf,YAAY;QACZ,kBAAkB;QAClB,OAAO,EAAE;YACP,GAAG,MAAM,CAAC,OAAO;YACjB,UAAU,EAAE,UAAU,GAAG,YAAY;YACrC,UAAU;YACV,YAAY;SACb;KACF,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,SAAS,wBAAwB,CAAC,KAAqB,EAAE,MAAwB;IAC/E,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAoB;YACjC,IAAI,EAAE,SAAS;YACf,iBAAiB,EAAE,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;gBACjD,CAAC,CAAC,KAAK,CAAC,UAAU;gBAClB,CAAC,CAAC,IAAI,KAAK,CAAC,UAAU,EAAE;SAC3B,CAAA;QACD,OAAO,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,CAAA;QACjC,oEAAoE;QACpE,4DAA4D;QAC5D,qDAAqD;QACrD,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAA;QAC3E,MAAM,SAAS,GAAoB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;QAC7D,OAAO,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IAC1C,CAAC;IACD,uEAAuE;IACvE,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/src/audit/suggestion-chain.d.ts

@@ -0,0 +1,89 @@
+/**
+ * @fileoverview 3-tier rename fall-through chain (SMI-4588 Wave 2 Step 2, PR #2).
+ * @module @skillsmith/mcp-server/audit/suggestion-chain
+ *
+ * Generates up to 3 ordered rename candidates per decision #11:
+ *
+ *   1. `${author}-${token}`                            (e.g. `anthropic-ship`)
+ *   2. `${author}-${packDomain}-${token}`              (e.g. `anthropic-codehelper-ship`)
+ *   3. `${author}-${packDomain}-${token}-${shortHash}` (e.g. `anthropic-codehelper-ship-a4f9`)
+ *
+ * Each candidate is checked against the supplied `existingInventory` — when
+ * a candidate collides with another entry's identifier (case-insensitive),
+ * the chain advances to the next tier. If all 3 collide, `exhausted: true`
+ * and the caller surfaces the chain to the user via `customName`.
+ *
+ * Inventory contract (plan §1 Edit 7): `existingInventory` is the
+ * snapshot **before** the candidate skill is appended. Otherwise the
+ * candidate self-collides at tier 1 and cascades unnecessarily. The install
+ * pre-flight maintains two inventory views — `existingInventory` for
+ * suggestion generation, `augmentedInventory` for `detectCollisions`.
+ *
+ * `shortHash` derivation: first 4 hex chars of
+ *   sha256(`${authorPath}/${token}/${packDomain}`)
+ *
+ * Birthday-bound collision-free for inventories <10k entries (Wave 0 spike
+ * §4 — measured 0% on 36-skill fixture, theoretical bound holds).
+ *
+ * Plan: docs/internal/implementation/smi-4588-rename-engine-ledger-install.md §1.
+ */
+import type { InventoryEntry } from './collision-detector.types.js';
+import type { SuggestionChain } from './rename-engine.types.js';
+/**
+ * Compute the deterministic 4-char `shortHash` suffix used at chain tier 3.
+ * Exported for tests; in normal flow callers use `generateSuggestionChain`.
+ */
+export declare function computeShortHash(authorPath: string, token: string, packDomain: string | null): string;
+/**
+ * Sanitize an author / tag / token segment for safe use in an identifier.
+ * Lowercases, replaces non-`[a-z0-9]` runs with `-`, trims, and dedupes
+ * consecutive separators. Mirrors the rule in plan §1 step 1.
+ */
+export declare function sanitizeSegment(raw: string): string;
+export interface GenerateSuggestionChainInput {
+    /**
+     * The colliding entry's base token (e.g. `ship` for `/ship`,
+     * `code-helper` for a skill named `code-helper`). Already stripped of
+     * any leading `/` for commands; the chain produces a token-only result
+     * — formatting back to `/foo` is the apply-path's job.
+     */
+    token: string;
+    /**
+     * Author segment from manifest. Sanitized inside; pass raw. When
+     * `null`/`''`, tier 1 falls through to using the supplied `tagFallback`.
+     */
+    author: string | null;
+    /**
+     * Pack-domain segment (e.g. `codehelper`). Sanitized inside. When
+     * `null`, tier 2 is skipped and tier 3 omits the pack-domain segment.
+     */
+    packDomain: string | null;
+    /**
+     * Tag fallback when `author` is unavailable. Already-sanitized values
+     * are accepted; the function re-sanitizes idempotently.
+     */
+    tagFallback?: string | null;
+    /**
+     * Repo-relative path used to derive `shortHash` at tier 3. Plan §1 calls
+     * for the entry's `source_path` resolved repo-relative; the caller is
+     * responsible for the resolution since the rename engine has no concept
+     * of "repo root".
+     */
+    authorPath: string;
+    /**
+     * Pre-candidate inventory snapshot (Edit 7). MUST NOT contain the
+     * candidate skill — the chain generator self-collides at tier 1
+     * otherwise.
+     */
+    existingInventory: ReadonlyArray<InventoryEntry>;
+}
+/**
+ * Walk the 3-tier rename fall-through chain (decision #11). Returns up to
+ * 3 ordered candidates and an `exhausted` flag. The caller picks the first
+ * non-colliding candidate as the recommended rename.
+ *
+ * Returns an empty `candidates` array iff `token` itself sanitizes to an
+ * empty string (defensive — pathological inputs).
+ */
+export declare function generateSuggestionChain(input: GenerateSuggestionChainInput): SuggestionChain;
+//# sourceMappingURL=suggestion-chain.d.ts.map

