@skillsmith/core 0.8.1 → 0.9.0

package/dist/src/sync/inventory-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-client.test.js","sourceRoot":"","sources":["../../../src/sync/inventory-client.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAExE,EAAE,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC3B,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC1B,CAAC,CAAC,CAAA;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAA;AAG9B,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAgB,CAAA;AAEvC,MAAM,OAAO,GAA2B;IACtC,MAAM,EAAE,EAAE,SAAS,EAAE,sCAAsC,EAAE;IAC7D,MAAM,EAAE,EAAE;CACX,CAAA;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,UAAU;IACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;IACjC,OAAO,EAAE,CAAU;CACpB,CAAA;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;QAClB,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAA;QACjF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,YAAY;YACzB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC;YAC9C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAE3F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;QAE7C,MAAM,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAC3C,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAC/D,CAAA;QACD,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAC5C,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;SACrE,CAAC,CACH,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,YAAY;YACzB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAErD,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAA;QACjF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,MAAM,UAAU,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;QAC3E,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAA;QAE1D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;QAE7C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAClC,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAEpF,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAE5E,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAE5E,+DAA+D;QAC/D,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;QACrE,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAA;QACtD,MAAM,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAEzE,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,SAAS,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;QAEtD,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,oEAAoE;IACpE,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,aAAa,GAAG;YACpB,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,gBAAgB;YAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,OAAO,EAAE,CAAU;SACpB,CAAA;QAED,kFAAkF;QAClF,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;QAC3D,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAEzE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;QACtE,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;QACnD,MAAM,CAAE,MAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QACjE,MAAM,CAAE,MAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QAEjE,kGAAkG;QAClG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;QAC3D,SAAS,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;QAEtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;QACtE,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;QACnD,MAAM,CAAE,MAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QACjE,MAAM,CAAE,MAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/sync/inventory-collector.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Cross-harness skill collector (SMI-5392, umbrella SMI-5382).
+ *
+ * Walks every known harness skill directory (`CLIENT_NATIVE_PATHS`) and emits
+ * one {@link InventorySkillEntry} per (harness, skill) observed on disk. This is
+ * the shared scanner that both the CLI `inventory push` command (Wave 3) and the
+ * MCP inventory tool call before handing the snapshot to {@link uploadInventory}.
+ *
+ * Design parity with the CLI scanner at
+ * `packages/cli/src/utils/skills-directory.ts`:
+ * - Uses the SAME {@link SkillParser} to resolve `skill_id` / `version`.
+ * - Realpath-deduplicates ACROSS harnesses (collapses symlink aliases), but does
+ *   NOT name-deduplicate — the same skill independently installed under two
+ *   harnesses is two distinct rows (the `device_skills` PK is `(harness, skill_id)`).
+ *
+ * @module @skillsmith/core/sync/inventory-collector
+ */
+import type { InventorySkillEntry } from './inventory-types.js';
+/**
+ * Collect every harness-installed skill on this device as inventory entries.
+ *
+ * Scans each harness in {@link CLIENT_IDS} order. Repo-local `./.claude/skills`
+ * is intentionally excluded — inventory tracks harness-installed skills only, and
+ * `harness` is always a {@link ClientId}, never `'local'`.
+ *
+ * The result is NOT truncated to `INVENTORY_LIMITS.MAX_SKILLS`. Exceeding
+ * the cap is a real condition the caller / edge function must enforce (returning
+ * a `too_many_skills` 400) — silently dropping skills here would corrupt the
+ * server-side reconcile by making present skills look absent.
+ *
+ * @returns One entry per (harness, skill), realpath-deduplicated across harnesses.
+ * @see SMI-5392
+ */
+export declare function collectDeviceSkills(): Promise<InventorySkillEntry[]>;
+//# sourceMappingURL=inventory-collector.d.ts.map

package/dist/src/sync/inventory-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-collector.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAoH/D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAO1E"}

package/dist/src/sync/inventory-collector.js

@@ -0,0 +1,149 @@
+/**
+ * Cross-harness skill collector (SMI-5392, umbrella SMI-5382).
+ *
+ * Walks every known harness skill directory (`CLIENT_NATIVE_PATHS`) and emits
+ * one {@link InventorySkillEntry} per (harness, skill) observed on disk. This is
+ * the shared scanner that both the CLI `inventory push` command (Wave 3) and the
+ * MCP inventory tool call before handing the snapshot to {@link uploadInventory}.
+ *
+ * Design parity with the CLI scanner at
+ * `packages/cli/src/utils/skills-directory.ts`:
+ * - Uses the SAME {@link SkillParser} to resolve `skill_id` / `version`.
+ * - Realpath-deduplicates ACROSS harnesses (collapses symlink aliases), but does
+ *   NOT name-deduplicate — the same skill independently installed under two
+ *   harnesses is two distinct rows (the `device_skills` PK is `(harness, skill_id)`).
+ *
+ * @module @skillsmith/core/sync/inventory-collector
+ */
+import { readdir, readFile, realpath, stat } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { SkillParser } from '../indexer/SkillParser.js';
+import { CLIENT_IDS, CLIENT_NATIVE_PATHS } from '../install/paths.js';
+/**
+ * Resolve a path through `realpath` defensively. Returns the resolved path on
+ * success, or the input path unchanged when the link is broken / unreadable —
+ * dedup keying still works either way (we just can't collapse a broken alias).
+ */
+async function safeRealpath(path) {
+    try {
+        return await realpath(path);
+    }
+    catch {
+        return path;
+    }
+}
+/**
+ * Return `true` when a directory entry resolves to a directory, following
+ * symlinks. `withFileTypes` reports a symlinked directory as a symlink (not a
+ * directory), so symlinked aliases must be `stat`-resolved to be collected —
+ * which is exactly what makes the cross-harness realpath dedup observable.
+ */
+async function resolvesToDirectory(entryPath, isDirectory, isSymbolicLink) {
+    if (isDirectory)
+        return true;
+    if (!isSymbolicLink)
+        return false;
+    try {
+        return (await stat(entryPath)).isDirectory();
+    }
+    catch {
+        return false; // broken symlink
+    }
+}
+/**
+ * Read `<skillDir>/SKILL.md` and derive the inventory fields.
+ *
+ * - `content_hash` is the sha256 hex digest of the raw SKILL.md content. Wave 5
+ *   validates that this hashing stays drift-aligned with the indexer's hashing.
+ * - `skill_id` is the parsed `id` front-matter field, falling back to the parsed
+ *   `name`, then the directory name (same precedence as the CLI scanner).
+ * - A directory with no readable SKILL.md still counts as a skill: `skill_id` is
+ *   the directory name, with `version` and `content_hash` both `null`.
+ */
+async function readSkillFields(skillDir, dirName) {
+    try {
+        const content = await readFile(join(skillDir, 'SKILL.md'), 'utf-8');
+        const contentHash = createHash('sha256').update(content, 'utf8').digest('hex');
+        const parsed = new SkillParser().parse(content);
+        if (!parsed) {
+            // SKILL.md is readable but has no valid frontmatter — hash still applies.
+            return { skillId: dirName, version: null, contentHash };
+        }
+        // Match the CLI scanner: read `id` off the parsed metadata, then `name`.
+        const parsedId = parsed['id'];
+        return {
+            skillId: parsedId ?? parsed.name ?? dirName,
+            version: parsed.version ?? null,
+            contentHash,
+        };
+    }
+    catch {
+        // No readable SKILL.md — still a skill, but version/hash are unknown.
+        return { skillId: dirName, version: null, contentHash: null };
+    }
+}
+/**
+ * Scan a single harness directory and append its skills to `entries`,
+ * deduplicating by realpath via the shared `seenRealpaths` set.
+ */
+async function collectHarness(harness, entries, seenRealpaths) {
+    const harnessDir = CLIENT_NATIVE_PATHS[harness];
+    let dirents;
+    try {
+        dirents = await readdir(harnessDir, { withFileTypes: true });
+    }
+    catch (error) {
+        const code = error.code;
+        // Absent harness dir is the common case (harness not installed) — skip it.
+        if (code === 'ENOENT' || code === 'ENOTDIR')
+            return;
+        throw error;
+    }
+    for (const dirent of dirents) {
+        const entryPath = join(harnessDir, dirent.name);
+        if (!(await resolvesToDirectory(entryPath, dirent.isDirectory(), dirent.isSymbolicLink()))) {
+            continue;
+        }
+        // Realpath dedup ACROSS harnesses: the first harness in CLIENT_IDS order
+        // wins, so a symlinked alias under a later harness is collapsed away.
+        const realDir = await safeRealpath(entryPath);
+        if (seenRealpaths.has(realDir))
+            continue;
+        seenRealpaths.add(realDir);
+        const { skillId, version, contentHash } = await readSkillFields(entryPath, dirent.name);
+        entries.push({
+            harness,
+            skill_id: skillId,
+            version,
+            content_hash: contentHash,
+            source: null,
+            pinned_version: null,
+            update_policy: null,
+        });
+    }
+}
+/**
+ * Collect every harness-installed skill on this device as inventory entries.
+ *
+ * Scans each harness in {@link CLIENT_IDS} order. Repo-local `./.claude/skills`
+ * is intentionally excluded — inventory tracks harness-installed skills only, and
+ * `harness` is always a {@link ClientId}, never `'local'`.
+ *
+ * The result is NOT truncated to `INVENTORY_LIMITS.MAX_SKILLS`. Exceeding
+ * the cap is a real condition the caller / edge function must enforce (returning
+ * a `too_many_skills` 400) — silently dropping skills here would corrupt the
+ * server-side reconcile by making present skills look absent.
+ *
+ * @returns One entry per (harness, skill), realpath-deduplicated across harnesses.
+ * @see SMI-5392
+ */
+export async function collectDeviceSkills() {
+    const entries = [];
+    const seenRealpaths = new Set();
+    for (const harness of CLIENT_IDS) {
+        await collectHarness(harness, entries, seenRealpaths);
+    }
+    return entries;
+}
+//# sourceMappingURL=inventory-collector.js.map

package/dist/src/sync/inventory-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-collector.js","sourceRoot":"","sources":["../../../src/sync/inventory-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAiB,MAAM,qBAAqB,CAAA;AAGpF;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,WAAoB,EACpB,cAAuB;IAEvB,IAAI,WAAW;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAA;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,iBAAiB;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;QACnE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,0EAA0E;YAC1E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACzD,CAAC;QACD,yEAAyE;QACzE,MAAM,QAAQ,GAAI,MAA6C,CAAC,IAAI,CAAuB,CAAA;QAC3F,OAAO;YACL,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO;YAC3C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,WAAW;SACZ,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAiB,EACjB,OAA8B,EAC9B,aAA0B;IAE1B,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAE/C,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;QAClD,2EAA2E;QAC3E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAM;QACnD,MAAM,KAAK,CAAA;IACb,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC;YAC3F,SAAQ;QACV,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;QAC7C,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAQ;QACxC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAE1B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACvF,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,QAAQ,EAAE,OAAO;YACjB,OAAO;YACP,YAAY,EAAE,WAAW;YACzB,MAAM,EAAE,IAAI;YACZ,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,OAAO,GAA0B,EAAE,CAAA;IACzC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/src/sync/inventory-collector.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * inventory-collector tests (SMI-5392).
+ *
+ * Controls the harness directory table by mocking `../install/paths.js` so each
+ * `ClientId` points at a real tmp fixture. CLIENT_NATIVE_PATHS is a mutable
+ * object the collector reads at call time, so per-test fixtures are visible
+ * without re-importing the module.
+ *
+ * IC-1: same skill under two harnesses (distinct realpaths) -> two entries.
+ * IC-2: a symlinked alias across harnesses -> one entry (first ClientId wins).
+ * IC-3: readable SKILL.md -> content_hash + version; missing SKILL.md -> nulls.
+ */
+export {};
+//# sourceMappingURL=inventory-collector.test.d.ts.map

package/dist/src/sync/inventory-collector.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-collector.test.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-collector.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/src/sync/inventory-collector.test.js

@@ -0,0 +1,107 @@
+/**
+ * inventory-collector tests (SMI-5392).
+ *
+ * Controls the harness directory table by mocking `../install/paths.js` so each
+ * `ClientId` points at a real tmp fixture. CLIENT_NATIVE_PATHS is a mutable
+ * object the collector reads at call time, so per-test fixtures are visible
+ * without re-importing the module.
+ *
+ * IC-1: same skill under two harnesses (distinct realpaths) -> two entries.
+ * IC-2: a symlinked alias across harnesses -> one entry (first ClientId wins).
+ * IC-3: readable SKILL.md -> content_hash + version; missing SKILL.md -> nulls.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, mkdir, writeFile, symlink, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+const mockPaths = vi.hoisted(() => ({
+    CLIENT_IDS: ['claude-code', 'cursor', 'copilot', 'windsurf', 'agents'],
+    CLIENT_NATIVE_PATHS: {},
+}));
+vi.mock('../install/paths.js', () => ({
+    CLIENT_IDS: mockPaths.CLIENT_IDS,
+    CLIENT_NATIVE_PATHS: mockPaths.CLIENT_NATIVE_PATHS,
+}));
+import { collectDeviceSkills } from './inventory-collector.js';
+import { INVENTORY_LIMITS } from './inventory-types.js';
+function skillMd(name, version) {
+    const versionLine = version ? `\nversion: ${version}` : '';
+    return `---\nname: ${name}${versionLine}\n---\n\n# ${name}\n`;
+}
+async function createSkill(harness, name, opts = {}) {
+    const dir = join(mockPaths.CLIENT_NATIVE_PATHS[harness], name);
+    await mkdir(dir, { recursive: true });
+    if (opts.withSkillMd !== false) {
+        await writeFile(join(dir, 'SKILL.md'), skillMd(name, opts.version));
+    }
+    return dir;
+}
+let root;
+describe('inventory-collector', () => {
+    beforeEach(async () => {
+        root = await mkdtemp(join(tmpdir(), 'inv-collector-'));
+        // Point every harness at its own (initially absent) subdir under root.
+        for (const id of mockPaths.CLIENT_IDS) {
+            mockPaths.CLIENT_NATIVE_PATHS[id] = join(root, id);
+        }
+    });
+    afterEach(async () => {
+        await rm(root, { recursive: true, force: true });
+        vi.restoreAllMocks();
+    });
+    it('IC-1: emits two entries for the same skill installed under two harnesses', async () => {
+        await createSkill('claude-code', 'foo', { version: '1.0.0' });
+        await createSkill('cursor', 'foo', { version: '2.0.0' });
+        const entries = await collectDeviceSkills();
+        const foo = entries.filter((e) => e.skill_id === 'foo');
+        expect(foo).toHaveLength(2);
+        expect(foo.map((e) => e.harness).sort()).toEqual(['claude-code', 'cursor']);
+        // Distinct realpaths -> distinct rows, each carrying its own version + hash.
+        expect(foo.every((e) => typeof e.content_hash === 'string')).toBe(true);
+        // Static fields are always null at the local-agent layer.
+        expect(foo.every((e) => e.source === null && e.pinned_version === null)).toBe(true);
+        expect(foo.every((e) => e.update_policy === null)).toBe(true);
+    });
+    it('IC-2: collapses a symlinked alias across harnesses to one entry (first ClientId wins)', async () => {
+        const real = await createSkill('claude-code', 'bar', { version: '1.0.0' });
+        await mkdir(mockPaths.CLIENT_NATIVE_PATHS['agents'], { recursive: true });
+        await symlink(real, join(mockPaths.CLIENT_NATIVE_PATHS['agents'], 'bar'), 'dir');
+        const entries = await collectDeviceSkills();
+        const bar = entries.filter((e) => e.skill_id === 'bar');
+        expect(bar).toHaveLength(1);
+        // claude-code precedes agents in CLIENT_IDS, so it wins the dedup.
+        expect(bar[0]?.harness).toBe('claude-code');
+    });
+    // IC-4: No truncation at MAX_SKILLS boundary.
+    //
+    // The collector is intentionally uncapped — it returns EVERY on-disk entry.
+    // The >5000 ceiling is enforced server-side via the `too_many_skills` 400 error
+    // (see inventory-client tests) and will be covered end-to-end in Wave 5. This
+    // test verifies the guarantee cheaply using a small K so the suite stays fast.
+    it('IC-4: returned entry count equals the number of on-disk skills with no local cap applied', async () => {
+        const K = 4;
+        for (let i = 0; i < K; i++) {
+            await createSkill('claude-code', `skill-ic4-${i}`, { version: `1.0.${i}` });
+        }
+        const entries = await collectDeviceSkills();
+        const ic4 = entries.filter((e) => e.skill_id.startsWith('skill-ic4-'));
+        // The collector must not truncate: returned count must equal the on-disk count.
+        expect(ic4).toHaveLength(K);
+        // K is well below the server-enforced limit — no false ceiling here.
+        expect(K).toBeLessThan(INVENTORY_LIMITS.MAX_SKILLS);
+    });
+    it('IC-3: populates content_hash + version for readable SKILL.md, nulls for missing', async () => {
+        await createSkill('claude-code', 'withmd', { version: '3.1.4' });
+        await createSkill('cursor', 'nomd', { withSkillMd: false });
+        const entries = await collectDeviceSkills();
+        const withMd = entries.find((e) => e.skill_id === 'withmd');
+        const noMd = entries.find((e) => e.skill_id === 'nomd');
+        expect(withMd?.version).toBe('3.1.4');
+        expect(withMd?.content_hash).toMatch(/^[0-9a-f]{64}$/);
+        // A subdir with no readable SKILL.md still counts, keyed by its dir name.
+        expect(noMd).toBeDefined();
+        expect(noMd?.version).toBeNull();
+        expect(noMd?.content_hash).toBeNull();
+    });
+});
+//# sourceMappingURL=inventory-collector.test.js.map

package/dist/src/sync/inventory-collector.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-collector.test.js","sourceRoot":"","sources":["../../../src/sync/inventory-collector.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AACxE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAA;AACzE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,MAAM,SAAS,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAClC,UAAU,EAAE,CAAC,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAU;IAC/E,mBAAmB,EAAE,EAA4B;CAClD,CAAC,CAAC,CAAA;AAEH,EAAE,CAAC,IAAI,CAAC,qBAAqB,EAAE,GAAG,EAAE,CAAC,CAAC;IACpC,UAAU,EAAE,SAAS,CAAC,UAAU;IAChC,mBAAmB,EAAE,SAAS,CAAC,mBAAmB;CACnD,CAAC,CAAC,CAAA;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAC9D,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAEvD,SAAS,OAAO,CAAC,IAAY,EAAE,OAAgB;IAC7C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;IAC1D,OAAO,cAAc,IAAI,GAAG,WAAW,cAAc,IAAI,IAAI,CAAA;AAC/D,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAe,EACf,IAAY,EACZ,OAAoD,EAAE;IAEtD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,OAAO,CAAW,EAAE,IAAI,CAAC,CAAA;IACxE,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACrC,IAAI,IAAI,CAAC,WAAW,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;IACrE,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,IAAI,IAAY,CAAA;AAEhB,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAA;QACtD,uEAAuE;QACvE,KAAK,MAAM,EAAE,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;YACtC,SAAS,CAAC,mBAAmB,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACpD,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,EAAE,CAAC,eAAe,EAAE,CAAA;IACtB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC7D,MAAM,WAAW,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAExD,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;QAEvD,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAA;QAC3E,6EAA6E;QAC7E,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvE,0DAA0D;QAC1D,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnF,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC/D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,aAAa,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAC1E,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACnF,MAAM,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,QAAQ,CAAW,EAAE,KAAK,CAAC,EAAE,KAAK,CAAC,CAAA;QAE1F,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAA;QAEvD,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,mEAAmE;QACnE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC7C,CAAC,CAAC,CAAA;IAEF,8CAA8C;IAC9C,EAAE;IACF,4EAA4E;IAC5E,gFAAgF;IAChF,8EAA8E;IAC9E,+EAA+E;IAC/E,EAAE,CAAC,0FAA0F,EAAE,KAAK,IAAI,EAAE;QACxG,MAAM,CAAC,GAAG,CAAC,CAAA;QACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,WAAW,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,CAAA;QAC7E,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAA;QAEtE,gFAAgF;QAChF,MAAM,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAC3B,qEAAqE;QACrE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAA;IACrD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,WAAW,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;QAChE,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAA;QAE3D,MAAM,OAAO,GAAG,MAAM,mBAAmB,EAAE,CAAA;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAA;QAC3D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;QAEvD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACrC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAEtD,0EAA0E;QAC1E,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAA;QAC1B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAA;QAChC,MAAM,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAA;IACvC,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/sync/inventory-device.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Device-identity builder for the cross-harness inventory payload
+ * (SMI-5392, umbrella SMI-5382).
+ *
+ * Produces the {@link InventoryDevice} half of an {@link InventoryUploadPayload}.
+ * Field minimization follows ADR-124: the raw hostname is NEVER sent by default
+ * (`hostname_display` is `null` this wave); only a salt-free sha256 `hostname_hash`
+ * is included as a soft duplicate-device hint. The hash is not trivially
+ * reversible, but a low-entropy hostname is dictionary-recoverable — this is
+ * acceptable per ADR-124 because the hash is scoped to the user's own
+ * authenticated account, never exposed cross-tenant.
+ *
+ * @module @skillsmith/core/sync/inventory-device
+ */
+import { type InventoryDevice } from './inventory-types.js';
+/** Options accepted by {@link buildInventoryDevice}. */
+export interface BuildInventoryDeviceOptions {
+    /** Skillsmith CLI version that produced the snapshot (defaults to `null`). */
+    cliVersion?: string | null;
+}
+/**
+ * Build the {@link InventoryDevice} descriptor for this machine.
+ *
+ * - `device_id` is the stable client-generated UUID (created on first call).
+ * - `label` is the user's optional device label from `~/.skillsmith/config.json`
+ *   (`inventory.deviceLabel`); there is no dedicated getter in `device-identity`,
+ *   so it is read directly from config and capped to `LABEL_MAX`.
+ * - `hostname_display` is always `null` this wave (ADR-124 minimization).
+ * - `hostname_hash` is the sha256 hex of `os.hostname()` — a soft duplicate hint.
+ *
+ * @param opts - Optional CLI version to stamp on the snapshot.
+ * @returns A fully-minimized device descriptor.
+ * @see SMI-5392
+ */
+export declare function buildInventoryDevice(opts?: BuildInventoryDeviceOptions): InventoryDevice;
+//# sourceMappingURL=inventory-device.d.ts.map

package/dist/src/sync/inventory-device.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-device.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-device.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,EAAoB,KAAK,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE7E,wDAAwD;AACxD,MAAM,WAAW,2BAA2B;IAC1C,8EAA8E;IAC9E,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAYD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,2BAA2B,GAAG,eAAe,CAcxF"}

package/dist/src/sync/inventory-device.js

@@ -0,0 +1,58 @@
+/**
+ * Device-identity builder for the cross-harness inventory payload
+ * (SMI-5392, umbrella SMI-5382).
+ *
+ * Produces the {@link InventoryDevice} half of an {@link InventoryUploadPayload}.
+ * Field minimization follows ADR-124: the raw hostname is NEVER sent by default
+ * (`hostname_display` is `null` this wave); only a salt-free sha256 `hostname_hash`
+ * is included as a soft duplicate-device hint. The hash is not trivially
+ * reversible, but a low-entropy hostname is dictionary-recoverable — this is
+ * acceptable per ADR-124 because the hash is scoped to the user's own
+ * authenticated account, never exposed cross-tenant.
+ *
+ * @module @skillsmith/core/sync/inventory-device
+ */
+import { hostname } from 'node:os';
+import { createHash } from 'node:crypto';
+import { getOrCreateDeviceId } from '../config/device-identity.js';
+import { loadConfig } from '../config/index.js';
+import { INVENTORY_LIMITS } from './inventory-types.js';
+/**
+ * Truncate `value` to at most `max` characters, returning `null` for nullish
+ * input. Guards every length-capped column so a malformed local value can't
+ * trip a DB CHECK constraint mid-reconcile.
+ */
+function capped(value, max) {
+    if (value == null)
+        return null;
+    return value.length > max ? value.slice(0, max) : value;
+}
+/**
+ * Build the {@link InventoryDevice} descriptor for this machine.
+ *
+ * - `device_id` is the stable client-generated UUID (created on first call).
+ * - `label` is the user's optional device label from `~/.skillsmith/config.json`
+ *   (`inventory.deviceLabel`); there is no dedicated getter in `device-identity`,
+ *   so it is read directly from config and capped to `LABEL_MAX`.
+ * - `hostname_display` is always `null` this wave (ADR-124 minimization).
+ * - `hostname_hash` is the sha256 hex of `os.hostname()` — a soft duplicate hint.
+ *
+ * @param opts - Optional CLI version to stamp on the snapshot.
+ * @returns A fully-minimized device descriptor.
+ * @see SMI-5392
+ */
+export function buildInventoryDevice(opts) {
+    const deviceId = getOrCreateDeviceId();
+    const deviceLabel = loadConfig().inventory?.deviceLabel;
+    const hostnameHash = createHash('sha256').update(hostname(), 'utf8').digest('hex');
+    return {
+        device_id: deviceId,
+        label: capped(deviceLabel, INVENTORY_LIMITS.LABEL_MAX),
+        hostname_display: null,
+        hostname_hash: capped(hostnameHash, INVENTORY_LIMITS.HOSTNAME_HASH_MAX),
+        platform: capped(process.platform, INVENTORY_LIMITS.PLATFORM_MAX),
+        arch: capped(process.arch, INVENTORY_LIMITS.ARCH_MAX),
+        cli_version: capped(opts?.cliVersion, INVENTORY_LIMITS.CLI_VERSION_MAX),
+    };
+}
+//# sourceMappingURL=inventory-device.js.map

package/dist/src/sync/inventory-device.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-device.js","sourceRoot":"","sources":["../../../src/sync/inventory-device.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAA;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,EAAE,gBAAgB,EAAwB,MAAM,sBAAsB,CAAA;AAQ7E;;;;GAIG;AACH,SAAS,MAAM,CAAC,KAAgC,EAAE,GAAW;IAC3D,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,IAAI,CAAA;IAC9B,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;AACzD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAkC;IACrE,MAAM,QAAQ,GAAG,mBAAmB,EAAE,CAAA;IACtC,MAAM,WAAW,GAAG,UAAU,EAAE,CAAC,SAAS,EAAE,WAAW,CAAA;IACvD,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAElF,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,gBAAgB,CAAC,SAAS,CAAC;QACtD,gBAAgB,EAAE,IAAI;QACtB,aAAa,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,iBAAiB,CAAC;QACvE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,gBAAgB,CAAC,YAAY,CAAC;QACjE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,gBAAgB,CAAC,QAAQ,CAAC;QACrD,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,EAAE,gBAAgB,CAAC,eAAe,CAAC;KACxE,CAAA;AACH,CAAC"}

package/dist/src/sync/inventory-push.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Inventory push orchestrator (SMI-5392, umbrella SMI-5382).
+ *
+ * The single entry point both the CLI command and the MCP tool call to push this
+ * device's inventory. Wires together the local opt-out gate, the payload builder,
+ * the upload client, and the auto-push throttle.
+ *
+ * @module @skillsmith/core/sync/inventory-push
+ */
+import type { BuildInventoryDeviceOptions } from './inventory-device.js';
+import type { InventoryUploadResult } from './inventory-types.js';
+/** Options accepted by {@link pushInventory}. */
+export type PushInventoryOptions = BuildInventoryDeviceOptions;
+/** Options accepted by {@link maybeAutoPush}. */
+export interface MaybeAutoPushOptions extends BuildInventoryDeviceOptions {
+    /** Injectable clock for deterministic throttle tests (defaults to `Date.now()`). */
+    now?: number;
+}
+/**
+ * Build and upload this device's inventory snapshot.
+ *
+ * When the local opt-out flag (`SKILLSMITH_INVENTORY_DISABLE`) is set, this is a
+ * pure no-op: NO network call, and NO device-id creation. On a server-applied
+ * upload, the last-push timestamp is persisted for the auto-push throttle. A
+ * consent-off `{ applied: false, reason: 'consent_disabled' }` result is returned
+ * as-is and does NOT advance the throttle (so consent re-enablement pushes promptly).
+ *
+ * @param opts - Optional CLI version to stamp on the snapshot.
+ * @returns The upload result (or the local-disable no-op).
+ * @see SMI-5392
+ */
+export declare function pushInventory(opts?: PushInventoryOptions): Promise<InventoryUploadResult>;
+/**
+ * Auto-push entry point for the session-start hook.
+ *
+ * Returns `null` (without pushing) when sync is locally disabled or the throttle
+ * window has not elapsed. Upload errors are SWALLOWED — an auto-push must never
+ * throw into a session hook — logged to `console.error` and reported as `null`.
+ *
+ * @param opts - Optional CLI version + injectable clock.
+ * @returns The upload result, or `null` when skipped / throttled / errored.
+ * @see SMI-5392
+ */
+export declare function maybeAutoPush(opts?: MaybeAutoPushOptions): Promise<InventoryUploadResult | null>;
+//# sourceMappingURL=inventory-push.d.ts.map

package/dist/src/sync/inventory-push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-push.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-push.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAUH,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAA;AACxE,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAEjE,iDAAiD;AACjD,MAAM,MAAM,oBAAoB,GAAG,2BAA2B,CAAA;AAE9D,iDAAiD;AACjD,MAAM,WAAW,oBAAqB,SAAQ,2BAA2B;IACvE,oFAAoF;IACpF,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,aAAa,CAAC,IAAI,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAa/F;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,aAAa,CACjC,IAAI,CAAC,EAAE,oBAAoB,GAC1B,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAYvC"}

package/dist/src/sync/inventory-push.js

@@ -0,0 +1,62 @@
+/**
+ * Inventory push orchestrator (SMI-5392, umbrella SMI-5382).
+ *
+ * The single entry point both the CLI command and the MCP tool call to push this
+ * device's inventory. Wires together the local opt-out gate, the payload builder,
+ * the upload client, and the auto-push throttle.
+ *
+ * @module @skillsmith/core/sync/inventory-push
+ */
+import { getLastInventoryPushAt, isInventorySyncDisabledLocally, recordInventoryPush, shouldAutoPush, } from '../config/device-identity.js';
+import { buildInventoryPayload } from './inventory-builder.js';
+import { uploadInventory } from './inventory-client.js';
+/**
+ * Build and upload this device's inventory snapshot.
+ *
+ * When the local opt-out flag (`SKILLSMITH_INVENTORY_DISABLE`) is set, this is a
+ * pure no-op: NO network call, and NO device-id creation. On a server-applied
+ * upload, the last-push timestamp is persisted for the auto-push throttle. A
+ * consent-off `{ applied: false, reason: 'consent_disabled' }` result is returned
+ * as-is and does NOT advance the throttle (so consent re-enablement pushes promptly).
+ *
+ * @param opts - Optional CLI version to stamp on the snapshot.
+ * @returns The upload result (or the local-disable no-op).
+ * @see SMI-5392
+ */
+export async function pushInventory(opts) {
+    if (isInventorySyncDisabledLocally()) {
+        return { ok: true, applied: false, reason: 'disabled_locally' };
+    }
+    const payload = await buildInventoryPayload(opts);
+    const result = await uploadInventory(payload);
+    if (result.applied) {
+        recordInventoryPush(new Date().toISOString());
+    }
+    return result;
+}
+/**
+ * Auto-push entry point for the session-start hook.
+ *
+ * Returns `null` (without pushing) when sync is locally disabled or the throttle
+ * window has not elapsed. