@skillsmith/core 0.8.1 → 0.9.0

package/dist/src/security/scanner/SecurityScanner.scanners.d.ts

@@ -17,6 +17,16 @@ export declare function scanSocialEngineering(content: string, lineContexts?: Li
 export declare function scanPromptLeaking(content: string, lineContexts?: LineContext[]): SecurityFinding[];
 export declare function scanDataExfiltration(content: string, lineContexts?: LineContext[]): SecurityFinding[];
 export declare function scanPrivilegeEscalation(content: string, lineContexts?: LineContext[]): SecurityFinding[];
+/** SMI-5420: Shannon entropy (bits per character) of a string. */
+export declare function shannonEntropy(s: string): number;
+/**
+ * SMI-5420: a credential match is a documentation placeholder (not a real leaked
+ * secret) when it carries a named placeholder marker, is a single repeated
+ * character, or its value has sub-secret Shannon entropy. Such matches must NOT
+ * emit critical/high severity — the batch trust-scorer (trust-scorer.ts) and the
+ * install gate quarantine on severity, so an example secret would falsely flag.
+ */
+export declare function looksLikePlaceholderSecret(match: string): boolean;
 /** SMI-3864: Detect PII patterns. Email in YAML frontmatter gets low severity. */
 export declare function scanPiiPatterns(content: string, lineContexts?: LineContext[]): SecurityFinding[];
 //# sourceMappingURL=SecurityScanner.scanners.d.ts.map

package/dist/src/security/scanner/SecurityScanner.scanners.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.scanners.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AAUpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAO/D,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA+BnB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CA+ChG"}
+{"version":3,"file":"SecurityScanner.scanners.d.ts","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AAUpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAO/D,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CA+BnB;AAED,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,YAAY,CAAC,EAAE,WAAW,EAAE,GAC3B,eAAe,EAAE,CAgCnB;AAwBD,kEAAkE;AAClE,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAUhD;AAaD;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAMjE;AAED,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CAuDhG"}

package/dist/src/security/scanner/SecurityScanner.scanners.js

@@ -157,6 +157,65 @@ export function scanPrivilegeEscalation(content, lineContexts) {
     });
     return findings;
 }
+/**
+ * SMI-5420: credential PII pattern indices (api/secret/access key, provider
+ * tokens, password) whose matched VALUE can be a documentation placeholder.
+ * Excludes email (7), SSN (8), and the private-key marker (9) — those have no
+ * placeholder-secret failure mode.
+ */
+const CREDENTIAL_PII_INDICES = new Set([0, 1, 2, 3, 4, 5, 6, 10]);
+/**
+ * SMI-5420: named-placeholder markers that indicate an example, not a real
+ * secret. Intentionally NO `X{4,}` rule — it would test the raw match string and
+ * short-circuit before the entropy check, downgrading a REAL high-entropy secret
+ * that coincidentally contains `xxxx` (governance FN). An all-repeated-char value
+ * (e.g. `xxxx…`) is caught by the `/^(.)\1+$/` check in looksLikePlaceholderSecret
+ * instead, and partial-repeat low-variety values by the entropy floor.
+ */
+const PLACEHOLDER_SECRET_RE = /EXAMPLE|YOUR[_-]?|PLACEHOLDER|CHANGE[_-]?ME|DUMMY|FAKE|SAMPLE|REDACTED|INSERT[_-]|\.\.\.|<[^>]+>/i;
+/** SMI-5420: minimum Shannon entropy (bits/char) for a value to read as a real secret. */
+const SECRET_ENTROPY_FLOOR = 3.0;
+/** SMI-5420: Shannon entropy (bits per character) of a string. */
+export function shannonEntropy(s) {
+    if (!s)
+        return 0;
+    const freq = new Map();
+    for (const ch of s)
+        freq.set(ch, (freq.get(ch) ?? 0) + 1);
+    let h = 0;
+    for (const c of freq.values()) {
+        const p = c / s.length;
+        h -= p * Math.log2(p);
+    }
+    return h;
+}
+/**
+ * SMI-5420: extract the secret token from a credential match by stripping a
+ * leading `<key>:`/`<key>=` assignment prefix and surrounding quotes.
+ */
+function extractSecretValue(match) {
+    return match
+        .replace(/^[^:=]*[:=]\s*/, '')
+        .replace(/^['"]|['"]$/g, '')
+        .trim();
+}
+/**
+ * SMI-5420: a credential match is a documentation placeholder (not a real leaked
+ * secret) when it carries a named placeholder marker, is a single repeated
+ * character, or its value has sub-secret Shannon entropy. Such matches must NOT
+ * emit critical/high severity — the batch trust-scorer (trust-scorer.ts) and the
+ * install gate quarantine on severity, so an example secret would falsely flag.
+ */
+export function looksLikePlaceholderSecret(match) {
+    if (PLACEHOLDER_SECRET_RE.test(match))
+        return true;
+    const value = extractSecretValue(match);
+    if (value.length === 0)
+        return false;
+    if (/^(.)\1+$/.test(value))
+        return true;
+    return shannonEntropy(value) < SECRET_ENTROPY_FLOOR;
+}
 /** SMI-3864: Detect PII patterns. Email in YAML frontmatter gets low severity. */
 export function scanPiiPatterns(content, lineContexts) {
     const findings = [];
@@ -193,7 +252,15 @@ export function scanPiiPatterns(content, lineContexts) {
                     severity = 'critical';
                 else
                     severity = 'high';
-                const confidence = inDocContext || inEmailSafeContext ? 'low' : 'high';
+                let confidence = inDocContext || inEmailSafeContext ? 'low' : 'high';
+                // SMI-5420: a credential match that reads as a documentation placeholder
+                // (named placeholder, repeated char, or low entropy) must not emit
+                // critical/high — the batch trust-scorer quarantines on severity, so an
+                // example secret like `api_key: "YOUR_API_KEY_HERE"` would falsely flag.
+                if (CREDENTIAL_PII_INDICES.has(pi) && looksLikePlaceholderSecret(match[0])) {
+                    severity = 'low';
+                    confidence = 'low';
+                }
                 findings.push({
                     type: 'pii',
                     severity,