package/dist/src/audit/suggestion-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggestion-chain.d.ts","sourceRoot":"","sources":["../../../src/audit/suggestion-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAA;AACnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAA;AAI/D;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,MAAM,EACb,UAAU,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,CAGR;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAenD;AAiBD,MAAM,WAAW,4BAA4B;IAC3C;;;;;OAKG;IACH,KAAK,EAAE,MAAM,CAAA;IACb;;;OAGG;IACH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB;;;OAGG;IACH,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,iBAAiB,EAAE,aAAa,CAAC,cAAc,CAAC,CAAA;CACjD;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,4BAA4B,GAAG,eAAe,CA+C5F"}

package/dist/src/audit/suggestion-chain.js

@@ -0,0 +1,121 @@
+/**
+ * @fileoverview 3-tier rename fall-through chain (SMI-4588 Wave 2 Step 2, PR #2).
+ * @module @skillsmith/mcp-server/audit/suggestion-chain
+ *
+ * Generates up to 3 ordered rename candidates per decision #11:
+ *
+ *   1. `${author}-${token}`                            (e.g. `anthropic-ship`)
+ *   2. `${author}-${packDomain}-${token}`              (e.g. `anthropic-codehelper-ship`)
+ *   3. `${author}-${packDomain}-${token}-${shortHash}` (e.g. `anthropic-codehelper-ship-a4f9`)
+ *
+ * Each candidate is checked against the supplied `existingInventory` — when
+ * a candidate collides with another entry's identifier (case-insensitive),
+ * the chain advances to the next tier. If all 3 collide, `exhausted: true`
+ * and the caller surfaces the chain to the user via `customName`.
+ *
+ * Inventory contract (plan §1 Edit 7): `existingInventory` is the
+ * snapshot **before** the candidate skill is appended. Otherwise the
+ * candidate self-collides at tier 1 and cascades unnecessarily. The install
+ * pre-flight maintains two inventory views — `existingInventory` for
+ * suggestion generation, `augmentedInventory` for `detectCollisions`.
+ *
+ * `shortHash` derivation: first 4 hex chars of
+ *   sha256(`${authorPath}/${token}/${packDomain}`)
+ *
+ * Birthday-bound collision-free for inventories <10k entries (Wave 0 spike
+ * §4 — measured 0% on 36-skill fixture, theoretical bound holds).
+ *
+ * Plan: docs/internal/implementation/smi-4588-rename-engine-ledger-install.md §1.
+ */
+import * as crypto from 'node:crypto';
+const SANITIZE_MAX_LENGTH = 256;
+/**
+ * Compute the deterministic 4-char `shortHash` suffix used at chain tier 3.
+ * Exported for tests; in normal flow callers use `generateSuggestionChain`.
+ */
+export function computeShortHash(authorPath, token, packDomain) {
+    const input = `${authorPath}/${token}/${packDomain ?? ''}`;
+    return crypto.createHash('sha256').update(input).digest('hex').slice(0, 4);
+}
+/**
+ * Sanitize an author / tag / token segment for safe use in an identifier.
+ * Lowercases, replaces non-`[a-z0-9]` runs with `-`, trims, and dedupes
+ * consecutive separators. Mirrors the rule in plan §1 step 1.
+ */
+export function sanitizeSegment(raw) {
+    // Defense-in-depth length cap (SMI-4733): guards against polynomial
+    // backtracking on the regex chain below when callers pass unbounded
+    // input (e.g. `packDomain` from manifest, `token` from skillId). An
+    // empty segment falls through tier construction in
+    // `generateSuggestionChain` — same fall-through behavior as a
+    // pathologically un-sanitizable input.
+    if (raw.length > SANITIZE_MAX_LENGTH) {
+        return '';
+    }
+    return raw
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .replace(/-{2,}/g, '-');
+}
+/**
+ * `existingInventory` collides with `candidate` when ANY entry has an
+ * identifier that case-insensitively equals `candidate`. The check is
+ * O(n) per candidate; chain depth is capped at 3 so worst case is O(3n).
+ */
+function collides(candidate, inventory) {
+    const needle = candidate.toLowerCase();
+    for (const entry of inventory) {
+        if (entry.identifier.toLowerCase() === needle) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Walk the 3-tier rename fall-through chain (decision #11). Returns up to
+ * 3 ordered candidates and an `exhausted` flag. The caller picks the first
+ * non-colliding candidate as the recommended rename.
+ *
+ * Returns an empty `candidates` array iff `token` itself sanitizes to an
+ * empty string (defensive — pathological inputs).
+ */
+export function generateSuggestionChain(input) {
+    const token = sanitizeSegment(input.token);
+    if (token.length === 0) {
+        return { candidates: [], exhausted: true };
+    }
+    const sanitizedAuthor = input.author ? sanitizeSegment(input.author) : '';
+    const sanitizedTag = input.tagFallback ? sanitizeSegment(input.tagFallback) : '';
+    const prefix = sanitizedAuthor.length > 0 ? sanitizedAuthor : sanitizedTag;
+    // No usable author OR tag fallback → emit a `local-` prefix at tier 1
+    // (matches plan §1's third resolution path). Tiers 2 + 3 also fall back
+    // to `local-` since neither author nor packDomain can be derived.
+    const tierPrefix = prefix.length > 0 ? prefix : 'local';
+    const sanitizedPack = input.packDomain ? sanitizeSegment(input.packDomain) : '';
+    const shortHash = computeShortHash(input.authorPath, token, sanitizedPack || null);
+    // Tier 1: `${prefix}-${token}`
+    const tier1 = `${tierPrefix}-${token}`;
+    // Tier 2: `${prefix}-${packDomain}-${token}` (skipped when packDomain absent)
+    const tier2 = sanitizedPack.length > 0 ? `${tierPrefix}-${sanitizedPack}-${token}` : null;
+    // Tier 3: `${prefix}-${packDomain}-${token}-${shortHash}`
+    // packDomain segment is included only when available.
+    const tier3 = sanitizedPack.length > 0
+        ? `${tierPrefix}-${sanitizedPack}-${token}-${shortHash}`
+        : `${tierPrefix}-${token}-${shortHash}`;
+    // Build the candidate list, dropping any null tier and de-duplicating
+    // (tier 2 and tier 3 are identical when packDomain is absent — the dedup
+    // ensures the agent doesn't see two equal candidates).
+    const rawCandidates = [tier1, tier2, tier3].filter((c) => c !== null);
+    const candidates = [];
+    for (const c of rawCandidates) {
+        if (!candidates.includes(c)) {
+            candidates.push(c);
+        }
+    }
+    // Walk the chain — first non-collider wins; if all collide, the chain is
+    // exhausted and the agent must escalate via `customName`.
+    const exhausted = candidates.every((c) => collides(c, input.existingInventory));
+    return { candidates, exhausted };
+}
+//# sourceMappingURL=suggestion-chain.js.map

