@skillsmith/mcp-server 0.4.13 → 0.5.0

package/dist/src/audit/bootstrap-unmanaged.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bootstrap-unmanaged.js","sourceRoot":"","sources":["../../../src/audit/bootstrap-unmanaged.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAGlD,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AA+BlE;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAqB;IACpD,OAAO,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAA;AACtD,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,SAAwC,EACxC,OAAkC,EAAE;IAEpC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,+BAA+B,CAAA;IACvE,MAAM,QAAQ,GAAkB,EAAE,CAAA;IAClC,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,IAAI,SAAS,GAAG,CAAC,CAAA;IAEjB,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC;YAAE,SAAQ;QACtC,SAAS,EAAE,CAAA;QACX,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,KAAK,CAAC,CAAA;YACxB,SAAS,EAAE,CAAA;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAChE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,aAAa,CAAC,gBAAgB;gBACpC,OAAO,EAAE,wBAAwB,KAAK,CAAC,WAAW,KAAK,OAAO,EAAE;gBAChE,OAAO,EAAE;oBACP,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,KAAK,EAAE,OAAO;iBACf;aACF,CAAC,CAAA;YACF,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,kBAAkB,EAAE;gBACvC,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,KAAK,EAAE,OAAO;aACf,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAA;AAC3C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,+BAA+B,CAAC,KAAqB;IAClE,MAAM,OAAO,CAAC,OAAO,CACnB,eAAe,CAAC,KAAK,CAAC,WAAW,EAAE;QACjC,gBAAgB;KACjB,CAAC,CACH,CAAA;AACH,CAAC"}

package/dist/src/audit/collision-detector.d.ts

@@ -0,0 +1,72 @@
+/**
+ * @fileoverview Three-pass collision detector for the consumer namespace
+ *               audit. Wave 1 PR1+PR2 ship the exact + generic passes;
+ *               PR #3 wires the semantic pass (gated by audit_mode) +
+ *               unmanaged-skill bootstrap + audit-mode resolver dispatch.
+ * @module @skillsmith/mcp-server/audit/collision-detector
+ * @see SMI-4587
+ *
+ * The detector is detection-only — file mutation lives in Wave 2's
+ * rename engine. Each pass is independently invocable for testing.
+ *
+ * Audit-mode dispatch (plan §6b):
+ *   - 'off'                        -> short-circuit, empty result, no telemetry
+ *   - 'preventative'               -> exact + generic only (no embedding service)
+ *   - 'power_user' / 'governance'  -> + semantic-overlap pass via OverlapDetector
+ *
+ * Latency invariant (plan §426): in `preventative` mode the
+ * `OverlapDetector` is **not instantiated** and `EmbeddingService` is
+ * **not touched**. Tests assert zero invocations.
+ */
+import { type AuditMode } from '@skillsmith/core/config/audit-mode';
+import type { Tier as AuditModeTier } from '@skillsmith/core/config/audit-mode';
+import type { InventoryEntry, ScanWarning } from '../utils/local-inventory.types.js';
+import type { InventoryAuditResult } from './collision-detector.types.js';
+import { type BootstrapFn } from './bootstrap-unmanaged.js';
+export interface DetectCollisionsOptions {
+    /**
+     * Pre-allocated audit id. Useful when the caller wants the id to flow
+     * into telemetry / report-writer alongside the detector result.
+     * Defaults to a fresh ULID.
+     */
+    auditId?: string;
+    /**
+     * Subscription tier of the caller. Drives the default audit mode via
+     * {@link resolveAuditMode}. When omitted, defaults to `'community'`
+     * (the cheapest fail-safe).
+     */
+    tier?: AuditModeTier;
+    /**
+     * Explicit audit-mode override (read by the caller from
+     * `~/.skillsmith/config.json` `audit_mode` or `SKILLSMITH_AUDIT_MODE`).
+     * When set + valid, this beats the tier default.
+     */
+    auditModeOverride?: AuditMode | null;
+    /**
+     * Bootstrap callback for unmanaged SKILL.md entries (Step 6a). Defaults
+     * to a no-op until PR #4 wires the real `indexLocalSkill` core helper.
+     */
+    bootstrapFn?: BootstrapFn;
+}
+/**
+ * Run the configured collision-detection passes over an inventory
+ * snapshot.
+ *
+ * Returns an `InventoryAuditResult` whose `summary.passDurations` records
+ * the wall-clock cost of each pass. The semantic pass duration is `0`
+ * when the resolved audit-mode short-circuits past it (preventative /
+ * off).
+ */
+export declare function detectCollisions(inventory: ReadonlyArray<InventoryEntry>, opts?: DetectCollisionsOptions): Promise<InventoryAuditResult>;
+/**
+ * Internal hook used by tests + PR #4 report writer. Returns the
+ * bootstrap warnings produced by the most recent `detectCollisions`
+ * call. Returns an empty array when the most recent call short-circuited
+ * (`auditMode === 'off'`) or no unmanaged skills failed to bootstrap.
+ */
+export declare function getLastBootstrapWarnings(): ReadonlyArray<ScanWarning>;
+export type { ExactCollisionFlag, GenericTokenFlag, InventoryAuditResult, SemanticCollisionFlag, } from './collision-detector.types.js';
+export { detectExactCollisions, detectGenericTokenFlags } from './collision-detector.helpers.js';
+export { bootstrapUnmanagedSkills, isUnmanagedSkill } from './bootstrap-unmanaged.js';
+export type { BootstrapFn } from './bootstrap-unmanaged.js';
+//# sourceMappingURL=collision-detector.d.ts.map

package/dist/src/audit/collision-detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collision-detector.d.ts","sourceRoot":"","sources":["../../../src/audit/collision-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,oCAAoC,CAAA;AACrF,OAAO,KAAK,EAAE,IAAI,IAAI,aAAa,EAAE,MAAM,oCAAoC,CAAA;AAE/E,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,mCAAmC,CAAA;AACpF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAA;AAGzE,OAAO,EAA4B,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAA;AAIrF,MAAM,WAAW,uBAAuB;IACtC;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;OAIG;IACH,IAAI,CAAC,EAAE,aAAa,CAAA;IACpB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,SAAS,GAAG,IAAI,CAAA;IACpC;;;OAGG;IACH,WAAW,CAAC,EAAE,WAAW,CAAA;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,EACxC,IAAI,GAAE,uBAA4B,GACjC,OAAO,CAAC,oBAAoB,CAAC,CAyG/B;AAWD;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,aAAa,CAAC,WAAW,CAAC,CAErE;AAqCD,YAAY,EACV,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,+BAA+B,CAAA;AACtC,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAChG,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AACrF,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/src/audit/collision-detector.helpers.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @fileoverview Pure pass functions for the collision detector
+ *               (SMI-4587 Wave 1 Steps 4–5).
+ * @module @skillsmith/mcp-server/audit/collision-detector.helpers
+ *
+ * Each pass is a pure function over `InventoryEntry[]`. The orchestrator
+ * (`collision-detector.ts`) wires them together. Wave 1 PR1 shipped the
+ * exact-name pass; this file now also exposes the generic-token pass
+ * (Step 5). Semantic pass lands in a subsequent PR.
+ */
+import type { InventoryEntry } from '../utils/local-inventory.types.js';
+import type { AuditId, ExactCollisionFlag, GenericTokenFlag } from './collision-detector.types.js';
+/**
+ * Stable pack-name input passed to {@link derivePackDomain} when running
+ * the generic-token pass over the user's local inventory. The user's
+ * `~/.claude/` install has no single pack name — using a non-suffixed
+ * sentinel forces `derivePackDomain` to fall through Strategy 1 (which
+ * keys off `-skills` suffixes) and rely on Strategy 2 (mode of per-entry
+ * tags). Centralized here so plan + tests share the same constant.
+ */
+export declare const LOCAL_INVENTORY_PACK_NAME = "local-inventory";
+/**
+ * Normalize an identifier for case-insensitive equality. Mirrors the
+ * normalization OverlapDetector applies for exact-match comparisons
+ * (`OverlapDetector.ts:180-183`).
+ */
+export declare function normalizeIdentifier(id: string): string;
+/**
+ * Group entries by normalized `identifier`. Returns a Map keyed by the
+ * normalized form so callers can find sets-of-2-or-more in O(n).
+ */
+export declare function groupByIdentifier(entries: ReadonlyArray<InventoryEntry>): Map<string, InventoryEntry[]>;
+/**
+ * Detect exact-name collisions across the inventory.
+ *
+ * A collision is two or more entries that share the same normalized
+ * `identifier` (case-insensitive, trimmed). Severity is always `error`.
+ *
+ * Pure O(n) — single Map pass over the input. Each returned flag carries
+ * a `collisionId` derived via `deriveCollisionId(auditId, entries)` so
+ * Wave 2's ledger can look it up by id.
+ */
+export declare function detectExactCollisions(inventory: ReadonlyArray<InventoryEntry>, auditId: string): ExactCollisionFlag[];
+/**
+ * Detect generic-trigger-word flags across the local inventory.
+ *
+ * Wraps {@link detectGenericTriggerWords} (the existing skill-pack-audit
+ * helper) and adapts the per-skill flag shape to this audit's
+ * {@link GenericTokenFlag}. Severity is always `warning` here — even
+ * skill-name hits, which the pack helper raises as `error`, are demoted
+ * to `warning` because the inventory audit is detection-only and the
+ * user's existing local install is grandfathered in (rename is opt-in
+ * via Wave 2's apply path).
+ *
+ * `packDomain` is computed once over the entire inventory using
+ * {@link derivePackDomain} with a stable sentinel pack name; Strategy 2
+ * (mode-of-tags) is the load-bearing branch since the user's inventory
+ * has no single pack name. The same `packDomain` is then passed into
+ * every per-entry call, so suggestions like `${packDomain}-${token}`
+ * are consistent across the report.
+ */
+export declare function detectGenericTokenFlags(inventory: ReadonlyArray<InventoryEntry>, auditId: AuditId): GenericTokenFlag[];
+//# sourceMappingURL=collision-detector.helpers.d.ts.map

package/dist/src/audit/collision-detector.helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collision-detector.helpers.d.ts","sourceRoot":"","sources":["../../../src/audit/collision-detector.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AACvE,OAAO,KAAK,EAAE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAA;AAIlG;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,oBAAoB,CAAA;AAE1D;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,aAAa,CAAC,cAAc,CAAC,GACrC,GAAG,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC,CAa/B;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,EACxC,OAAO,EAAE,MAAM,GACd,kBAAkB,EAAE,CAoBtB;AAiBD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,uBAAuB,CACrC,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,EACxC,OAAO,EAAE,OAAO,GACf,gBAAgB,EAAE,CAiCpB"}

package/dist/src/audit/collision-detector.helpers.js

@@ -0,0 +1,141 @@
+/**
+ * @fileoverview Pure pass functions for the collision detector
+ *               (SMI-4587 Wave 1 Steps 4–5).
+ * @module @skillsmith/mcp-server/audit/collision-detector.helpers
+ *
+ * Each pass is a pure function over `InventoryEntry[]`. The orchestrator
+ * (`collision-detector.ts`) wires them together. Wave 1 PR1 shipped the
+ * exact-name pass; this file now also exposes the generic-token pass
+ * (Step 5). Semantic pass lands in a subsequent PR.
+ */
+import { GENERIC_TRIGGERS } from '@skillsmith/core';
+import { deriveCollisionId } from './audit-history.js';
+import { derivePackDomain, detectGenericTriggerWords } from '../tools/skill-pack-audit.helpers.js';
+/**
+ * Stable pack-name input passed to {@link derivePackDomain} when running
+ * the generic-token pass over the user's local inventory. The user's
+ * `~/.claude/` install has no single pack name — using a non-suffixed
+ * sentinel forces `derivePackDomain` to fall through Strategy 1 (which
+ * keys off `-skills` suffixes) and rely on Strategy 2 (mode of per-entry
+ * tags). Centralized here so plan + tests share the same constant.
+ */
+export const LOCAL_INVENTORY_PACK_NAME = 'local-inventory';
+/**
+ * Normalize an identifier for case-insensitive equality. Mirrors the
+ * normalization OverlapDetector applies for exact-match comparisons
+ * (`OverlapDetector.ts:180-183`).
+ */
+export function normalizeIdentifier(id) {
+    return id.trim().toLowerCase();
+}
+/**
+ * Group entries by normalized `identifier`. Returns a Map keyed by the
+ * normalized form so callers can find sets-of-2-or-more in O(n).
+ */
+export function groupByIdentifier(entries) {
+    const groups = new Map();
+    for (const entry of entries) {
+        const key = normalizeIdentifier(entry.identifier);
+        if (!key)
+            continue; // empty/whitespace identifier — skip silently
+        const bucket = groups.get(key);
+        if (bucket) {
+            bucket.push(entry);
+        }
+        else {
+            groups.set(key, [entry]);
+        }
+    }
+    return groups;
+}
+/**
+ * Detect exact-name collisions across the inventory.
+ *
+ * A collision is two or more entries that share the same normalized
+ * `identifier` (case-insensitive, trimmed). Severity is always `error`.
+ *
+ * Pure O(n) — single Map pass over the input. Each returned flag carries
+ * a `collisionId` derived via `deriveCollisionId(auditId, entries)` so
+ * Wave 2's ledger can look it up by id.
+ */
+export function detectExactCollisions(inventory, auditId) {
+    const groups = groupByIdentifier(inventory);
+    const flags = [];
+    for (const [, bucket] of groups) {
+        if (bucket.length < 2)
+            continue;
+        const reason = describeCollision(bucket);
+        flags.push({
+            kind: 'exact',
+            collisionId: deriveCollisionId(auditId, bucket),
+            identifier: bucket[0]?.identifier ?? '',
+            entries: bucket,
+            severity: 'error',
+            reason,
+        });
+    }
+    // Stable ordering for downstream consumers (report writer relies on this).
+    flags.sort((a, b) => a.identifier.localeCompare(b.identifier));
+    return flags;
+}
+/**
+ * Build the human-readable `reason` string for an exact collision. The
+ * message lists the colliding kinds + count so the audit report can
+ * render it without re-walking the entries array.
+ */
+function describeCollision(entries) {
+    const kinds = new Set(entries.map((e) => e.kind));
+    if (kinds.size === 1) {
+        const k = entries[0]?.kind ?? 'entry';
+        return `${entries.length} ${k}s share the same identifier "${entries[0]?.identifier ?? ''}"`;
+    }
+    const kindList = [...kinds].sort().join(' / ');
+    return `${entries.length} entries (${kindList}) share the same identifier "${entries[0]?.identifier ?? ''}"`;
+}
+/**
+ * Detect generic-trigger-word flags across the local inventory.
+ *
+ * Wraps {@link detectGenericTriggerWords} (the existing skill-pack-audit
+ * helper) and adapts the per-skill flag shape to this audit's
+ * {@link GenericTokenFlag}. Severity is always `warning` here — even
+ * skill-name hits, which the pack helper raises as `error`, are demoted
+ * to `warning` because the inventory audit is detection-only and the
+ * user's existing local install is grandfathered in (rename is opt-in
+ * via Wave 2's apply path).
+ *
+ * `packDomain` is computed once over the entire inventory using
+ * {@link derivePackDomain} with a stable sentinel pack name; Strategy 2
+ * (mode-of-tags) is the load-bearing branch since the user's inventory
+ * has no single pack name. The same `packDomain` is then passed into
+ * every per-entry call, so suggestions like `${packDomain}-${token}`
+ * are consistent across the report.
+ */
+export function detectGenericTokenFlags(inventory, auditId) {
+    const stoplist = GENERIC_TRIGGERS;
+    const tagBag = inventory.map((e) => ({ tags: e.meta?.tags }));
+    const packDomain = derivePackDomain(LOCAL_INVENTORY_PACK_NAME, tagBag, stoplist);
+    const flags = [];
+    for (const entry of inventory) {
+        const wordFlags = detectGenericTriggerWords(entry.meta?.description, entry.identifier, packDomain, stoplist);
+        for (const wf of wordFlags) {
+            flags.push({
+                kind: 'generic',
+                collisionId: deriveCollisionId(auditId, [entry]),
+                identifier: entry.identifier,
+                entry,
+                matchedTokens: [wf.token],
+                severity: 'warning',
+                reason: wf.reason,
+            });
+        }
+    }
+    // Stable ordering for downstream consumers: identifier asc, then token asc.
+    flags.sort((a, b) => {
+        const byId = a.identifier.localeCompare(b.identifier);
+        if (byId !== 0)
+            return byId;
+        return (a.matchedTokens[0] ?? '').localeCompare(b.matchedTokens[0] ?? '');
+    });
+    return flags;
+}
+//# sourceMappingURL=collision-detector.helpers.js.map

package/dist/src/audit/collision-detector.helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collision-detector.helpers.js","sourceRoot":"","sources":["../../../src/audit/collision-detector.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAInD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,sCAAsC,CAAA;AAElG;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,iBAAiB,CAAA;AAE1D;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,EAAU;IAC5C,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsC;IAEtC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAA;IAClD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,CAAC,GAAG;YAAE,SAAQ,CAAC,8CAA8C;QACjE,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACpB,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CACnC,SAAwC,EACxC,OAAe;IAEf,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAA;IAC3C,MAAM,KAAK,GAAyB,EAAE,CAAA;IAEtC,KAAK,MAAM,CAAC,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QAChC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,SAAQ;QAC/B,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAA;QACxC,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,OAAO;YACb,WAAW,EAAE,iBAAiB,CAAC,OAAO,EAAE,MAAM,CAAC;YAC/C,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE;YACvC,OAAO,EAAE,MAAM;YACf,QAAQ,EAAE,OAAO;YACjB,MAAM;SACP,CAAC,CAAA;IACJ,CAAC;IAED,2EAA2E;IAC3E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;IAC9D,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAsC;IAC/D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;IACjD,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,OAAO,CAAA;QACrC,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,gCAAgC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,GAAG,CAAA;IAC9F,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;IAC9C,OAAO,GAAG,OAAO,CAAC,MAAM,aAAa,QAAQ,gCAAgC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,IAAI,EAAE,GAAG,CAAA;AAC9G,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,SAAwC,EACxC,OAAgB;IAEhB,MAAM,QAAQ,GAAG,gBAAgB,CAAA;IACjC,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC7D,MAAM,UAAU,GAAG,gBAAgB,CAAC,yBAAyB,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAA;IAEhF,MAAM,KAAK,GAAuB,EAAE,CAAA;IACpC,KAAK,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,yBAAyB,CACzC,KAAK,CAAC,IAAI,EAAE,WAAW,EACvB,KAAK,CAAC,UAAU,EAChB,UAAU,EACV,QAAQ,CACT,CAAA;QACD,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,SAAS;gBACf,WAAW,EAAE,iBAAiB,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;gBAChD,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,KAAK;gBACL,aAAa,EAAE,CAAC,EAAE,CAAC,KAAK,CAAC;gBACzB,QAAQ,EAAE,SAAS;gBACnB,MAAM,EAAE,EAAE,CAAC,MAAM;aAClB,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QAClB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAA;QACrD,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAC3B,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;IAC3E,CAAC,CAAC,CAAA;IACF,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/src/audit/collision-detector.js

@@ -0,0 +1,172 @@
+/**
+ * @fileoverview Three-pass collision detector for the consumer namespace
+ *               audit. Wave 1 PR1+PR2 ship the exact + generic passes;
+ *               PR #3 wires the semantic pass (gated by audit_mode) +
+ *               unmanaged-skill bootstrap + audit-mode resolver dispatch.
+ * @module @skillsmith/mcp-server/audit/collision-detector
+ * @see SMI-4587
+ *
+ * The detector is detection-only — file mutation lives in Wave 2's
+ * rename engine. Each pass is independently invocable for testing.
+ *
+ * Audit-mode dispatch (plan §6b):
+ *   - 'off'                        -> short-circuit, empty result, no telemetry
+ *   - 'preventative'               -> exact + generic only (no embedding service)
+ *   - 'power_user' / 'governance'  -> + semantic-overlap pass via OverlapDetector
+ *
+ * Latency invariant (plan §426): in `preventative` mode the
+ * `OverlapDetector` is **not instantiated** and `EmbeddingService` is
+ * **not touched**. Tests assert zero invocations.
+ */
+import { OverlapDetector } from '@skillsmith/core';
+import { resolveAuditMode } from '@skillsmith/core/config/audit-mode';
+import { detectExactCollisions, detectGenericTokenFlags } from './collision-detector.helpers.js';
+import { newAuditId } from './audit-history.js';
+import { bootstrapUnmanagedSkills } from './bootstrap-unmanaged.js';
+import { detectSemanticCollisions } from './collision-detector.semantic.helpers.js';
+import { emitAuditCompleteEvent } from '../tools/namespace-audit/telemetry.js';
+/**
+ * Run the configured collision-detection passes over an inventory
+ * snapshot.
+ *
+ * Returns an `InventoryAuditResult` whose `summary.passDurations` records
+ * the wall-clock cost of each pass. The semantic pass duration is `0`
+ * when the resolved audit-mode short-circuits past it (preventative /
+ * off).
+ */
+export async function detectCollisions(inventory, opts = {}) {
+    const startedAt = process.hrtime.bigint();
+    const auditId = (opts.auditId ?? newAuditId());
+    // Step 6b: resolve the audit mode before any pass runs.
+    const auditMode = resolveAuditMode({
+        tier: opts.tier ?? 'community',
+        override: opts.auditModeOverride ?? null,
+    });
+    // Step 6b: 'off' short-circuits — empty result, zero passes, no
+    // telemetry. The orchestrator returns immediately so callers can
+    // safely no-op.
+    if (auditMode === 'off') {
+        return emptyResult(auditId, inventory);
+    }
+    // Bootstrap warnings flow into the audit result via the report writer
+    // in PR #4 (Step 8). Until then we collect them locally so the surface
+    // is stable; tests assert on the collected list via a helper.
+    const bootstrapWarnings = [];
+    // Step 6a: bootstrap unmanaged skills before the exact pass so any
+    // newly-discovered manifest data shows up as `meta.author` on
+    // subsequent re-scans (handled by the caller — this PR only plumbs).
+    const bootstrap = await bootstrapUnmanagedSkills(inventory, {
+        bootstrapFn: opts.bootstrapFn,
+    });
+    bootstrapWarnings.push(...bootstrap.warnings);
+    // Step 4: exact-name pass.
+    const exactStart = process.hrtime.bigint();
+    const exactCollisions = detectExactCollisions(inventory, auditId);
+    const exactDuration = nsToMs(process.hrtime.bigint() - exactStart);
+    // Step 5: generic-token pass.
+    const genericStart = process.hrtime.bigint();
+    const genericFlags = detectGenericTokenFlags(inventory, auditId);
+    const genericDuration = nsToMs(process.hrtime.bigint() - genericStart);
+    // Step 6: semantic-overlap pass — only when the resolved mode opts in.
+    // Latency invariant: instantiate `OverlapDetector` only when needed
+    // so `EmbeddingService` is never touched in `preventative` mode.
+    let semanticCollisions = [];
+    let semanticDuration = 0;
+    if (needsSemanticPass(auditMode)) {
+        const detector = new OverlapDetector();
+        try {
+            const semanticStart = process.hrtime.bigint();
+            semanticCollisions = await detectSemanticCollisions(inventory, exactCollisions, auditId, detector);
+            semanticDuration = nsToMs(process.hrtime.bigint() - semanticStart);
+        }
+        finally {
+            detector.close();
+        }
+    }
+    const totalDuration = nsToMs(process.hrtime.bigint() - startedAt);
+    const errorCount = exactCollisions.length;
+    const warningCount = genericFlags.length + semanticCollisions.length;
+    // bootstrapWarnings is collected for PR #4's report writer; emitted
+    // through `getLastBootstrapWarnings()` to avoid widening the public
+    // result shape ahead of Step 8.
+    lastBootstrapWarnings = bootstrapWarnings;
+    const result = {
+        auditId,
+        inventory: [...inventory],
+        exactCollisions,
+        genericFlags,
+        semanticCollisions,
+        summary: {
+            totalEntries: inventory.length,
+            totalFlags: errorCount + warningCount,
+            errorCount,
+            warningCount,
+            durationMs: totalDuration,
+            passDurations: {
+                exact: exactDuration,
+                generic: genericDuration,
+                semantic: semanticDuration,
+            },
+        },
+    };
+    // Step 8a: aggregate-only server telemetry (decision #7). Never emits
+    // when audit_mode is 'off' (handled by both the short-circuit above and
+    // a defense-in-depth check inside `emitAuditCompleteEvent`). Wave 1
+    // ships zeroed resolution counters; Wave 2's rename engine wires real
+    // values when the apply path lands.
+    void emitAuditCompleteEvent(result, {
+        tier: opts.tier ?? 'community',
+        audit_mode: auditMode,
+        resolved_auto: 0,
+        resolved_manual: 0,
+        resolved_skipped: 0,
+        user_id: null,
+    });
+    return result;
+}
+/**
+ * Module-private cache of the most recent bootstrap warnings. Tests
+ * (and PR #4's report writer) read this immediately after invoking
+ * `detectCollisions`. Module-scoped is acceptable because the detector
+ * is invoked sequentially per process — there is no concurrency on this
+ * surface in Wave 1.
+ */
+let lastBootstrapWarnings = [];
+/**
+ * Internal hook used by tests + PR #4 report writer. Returns the
+ * bootstrap warnings produced by the most recent `detectCollisions`
+ * call. Returns an empty array when the most recent call short-circuited
+ * (`auditMode === 'off'`) or no unmanaged skills failed to bootstrap.
+ */
+export function getLastBootstrapWarnings() {
+    return lastBootstrapWarnings;
+}
+function needsSemanticPass(mode) {
+    return mode === 'power_user' || mode === 'governance';
+}
+function emptyResult(auditId, inventory) {
+    // 'off' short-circuit also clears any prior bootstrap warnings so
+    // the test-visible state matches the documented "no work" semantics.
+    lastBootstrapWarnings = [];
+    return {
+        auditId,
+        inventory: [...inventory],
+        exactCollisions: [],
+        genericFlags: [],
+        semanticCollisions: [],
+        summary: {
+            totalEntries: 0,
+            totalFlags: 0,
+            errorCount: 0,
+            warningCount: 0,
+            durationMs: 0,
+            passDurations: { exact: 0, generic: 0, semantic: 0 },
+        },
+    };
+}
+function nsToMs(ns) {
+    return Number(ns) / 1_000_000;
+}
+export { detectExactCollisions, detectGenericTokenFlags } from './collision-detector.helpers.js';
+export { bootstrapUnmanagedSkills, isUnmanagedSkill } from './bootstrap-unmanaged.js';
+//# sourceMappingURL=collision-detector.js.map

package/dist/src/audit/collision-detector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"collision-detector.js","sourceRoot":"","sources":["../../../src/audit/collision-detector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAClD,OAAO,EAAE,gBAAgB,EAAkB,MAAM,oCAAoC,CAAA;AAKrF,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAChG,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,wBAAwB,EAAoB,MAAM,0BAA0B,CAAA;AACrF,OAAO,EAAE,wBAAwB,EAAE,MAAM,0CAA0C,CAAA;AACnF,OAAO,EAAE,sBAAsB,EAAE,MAAM,uCAAuC,CAAA;AA4B9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,SAAwC,EACxC,OAAgC,EAAE;IAElC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IACzC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,UAAU,EAAE,CAAoC,CAAA;IAEjF,wDAAwD;IACxD,MAAM,SAAS,GAAG,gBAAgB,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW;QAC9B,QAAQ,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI;KACzC,CAAC,CAAA;IAEF,gEAAgE;IAChE,iEAAiE;IACjE,gBAAgB;IAChB,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,OAAO,WAAW,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxC,CAAC;IAED,sEAAsE;IACtE,uEAAuE;IACvE,8DAA8D;IAC9D,MAAM,iBAAiB,GAAkB,EAAE,CAAA;IAE3C,mEAAmE;IACnE,8DAA8D;IAC9D,qEAAqE;IACrE,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,SAAS,EAAE;QAC1D,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CAAA;IACF,iBAAiB,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IAE7C,2BAA2B;IAC3B,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC1C,MAAM,eAAe,GAAG,qBAAqB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACjE,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,UAAU,CAAC,CAAA;IAElE,8BAA8B;IAC9B,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;IAC5C,MAAM,YAAY,GAAG,uBAAuB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAChE,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,YAAY,CAAC,CAAA;IAEtE,uEAAuE;IACvE,oEAAoE;IACpE,iEAAiE;IACjE,IAAI,kBAAkB,GAA+C,EAAE,CAAA;IACvE,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAA;QACtC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAA;YAC7C,kBAAkB,GAAG,MAAM,wBAAwB,CACjD,SAAS,EACT,eAAe,EACf,OAAO,EACP,QAAQ,CACT,CAAA;YACD,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,aAAa,CAAC,CAAA;QACpE,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,KAAK,EAAE,CAAA;QAClB,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAA;IACjE,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAA;IACzC,MAAM,YAAY,GAAG,YAAY,CAAC,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAA;IAEpE,oEAAoE;IACpE,oEAAoE;IACpE,gCAAgC;IAChC,qBAAqB,GAAG,iBAAiB,CAAA;IAEzC,MAAM,MAAM,GAAyB;QACnC,OAAO;QACP,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;QACzB,eAAe;QACf,YAAY;QACZ,kBAAkB;QAClB,OAAO,EAAE;YACP,YAAY,EAAE,SAAS,CAAC,MAAM;YAC9B,UAAU,EAAE,UAAU,GAAG,YAAY;YACrC,UAAU;YACV,YAAY;YACZ,UAAU,EAAE,aAAa;YACzB,aAAa,EAAE;gBACb,KAAK,EAAE,aAAa;gBACpB,OAAO,EAAE,eAAe;gBACxB,QAAQ,EAAE,gBAAgB;aAC3B;SACF;KACF,CAAA;IAED,sEAAsE;IACtE,wEAAwE;IACxE,oEAAoE;IACpE,sEAAsE;IACtE,oCAAoC;IACpC,KAAK,sBAAsB,CAAC,MAAM,EAAE;QAClC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,WAAW;QAC9B,UAAU,EAAE,SAAS;QACrB,aAAa,EAAE,CAAC;QAChB,eAAe,EAAE,CAAC;QAClB,gBAAgB,EAAE,CAAC;QACnB,OAAO,EAAE,IAAI;KACd,CAAC,CAAA;IAEF,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;GAMG;AACH,IAAI,qBAAqB,GAAkB,EAAE,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,OAAO,qBAAqB,CAAA;AAC9B,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAe;IACxC,OAAO,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,YAAY,CAAA;AACvD,CAAC;AAED,SAAS,WAAW,CAClB,OAAwC,EACxC,SAAwC;IAExC,kEAAkE;IAClE,qEAAqE;IACrE,qBAAqB,GAAG,EAAE,CAAA;IAC1B,OAAO;QACL,OAAO;QACP,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;QACzB,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB,kBAAkB,EAAE,EAAE;QACtB,OAAO,EAAE;YACP,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,CAAC;YACb,UAAU,EAAE,CAAC;YACb,YAAY,EAAE,CAAC;YACf,UAAU,EAAE,CAAC;YACb,aAAa,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE;SACrD;KACF,CAAA;AACH,CAAC;AAED,SAAS,MAAM,CAAC,EAAU;IACxB,OAAO,MAAM,CAAC,EAAE,CAAC,GAAG,SAAS,CAAA;AAC/B,CAAC;AAWD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAA;AAChG,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA"}

package/dist/src/audit/collision-detector.semantic.helpers.d.ts

@@ -0,0 +1,49 @@
+/**
+ * @fileoverview Semantic-overlap pass for SMI-4587 Wave 1 Step 6.
+ * @module @skillsmith/mcp-server/audit/collision-detector.semantic.helpers
+ *
+ * Wraps the existing {@link OverlapDetector} from `@skillsmith/core` and
+ * adapts inventory entries to the `TriggerPhraseSkill` shape it expects.
+ *
+ * Latency invariant: this module is **only imported and exercised** when
+ * the resolved audit-mode is `power_user` or `governance`. In
+ * `preventative` mode the orchestrator skips this path entirely and
+ * therefore never instantiates `EmbeddingService` (the load-bearing
+ * 5 ms p95 invariant for the cheap mode).
+ *
+ * Intentional design: the orchestrator constructs `OverlapDetector` once
+ * per audit run and disposes it via `close()` after this helper returns.
+ * That keeps ONNX model lifetime bounded and avoids two concurrent model
+ * instances on memory-constrained machines (per plan §430).
+ */
+import type { OverlapDetector, TriggerPhraseSkill } from '@skillsmith/core';
+import type { InventoryEntry } from '../utils/local-inventory.types.js';
+import type { AuditId, ExactCollisionFlag, SemanticCollisionFlag } from './collision-detector.types.js';
+/**
+ * Adapt an {@link InventoryEntry} to the `TriggerPhraseSkill` shape that
+ * `OverlapDetector` expects. Uses `source_path` as the stable id so we
+ * can map detector results back to the originating inventory entries
+ * via a Map keyed off `source_path`.
+ *
+ * Empty `triggerSurface[]` -> the entry is filtered out upstream because
+ * `OverlapDetector.detectOverlap` would produce a 0-overlap result anyway
+ * and the iteration cost (O(n^2)) isn't free.
+ */
+export declare function inventoryToTriggerPhraseSkill(entry: InventoryEntry): TriggerPhraseSkill;
+/**
+ * Run the semantic-overlap pass over the inventory.
+ *
+ * Steps:
+ *   1. Build an O(1) lookup from `source_path` -> `InventoryEntry`.
+ *   2. Adapt entries with non-empty `triggerSurface[]` to
+ *      `TriggerPhraseSkill[]`.
+ *   3. Call `OverlapDetector.findAllOverlaps` once.
+ *   4. Map each non-zero overlap result back to a `SemanticCollisionFlag`,
+ *      skipping pairs already flagged by the exact pass.
+ *
+ * Disposal of the `OverlapDetector` is the **caller's** responsibility
+ * — the orchestrator does it after this function returns so it can
+ * also be skipped on the cheap path without double-construction.
+ */
+export declare function detectSemanticCollisions(inventory: ReadonlyArray<InventoryEntry>, exactCollisions: ReadonlyArray<ExactCollisionFlag>, auditId: AuditId, detector: OverlapDetector): Promise<SemanticCollisionFlag[]>;
+//# sourceMappingURL=collision-detector.semantic.helpers.d.ts.map

package/dist/src/audit/collision-detector.semantic.helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"collision-detector.semantic.helpers.d.ts","sourceRoot":"","sources":["../../../src/audit/collision-detector.semantic.helpers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AAE3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mCAAmC,CAAA;AAEvE,OAAO,KAAK,EACV,OAAO,EACP,kBAAkB,EAClB,qBAAqB,EACtB,MAAM,+BAA+B,CAAA;AAEtC;;;;;;;;;GASG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,cAAc,GAAG,kBAAkB,CAMvF;AAqBD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,wBAAwB,CAC5C,SAAS,EAAE,aAAa,CAAC,cAAc,CAAC,EACxC,eAAe,EAAE,aAAa,CAAC,kBAAkB,CAAC,EAClD,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,eAAe,GACxB,OAAO,CAAC,qBAAqB,EAAE,CAAC,CAoDlC"}

package/dist/src/audit/collision-detector.semantic.helpers.js

@@ -0,0 +1,121 @@
+/**
+ * @fileoverview Semantic-overlap pass for SMI-4587 Wave 1 Step 6.
+ * @module @skillsmith/mcp-server/audit/collision-detector.semantic.helpers
+ *
+ * Wraps the existing {@link OverlapDetector} from `@skillsmith/core` and
+ * adapts inventory entries to the `TriggerPhraseSkill` shape it expects.
+ *
+ * Latency invariant: this module is **only imported and exercised** when
+ * the resolved audit-mode is `power_user` or `governance`. In
+ * `preventative` mode the orchestrator skips this path entirely and
+ * therefore never instantiates `EmbeddingService` (the load-bearing
+ * 5 ms p95 invariant for the cheap mode).
+ *
+ * Intentional design: the orchestrator constructs `OverlapDetector` once
+ * per audit run and disposes it via `close()` after this helper returns.
+ * That keeps ONNX model lifetime bounded and avoids two concurrent model
+ * instances on memory-constrained machines (per plan §430).
+ */
+import { deriveCollisionId } from './audit-history.js';
+/**
+ * Adapt an {@link InventoryEntry} to the `TriggerPhraseSkill` shape that
+ * `OverlapDetector` expects. Uses `source_path` as the stable id so we
+ * can map detector results back to the originating inventory entries
+ * via a Map keyed off `source_path`.
+ *
+ * Empty `triggerSurface[]` -> the entry is filtered out upstream because
+ * `OverlapDetector.detectOverlap` would produce a 0-overlap result anyway
+ * and the iteration cost (O(n^2)) isn't free.
+ */
+export function inventoryToTriggerPhraseSkill(entry) {
+    return {
+        id: entry.source_path,
+        name: entry.identifier,
+        triggerPhrases: entry.triggerSurface,
+    };
+}
+/**
+ * Build a Set of "exactly-collided" path-pair keys so the semantic pass
+ * can skip pairs already flagged by Step 4. Key format is the sorted
+ * pair of source_paths joined by `\x00` (NUL — never appears in paths).
+ */
+function buildExactPairSet(exactCollisions) {
+    const pairs = new Set();
+    for (const flag of exactCollisions) {
+        const paths = flag.entries.map((e) => e.source_path).sort();
+        // For 3-way+ exact collisions, all sub-pairs are skipped.
+        for (let i = 0; i < paths.length; i++) {
+            for (let j = i + 1; j < paths.length; j++) {
+                pairs.add(`${paths[i]}\x00${paths[j]}`);
+            }
+        }
+    }
+    return pairs;
+}
+/**
+ * Run the semantic-overlap pass over the inventory.
+ *
+ * Steps:
+ *   1. Build an O(1) lookup from `source_path` -> `InventoryEntry`.
+ *   2. Adapt entries with non-empty `triggerSurface[]` to
+ *      `TriggerPhraseSkill[]`.
+ *   3. Call `OverlapDetector.findAllOverlaps` once.
+ *   4. Map each non-zero overlap result back to a `SemanticCollisionFlag`,
+ *      skipping pairs already flagged by the exact pass.
+ *
+ * Disposal of the `OverlapDetector` is the **caller's** responsibility
+ * — the orchestrator does it after this function returns so it can
+ * also be skipped on the cheap path without double-construction.
+ */
+export async function detectSemanticCollisions(inventory, exactCollisions, auditId, detector) {
+    // Build path -> entry lookup so result mapping is O(1) per overlap.
+    const byPath = new Map();
+    for (const entry of inventory) {
+        byPath.set(entry.source_path, entry);
+    }
+    // Filter to entries with at least one trigger phrase. Empty surfaces
+    // can't overlap with anything semantically.
+    const candidates = inventory
+        .filter((e) => e.triggerSurface.length > 0)
+        .map(inventoryToTriggerPhraseSkill);
+    if (candidates.length < 2) {
+        return [];
+    }
+    const exactPairs = buildExactPairSet(exactCollisions);
+    const overlaps = await detector.findAllOverlaps(candidates);
+    const flags = [];
+    for (const overlap of overlaps) {
+        if (overlap.overlappingPhrases.length === 0)
+            continue;
+        const sortedPair = [overlap.skillId1, overlap.skillId2].sort();
+        const pairKey = `${sortedPair[0]}\x00${sortedPair[1]}`;
+        if (exactPairs.has(pairKey))
+            continue;
+        const entryA = byPath.get(overlap.skillId1);
+        const entryB = byPath.get(overlap.skillId2);
+        if (!entryA || !entryB)
+            continue;
+        flags.push({
+            kind: 'semantic',
+            collisionId: deriveCollisionId(auditId, [entryA, entryB]),
+            entryA,
+            entryB,
+            cosineScore: overlap.overlapScore,
+            overlappingPhrases: overlap.overlappingPhrases,
+            severity: 'warning',
+            reason: buildReason(entryA, entryB, overlap.overlapScore),
+        });
+    }
+    // Stable ordering by entry-pair identifier for deterministic reports.
+    flags.sort((a, b) => {
+        const aKey = `${a.entryA.identifier}|${a.entryB.identifier}`;
+        const bKey = `${b.entryA.identifier}|${b.entryB.identifier}`;
+        return aKey.localeCompare(bKey);
+    });
+    return flags;
+}
+function buildReason(a, b, score) {
+    const pct = Math.round(score * 100);
+    return `"${a.identifier}" and "${b.identifier}" share semantically similar trigger phrases (${pct}% overlap)`;
+}
+//# sourceMappingURL=collision-detector.semantic.helpers.js.map