package/dist/src/security/scanner/SecurityScanner.scanners.js.map

@@ -1 +1 @@
-{"version":3,"file":"SecurityScanner.scanners.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AAErC,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;gBACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,4CAA4C,OAAO,CAAC,MAAM,EAAE;oBACrE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;oBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,mBAAmB;oBAC7B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;oBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAA4B;IAC3E,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC9B,cAAc,GAAG,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,CAAA;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,cAAc,CAAA;QACzD,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,cAAc,GAAG,EAAE,KAAK,iBAAiB,CAAA;gBAC/C,MAAM,YAAY,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC3E,MAAM,kBAAkB,GAAG,cAAc,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,CAAA;gBAC5E,IAAI,QAAgD,CAAA;gBACpD,IAAI,kBAAkB;oBAAE,QAAQ,GAAG,KAAK,CAAA;qBACnC,IAAI,YAAY;oBAAE,QAAQ,GAAG,QAAQ,CAAA;qBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,QAAQ,GAAG,UAAU,CAAA;;oBAC9C,QAAQ,GAAG,MAAM,CAAA;gBACtB,MAAM,UAAU,GAAsB,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACzF,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ;oBACR,OAAO,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;oBACrF,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,KAAK;oBACf,sBAAsB,EAAE,YAAY,IAAI,kBAAkB;oBAC1D,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AACjB,CAAC"}
+{"version":3,"file":"SecurityScanner.scanners.js","sourceRoot":"","sources":["../../../../src/security/scanner/SecurityScanner.scanners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAGH,OAAO,EACL,uBAAuB,EACvB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAEhE,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AAErC,MAAM,UAAU,kBAAkB,CAChC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;gBACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,4CAA4C,OAAO,CAAC,MAAM,EAAE;oBACrE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;YAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,oBAAoB;oBAC1B,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,oBAAoB;oBAC9B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ;oBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;oBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,gBAAgB;oBAC1B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,mBAAmB;oBACzB,QAAQ;oBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,mBAAmB;oBAC7B,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,YAA4B;IAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;YACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;gBAEnD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,sBAAsB;oBAC5B,QAAQ;oBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,sBAAsB;oBAChC,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAA;AAEjE;;;;;;;GAOG;AACH,MAAM,qBAAqB,GACzB,mGAAmG,CAAA;AAErG,0FAA0F;AAC1F,MAAM,oBAAoB,GAAG,GAAG,CAAA;AAEhC,kEAAkE;AAClE,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,IAAI,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAChB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IACtC,KAAK,MAAM,EAAE,IAAI,CAAC;QAAE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;QACtB,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,OAAO,KAAK;SACT,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC;SAC7B,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC;SAC3B,IAAI,EAAE,CAAA;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAClD,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACpC,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IACvC,OAAO,cAAc,CAAC,KAAK,CAAC,GAAG,oBAAoB,CAAA;AACrD,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,OAAe,EAAE,YAA4B;IAC3E,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;IACvB,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;gBAC9B,cAAc,GAAG,CAAC,CAAA;gBAClB,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,iBAAiB,GAAG,CAAC,CAAA;IAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAC3B,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,cAAc,CAAA;QACzD,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;YAChD,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;YAChC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,cAAc,GAAG,EAAE,KAAK,iBAAiB,CAAA;gBAC/C,MAAM,YAAY,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;gBAC3E,MAAM,kBAAkB,GAAG,cAAc,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,CAAA;gBAC5E,IAAI,QAAgD,CAAA;gBACpD,IAAI,kBAAkB;oBAAE,QAAQ,GAAG,KAAK,CAAA;qBACnC,IAAI,YAAY;oBAAE,QAAQ,GAAG,QAAQ,CAAA;qBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;oBAAE,QAAQ,GAAG,UAAU,CAAA;;oBAC9C,QAAQ,GAAG,MAAM,CAAA;gBACtB,IAAI,UAAU,GAAsB,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACvF,yEAAyE;gBACzE,mEAAmE;gBACnE,wEAAwE;gBACxE,yEAAyE;gBACzE,IAAI,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC3E,QAAQ,GAAG,KAAK,CAAA;oBAChB,UAAU,GAAG,KAAK,CAAA;gBACpB,CAAC;gBACD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ;oBACR,OAAO,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;oBACrF,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,KAAK;oBACf,sBAAsB,EAAE,YAAY,IAAI,kBAAkB;oBAC1D,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IACF,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/src/sync/index.d.ts

@@ -8,4 +8,10 @@ export { SyncConfigRepository, type SyncConfig, type SyncConfigUpdate, type Sync
 export { SyncHistoryRepository, type SyncHistoryEntry, type SyncStatus, type SyncRunResult, } from '../repositories/SyncHistoryRepository.js';
 export { SyncEngine, type SyncOptions, type SyncProgress, type SyncResult } from './SyncEngine.js';
 export { BackgroundSyncService, createBackgroundSyncService, type BackgroundSyncOptions, type BackgroundSyncState, } from './BackgroundSyncService.js';
+export { INVENTORY_LIMITS, INVENTORY_UPDATE_POLICIES, type InventoryDevice, type InventorySkillEntry, type InventoryUpdatePolicy, type InventoryUploadPayload, type InventoryUploadResult, } from './inventory-types.js';
+export { collectDeviceSkills } from './inventory-collector.js';
+export { buildInventoryDevice, type BuildInventoryDeviceOptions } from './inventory-device.js';
+export { buildInventoryPayload } from './inventory-builder.js';
+export { uploadInventory, InventoryAuthError, InventoryConflictError, InventoryValidationError, InventoryUploadError, } from './inventory-client.js';
+export { pushInventory, maybeAutoPush, type PushInventoryOptions, type MaybeAutoPushOptions, } from './inventory-push.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/src/sync/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,mBAAmB,GACpB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,0CAA0C,CAAA;AAGjD,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAGlG,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,oBAAoB,EACpB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,mBAAmB,GACpB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,EACL,qBAAqB,EACrB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,aAAa,GACnB,MAAM,0CAA0C,CAAA;AAGjD,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAA;AAGlG,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,GACzB,MAAM,4BAA4B,CAAA;AAGnC,OAAO,EACL,gBAAgB,EAChB,yBAAyB,EACzB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAA;AAG7B,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,oBAAoB,EAAE,KAAK,2BAA2B,EAAE,MAAM,uBAAuB,CAAA;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,aAAa,EACb,aAAa,EACb,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAA"}

package/dist/src/sync/index.js

@@ -11,4 +11,12 @@ export { SyncHistoryRepository, } from '../repositories/SyncHistoryRepository.js
 export { SyncEngine } from './SyncEngine.js';
 // Background service
 export { BackgroundSyncService, createBackgroundSyncService, } from './BackgroundSyncService.js';
+// Cross-harness inventory payload contract (SMI-5389)
+export { INVENTORY_LIMITS, INVENTORY_UPDATE_POLICIES, } from './inventory-types.js';
+// Cross-harness inventory service — shared local agent (SMI-5392)
+export { collectDeviceSkills } from './inventory-collector.js';
+export { buildInventoryDevice } from './inventory-device.js';
+export { buildInventoryPayload } from './inventory-builder.js';
+export { uploadInventory, InventoryAuthError, InventoryConflictError, InventoryValidationError, InventoryUploadError, } from './inventory-client.js';
+export { pushInventory, maybeAutoPush, } from './inventory-push.js';
 //# sourceMappingURL=index.js.map

package/dist/src/sync/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAe;AACf,OAAO,EACL,oBAAoB,EAIpB,mBAAmB,GACpB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,EACL,qBAAqB,GAItB,MAAM,0CAA0C,CAAA;AAEjD,mBAAmB;AACnB,OAAO,EAAE,UAAU,EAAwD,MAAM,iBAAiB,CAAA;AAElG,qBAAqB;AACrB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAG5B,MAAM,4BAA4B,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/sync/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAe;AACf,OAAO,EACL,oBAAoB,EAIpB,mBAAmB,GACpB,MAAM,yCAAyC,CAAA;AAEhD,OAAO,EACL,qBAAqB,GAItB,MAAM,0CAA0C,CAAA;AAEjD,mBAAmB;AACnB,OAAO,EAAE,UAAU,EAAwD,MAAM,iBAAiB,CAAA;AAElG,qBAAqB;AACrB,OAAO,EACL,qBAAqB,EACrB,2BAA2B,GAG5B,MAAM,4BAA4B,CAAA;AAEnC,sDAAsD;AACtD,OAAO,EACL,gBAAgB,EAChB,yBAAyB,GAM1B,MAAM,sBAAsB,CAAA;AAE7B,kEAAkE;AAClE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,oBAAoB,EAAoC,MAAM,uBAAuB,CAAA;AAC9F,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAA;AAC9B,OAAO,EACL,aAAa,EACb,aAAa,GAGd,MAAM,qBAAqB,CAAA"}

package/dist/src/sync/inventory-builder.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Inventory payload assembler (SMI-5392, umbrella SMI-5382).
+ *
+ * Combines the device descriptor ({@link buildInventoryDevice}) with the scanned
+ * skill set ({@link collectDeviceSkills}) into the full
+ * {@link InventoryUploadPayload} that {@link uploadInventory} POSTs to the
+ * `inventory-upload` edge function.
+ *
+ * @module @skillsmith/core/sync/inventory-builder
+ */
+import { type BuildInventoryDeviceOptions } from './inventory-device.js';
+import type { InventoryUploadPayload } from './inventory-types.js';
+/**
+ * Build the complete inventory snapshot for this device.
+ *
+ * @param opts - Optional CLI version to stamp on the device descriptor.
+ * @returns `{ device, skills }` ready to upload.
+ * @see SMI-5392
+ */
+export declare function buildInventoryPayload(opts?: BuildInventoryDeviceOptions): Promise<InventoryUploadPayload>;
+//# sourceMappingURL=inventory-builder.d.ts.map

package/dist/src/sync/inventory-builder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-builder.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAwB,KAAK,2BAA2B,EAAE,MAAM,uBAAuB,CAAA;AAC9F,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAA;AAElE;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,CAAC,EAAE,2BAA2B,GACjC,OAAO,CAAC,sBAAsB,CAAC,CAKjC"}

package/dist/src/sync/inventory-builder.js

@@ -0,0 +1,26 @@
+/**
+ * Inventory payload assembler (SMI-5392, umbrella SMI-5382).
+ *
+ * Combines the device descriptor ({@link buildInventoryDevice}) with the scanned
+ * skill set ({@link collectDeviceSkills}) into the full
+ * {@link InventoryUploadPayload} that {@link uploadInventory} POSTs to the
+ * `inventory-upload` edge function.
+ *
+ * @module @skillsmith/core/sync/inventory-builder
+ */
+import { collectDeviceSkills } from './inventory-collector.js';
+import { buildInventoryDevice } from './inventory-device.js';
+/**
+ * Build the complete inventory snapshot for this device.
+ *
+ * @param opts - Optional CLI version to stamp on the device descriptor.
+ * @returns `{ device, skills }` ready to upload.
+ * @see SMI-5392
+ */
+export async function buildInventoryPayload(opts) {
+    return {
+        device: buildInventoryDevice(opts),
+        skills: await collectDeviceSkills(),
+    };
+}
+//# sourceMappingURL=inventory-builder.js.map

package/dist/src/sync/inventory-builder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-builder.js","sourceRoot":"","sources":["../../../src/sync/inventory-builder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,oBAAoB,EAAoC,MAAM,uBAAuB,CAAA;AAG9F;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAkC;IAElC,OAAO;QACL,MAAM,EAAE,oBAAoB,CAAC,IAAI,CAAC;QAClC,MAAM,EAAE,MAAM,mBAAmB,EAAE;KACpC,CAAA;AACH,CAAC"}

package/dist/src/sync/inventory-client.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Inventory upload HTTP client (SMI-5392, umbrella SMI-5382).
+ *
+ * Authenticates with the stored device-login session (JWT + refresh) and POSTs a
+ * full inventory snapshot to the gateway-verified `inventory-upload` edge
+ * function. Maps the edge function's status codes onto typed errors so callers
+ * (CLI command, MCP tool) can render precise, actionable messages.
+ *
+ * @module @skillsmith/core/sync/inventory-client
+ */
+import type { InventoryUploadPayload, InventoryUploadResult } from './inventory-types.js';
+/**
+ * No usable session (no stored credentials, or a refresh that failed). The
+ * message hints at the recovery action so the CLI/MCP surface can relay it.
+ *
+ * @see SMI-5392
+ */
+export declare class InventoryAuthError extends Error {
+    constructor(message?: string);
+}
+/**
+ * The `device_id` is already owned by another user (HTTP 409). The user must
+ * forget the local device and re-register before retrying.
+ *
+ * @see SMI-5392
+ */
+export declare class InventoryConflictError extends Error {
+    constructor(message?: string);
+}
+/**
+ * The server rejected the payload as malformed (HTTP 400) — e.g.
+ * `device_id_required`, `too_many_skills`, or an invalid field.
+ *
+ * @see SMI-5392
+ */
+export declare class InventoryValidationError extends Error {
+    constructor(message?: string);
+}
+/**
+ * Catch-all for transport failures and unexpected server responses (HTTP 5xx,
+ * network errors, unparseable bodies).
+ *
+ * @see SMI-5392
+ */
+export declare class InventoryUploadError extends Error {
+    constructor(message: string);
+}
+/**
+ * Upload a full inventory snapshot for this device.
+ *
+ * A `200` response is returned verbatim — this INCLUDES the consent-off no-op
+ * `{ ok: true, applied: false, reason: 'consent_disabled' }`, which is a success,
+ * not an error.
+ *
+ * @param payload - The device + skills snapshot to upload.
+ * @returns The edge function's {@link InventoryUploadResult}.
+ * @throws {InventoryAuthError} HTTP 401, or no/expired session.
+ * @throws {InventoryConflictError} HTTP 409 (device owned by another user).
+ * @throws {InventoryValidationError} HTTP 400 (malformed / oversized payload).
+ * @throws {InventoryUploadError} HTTP 5xx, network failure, or unparseable 200 body.
+ * @see SMI-5392
+ */
+export declare function uploadInventory(payload: InventoryUploadPayload): Promise<InventoryUploadResult>;
+//# sourceMappingURL=inventory-client.d.ts.map

package/dist/src/sync/inventory-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-client.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAEzF;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,SAA6D;CAIjF;AAED;;;;;GAKG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,OAAO,SAAoB;CAIxC;AAED;;;;;GAKG;AACH,qBAAa,wBAAyB,SAAQ,KAAK;gBACrC,OAAO,SAAoB;CAIxC;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI5B;AAuCD;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CAyChC"}

package/dist/src/sync/inventory-client.js

@@ -0,0 +1,150 @@
+/**
+ * Inventory upload HTTP client (SMI-5392, umbrella SMI-5382).
+ *
+ * Authenticates with the stored device-login session (JWT + refresh) and POSTs a
+ * full inventory snapshot to the gateway-verified `inventory-upload` edge
+ * function. Maps the edge function's status codes onto typed errors so callers
+ * (CLI command, MCP tool) can render precise, actionable messages.
+ *
+ * @module @skillsmith/core/sync/inventory-client
+ */
+import { loadCredentials, refreshAccessToken, storeCredentials, } from '../config/token-credentials.js';
+import { DEFAULT_BASE_URL, PRODUCTION_ANON_KEY } from '../api/utils.js';
+/**
+ * No usable session (no stored credentials, or a refresh that failed). The
+ * message hints at the recovery action so the CLI/MCP surface can relay it.
+ *
+ * @see SMI-5392
+ */
+export class InventoryAuthError extends Error {
+    constructor(message = 'Not authenticated. Run `skillsmith login` and try again.') {
+        super(message);
+        this.name = 'InventoryAuthError';
+    }
+}
+/**
+ * The `device_id` is already owned by another user (HTTP 409). The user must
+ * forget the local device and re-register before retrying.
+ *
+ * @see SMI-5392
+ */
+export class InventoryConflictError extends Error {
+    constructor(message = 'device_conflict') {
+        super(message);
+        this.name = 'InventoryConflictError';
+    }
+}
+/**
+ * The server rejected the payload as malformed (HTTP 400) — e.g.
+ * `device_id_required`, `too_many_skills`, or an invalid field.
+ *
+ * @see SMI-5392
+ */
+export class InventoryValidationError extends Error {
+    constructor(message = 'invalid payload') {
+        super(message);
+        this.name = 'InventoryValidationError';
+    }
+}
+/**
+ * Catch-all for transport failures and unexpected server responses (HTTP 5xx,
+ * network errors, unparseable bodies).
+ *
+ * @see SMI-5392
+ */
+export class InventoryUploadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InventoryUploadError';
+    }
+}
+/** Refresh the access token this many ms before it actually expires. */
+const TOKEN_REFRESH_SKEW_MS = 60_000;
+/**
+ * Resolve a fresh access token, refreshing (and persisting) if the stored one is
+ * within {@link TOKEN_REFRESH_SKEW_MS} of expiry.
+ *
+ * @throws {InventoryAuthError} When no credentials exist or the refresh fails.
+ */
+async function resolveAccessToken() {
+    const creds = await loadCredentials();
+    if (!creds)
+        throw new InventoryAuthError();
+    if (creds.expiresAt <= Date.now() + TOKEN_REFRESH_SKEW_MS) {
+        const refreshed = await refreshAccessToken(creds.refreshToken);
+        if (!refreshed)
+            throw new InventoryAuthError();
+        await storeCredentials(refreshed);
+        return refreshed.accessToken;
+    }
+    return creds.accessToken;
+}
+/**
+ * Best-effort extraction of the server's `{ error: string }` body so a typed
+ * error can carry the precise server message. Returns `null` when the body is
+ * absent or not JSON.
+ */
+async function readServerError(res) {
+    try {
+        const body = (await res.json());
+        return typeof body.error === 'string' ? body.error : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Upload a full inventory snapshot for this device.
+ *
+ * A `200` response is returned verbatim — this INCLUDES the consent-off no-op
+ * `{ ok: true, applied: false, reason: 'consent_disabled' }`, which is a success,
+ * not an error.
+ *
+ * @param payload - The device + skills snapshot to upload.
+ * @returns The edge function's {@link InventoryUploadResult}.
+ * @throws {InventoryAuthError} HTTP 401, or no/expired session.
+ * @throws {InventoryConflictError} HTTP 409 (device owned by another user).
+ * @throws {InventoryValidationError} HTTP 400 (malformed / oversized payload).
+ * @throws {InventoryUploadError} HTTP 5xx, network failure, or unparseable 200 body.
+ * @see SMI-5392
+ */
+export async function uploadInventory(payload) {
+    const accessToken = await resolveAccessToken();
+    let res;
+    try {
+        res = await fetch(`${DEFAULT_BASE_URL}/inventory-upload`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                apikey: PRODUCTION_ANON_KEY,
+                Authorization: `Bearer ${accessToken}`,
+            },
+            body: JSON.stringify(payload),
+        });
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new InventoryUploadError(`Inventory upload request failed: ${detail}`);
+    }
+    if (res.ok) {
+        try {
+            return (await res.json());
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new InventoryUploadError(`Inventory upload returned an unreadable body: ${detail}`);
+        }
+    }
+    const serverError = await readServerError(res);
+    switch (res.status) {
+        case 401:
+            throw new InventoryAuthError();
+        case 409:
+            throw new InventoryConflictError(serverError ?? 'device_conflict');
+        case 400:
+            throw new InventoryValidationError(serverError ?? 'invalid payload');
+        default:
+            throw new InventoryUploadError(`Inventory upload failed (HTTP ${res.status})${serverError ? `: ${serverError}` : ''}`);
+    }
+}
+//# sourceMappingURL=inventory-client.js.map

package/dist/src/sync/inventory-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-client.js","sourceRoot":"","sources":["../../../src/sync/inventory-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGvE;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,GAAG,0DAA0D;QAC9E,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,GAAG,iBAAiB;QACrC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,iBAAiB;QACrC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAEpC;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB;IAC/B,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAE1C,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAC9D,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;QAC9C,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;QACjC,OAAO,SAAS,CAAC,WAAW,CAAA;IAC9B,CAAC;IAED,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,GAAa;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;QACtD,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAA;IAE9C,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,gBAAgB,mBAAmB,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,mBAAmB;gBAC3B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACrE,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAA;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrE,MAAM,IAAI,oBAAoB,CAAC,iDAAiD,MAAM,EAAE,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAA;IAC9C,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,GAAG;YACN,MAAM,IAAI,kBAAkB,EAAE,CAAA;QAChC,KAAK,GAAG;YACN,MAAM,IAAI,sBAAsB,CAAC,WAAW,IAAI,iBAAiB,CAAC,CAAA;QACpE,KAAK,GAAG;YACN,MAAM,IAAI,wBAAwB,CAAC,WAAW,IAAI,iBAAiB,CAAC,CAAA;QACtE;YACE,MAAM,IAAI,oBAAoB,CAC5B,iCAAiC,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACvF,CAAA;IACL,CAAC;AACH,CAAC"}

package/dist/src/sync/inventory-client.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * inventory-client tests (SMI-5392).
+ *
+ * Mocks the token-credentials module and global fetch.
+ *
+ * UC-1: no credentials -> InventoryAuthError, no fetch.
+ * UC-2: expired credentials -> refresh path runs, new creds stored, new token used.
+ * UC-3: expired credentials + failed refresh -> InventoryAuthError.
+ * UC-4: 200 body returned verbatim (incl. the consent-off no-op).
+ * UC-5: 401 / 409 / 400 / 500 -> the matching typed error.
+ * UC-6: network throw -> InventoryUploadError.
+ */
+export {};
+//# sourceMappingURL=inventory-client.test.d.ts.map

package/dist/src/sync/inventory-client.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-client.test.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-client.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/src/sync/inventory-client.test.js

@@ -0,0 +1,146 @@
+/**
+ * inventory-client tests (SMI-5392).
+ *
+ * Mocks the token-credentials module and global fetch.
+ *
+ * UC-1: no credentials -> InventoryAuthError, no fetch.
+ * UC-2: expired credentials -> refresh path runs, new creds stored, new token used.
+ * UC-3: expired credentials + failed refresh -> InventoryAuthError.
+ * UC-4: 200 body returned verbatim (incl. the consent-off no-op).
+ * UC-5: 401 / 409 / 400 / 500 -> the matching typed error.
+ * UC-6: network throw -> InventoryUploadError.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+vi.mock('../config/token-credentials.js', () => ({
+    loadCredentials: vi.fn(),
+    refreshAccessToken: vi.fn(),
+    storeCredentials: vi.fn(),
+}));
+import { loadCredentials, refreshAccessToken, storeCredentials, } from '../config/token-credentials.js';
+import { uploadInventory, InventoryAuthError, InventoryConflictError, InventoryValidationError, InventoryUploadError, } from './inventory-client.js';
+const fetchMock = vi.fn();
+const payload = {
+    device: { device_id: '11111111-1111-4111-8111-111111111111' },
+    skills: [],
+};
+function jsonResponse(body, status) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+const futureCreds = {
+    accessToken: 'at_valid',
+    refreshToken: 'rt_valid',
+    expiresAt: Date.now() + 3_600_000,
+    version: 2,
+};
+describe('inventory-client', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.stubGlobal('fetch', fetchMock);
+    });
+    afterEach(() => {
+        vi.unstubAllGlobals();
+    });
+    it('UC-1: throws InventoryAuthError when no credentials are stored', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(null);
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryAuthError);
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+    it('UC-2: refreshes + stores when the access token is near expiry, then uses the new token', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'at_expired',
+            refreshToken: 'rt_old',
+            expiresAt: Date.now() - 1_000,
+            version: 2,
+        });
+        vi.mocked(refreshAccessToken).mockResolvedValue({
+            accessToken: 'at_new',
+            refreshToken: 'rt_new',
+            expiresAt: Date.now() + 3_600_000,
+            version: 2,
+        });
+        fetchMock.mockResolvedValue(jsonResponse({ ok: true, applied: true, device_id: 'd' }, 200));
+        const result = await uploadInventory(payload);
+        expect(refreshAccessToken).toHaveBeenCalledWith('rt_old');
+        expect(storeCredentials).toHaveBeenCalledWith(expect.objectContaining({ accessToken: 'at_new', version: 2 }));
+        expect(fetchMock).toHaveBeenCalledWith(expect.stringContaining('/inventory-upload'), expect.objectContaining({
+            method: 'POST',
+            headers: expect.objectContaining({ Authorization: 'Bearer at_new' }),
+        }));
+        expect(result.applied).toBe(true);
+    });
+    it('UC-3: throws InventoryAuthError when the refresh fails', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'at_expired',
+            refreshToken: 'rt_old',
+            expiresAt: Date.now() - 1_000,
+            version: 2,
+        });
+        vi.mocked(refreshAccessToken).mockResolvedValue(null);
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryAuthError);
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+    it('UC-4: returns the 200 body verbatim, including the consent-off no-op', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        const consentOff = { ok: true, applied: false, reason: 'consent_disabled' };
+        fetchMock.mockResolvedValue(jsonResponse(consentOff, 200));
+        const result = await uploadInventory(payload);
+        expect(result).toEqual(consentOff);
+        expect(refreshAccessToken).not.toHaveBeenCalled();
+    });
+    it('UC-5a: maps 401 to InventoryAuthError', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        fetchMock.mockResolvedValue(jsonResponse({ error: 'authentication_required' }, 401));
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryAuthError);
+    });
+    it('UC-5b: maps 409 to InventoryConflictError', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        fetchMock.mockResolvedValue(jsonResponse({ error: 'device_conflict' }, 409));
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryConflictError);
+    });
+    it('UC-5c: maps 400 to InventoryValidationError carrying the server message', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        fetchMock.mockResolvedValue(jsonResponse({ error: 'too_many_skills' }, 400));
+        // Single call: the mocked Response body can only be read once.
+        const error = await uploadInventory(payload).catch((e) => e);
+        expect(error).toBeInstanceOf(InventoryValidationError);
+        expect(error.message).toBe('too_many_skills');
+    });
+    it('UC-5d: maps 500 to InventoryUploadError', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        fetchMock.mockResolvedValue(jsonResponse({ error: 'server_error' }, 500));
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryUploadError);
+    });
+    it('UC-6: wraps a network throw in InventoryUploadError', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        fetchMock.mockRejectedValue(new Error('ECONNREFUSED'));
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryUploadError);
+    });
+    // Security invariant: tokens must never appear in error message strings.
+    // Covers both the non-200 response path and the network-throw path.
+    it('UC-7: error messages do not leak access tokens or refresh tokens (security invariant)', async () => {
+        const sentinelCreds = {
+            accessToken: 'at_SECRET_5392',
+            refreshToken: 'rt_SECRET_5392',
+            expiresAt: Date.now() + 3_600_000,
+            version: 2,
+        };
+        // Non-200 path: 500 → InventoryUploadError whose message must not contain tokens.
+        vi.mocked(loadCredentials).mockResolvedValue(sentinelCreds);
+        fetchMock.mockResolvedValue(jsonResponse({ error: 'server_error' }, 500));
+        const err500 = await uploadInventory(payload).catch((e) => e);
+        expect(err500).toBeInstanceOf(InventoryUploadError);
+        expect(err500.message).not.toContain('at_SECRET_5392');
+        expect(err500.message).not.toContain('rt_SECRET_5392');
+        // Network-throw path: fetch rejects → InventoryUploadError whose message must not contain tokens.
+        vi.mocked(loadCredentials).mockResolvedValue(sentinelCreds);
+        fetchMock.mockRejectedValue(new Error('ECONNREFUSED'));
+        const errNet = await uploadInventory(payload).catch((e) => e);
+        expect(errNet).toBeInstanceOf(InventoryUploadError);
+        expect(errNet.message).not.toContain('at_SECRET_5392');
+        expect(errNet.message).not.toContain('rt_SECRET_5392');
+    });
+});
+//# sourceMappingURL=inventory-client.test.js.map