package/dist/src/audit/suggestion-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"suggestion-chain.js","sourceRoot":"","sources":["../../../src/audit/suggestion-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AAKrC,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAE/B;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,UAAkB,EAClB,KAAa,EACb,UAAyB;IAEzB,MAAM,KAAK,GAAG,GAAG,UAAU,IAAI,KAAK,IAAI,UAAU,IAAI,EAAE,EAAE,CAAA;IAC1D,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;AAC5E,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,mDAAmD;IACnD,8DAA8D;IAC9D,uCAAuC;IACvC,IAAI,GAAG,CAAC,MAAM,GAAG,mBAAmB,EAAE,CAAC;QACrC,OAAO,EAAE,CAAA;IACX,CAAC;IACD,OAAO,GAAG;SACP,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,SAAiB,EAAE,SAAwC;IAC3E,MAAM,MAAM,GAAG,SAAS,CAAC,WAAW,EAAE,CAAA;IACtC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,MAAM,EAAE,CAAC;YAC9C,OAAO,IAAI,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAwCD;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAmC;IACzE,MAAM,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAA;IAC5C,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACzE,MAAM,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAChF,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,YAAY,CAAA;IAE1E,sEAAsE;IACtE,wEAAwE;IACxE,kEAAkE;IAClE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAA;IAEvD,MAAM,aAAa,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC/E,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,aAAa,IAAI,IAAI,CAAC,CAAA;IAElF,+BAA+B;IAC/B,MAAM,KAAK,GAAG,GAAG,UAAU,IAAI,KAAK,EAAE,CAAA;IAEtC,8EAA8E;IAC9E,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;IAEzF,0DAA0D;IAC1D,sDAAsD;IACtD,MAAM,KAAK,GACT,aAAa,CAAC,MAAM,GAAG,CAAC;QACtB,CAAC,CAAC,GAAG,UAAU,IAAI,aAAa,IAAI,KAAK,IAAI,SAAS,EAAE;QACxD,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,IAAI,SAAS,EAAE,CAAA;IAE3C,sEAAsE;IACtE,yEAAyE;IACzE,uDAAuD;IACvD,MAAM,aAAa,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAA;IAClF,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5B,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAA;IAE/E,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAA;AAClC,CAAC"}

package/dist/src/audit-tool-dispatch.d.ts

@@ -0,0 +1,61 @@
+/**
+ * @fileoverview Audit-tool dispatch for the Skillsmith MCP server
+ * @module @skillsmith/mcp-server/audit-tool-dispatch
+ *
+ * SMI-4590 Wave 4 Step 0b: extracted from `tool-dispatch.ts` to keep the
+ * parent dispatcher under the 500-LOC file-size gate.
+ *
+ * Wave 4 PR 4 (this PR) adds three new tools:
+ *   - `skill_inventory_audit`  — full inventory audit (always registered)
+ *   - `apply_namespace_rename` — apply a Wave 2 rename (always registered)
+ *   - `apply_recommended_edit` — apply a Wave 3 prose edit; **registered
+ *     iff `APPLY_TEMPLATE_REGISTRY.size > 0`** (defense-in-depth — if the
+ *     registry ever empties via rollback, the tool unregisters itself and
+ *     the audit-report writer surfaces edits as `manual_review` only).
+ *
+ * Surface: handles dispatch for all audit-family tools. The parent
+ * `tool-dispatch.ts` delegates by name match against {@link AUDIT_TOOL_NAMES};
+ * this module owns the audit case bodies, license + quota wiring (for the
+ * pre-existing `skill_audit` / `skill_pack_audit` cases), and Zod parse
+ * error envelopes.
+ *
+ * Dispatch responses for the three new tools follow the
+ * `safeParseOrError` pattern (see `validation.ts`) for protocol-level
+ * shape errors, AND embed an application-level `success: false` envelope
+ * inside `content[0].text` for domain-level failures (history not found,
+ * subcall failed). MCP clients introspect both.
+ */
+import type { CallToolResult } from '@modelcontextprotocol/sdk/types.js';
+import type { ToolContext } from './context.js';
+import type { LicenseMiddleware } from './middleware/license.js';
+import type { QuotaMiddleware } from './middleware/quota.js';
+/**
+ * Tool names handled by this dispatcher. The parent `tool-dispatch.ts`
+ * delegates iff the requested tool name is in this set.
+ *
+ * `apply_recommended_edit` is conditionally included based on
+ * `APPLY_TEMPLATE_REGISTRY.size`. When the registry is empty (rollback
+ * scenario), the name is omitted from this set AND
+ * {@link dispatchAuditTool} returns the standard "Unknown audit tool"
+ * error if the dispatcher is somehow reached for that name.
+ */
+export declare const AUDIT_TOOL_NAMES: ReadonlySet<string>;
+/**
+ * Returns true if `name` is an audit-family tool dispatched by this module.
+ * Parent dispatcher uses this to route — keeping the routing predicate
+ * colocated with the case bodies prevents drift.
+ */
+export declare function isAuditToolName(name: string): boolean;
+/**
+ * Dispatch an audit-family tool call. Caller must check {@link isAuditToolName}
+ * before invoking; unrecognized names throw `Error('Unknown audit tool: <name>')`.
+ *
+ * @param name              MCP tool name (must be in {@link AUDIT_TOOL_NAMES}).
+ * @param args              Raw tool arguments from the request.
+ * @param toolContext       Initialized database + repository context.
+ * @param licenseMiddleware License validation middleware instance.
+ * @param quotaMiddleware   Quota enforcement middleware instance.
+ * @returns MCP tool response.
+ */
+export declare function dispatchAuditTool(name: string, args: Record<string, unknown> | undefined, toolContext: ToolContext, licenseMiddleware: LicenseMiddleware, quotaMiddleware: QuotaMiddleware): Promise<CallToolResult>;
+//# sourceMappingURL=audit-tool-dispatch.d.ts.map

package/dist/src/audit-tool-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-tool-dispatch.d.ts","sourceRoot":"","sources":["../../src/audit-tool-dispatch.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAA;AACxE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAQ/C,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAA;AAChE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAE5D;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAA0C,CAAA;AAqB3F;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAErD;AAaD;;;;;;;;;;GAUG;AACH,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EACzC,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,iBAAiB,EACpC,eAAe,EAAE,eAAe,GAC/B,OAAO,CAAC,cAAc,CAAC,CAyCzB"}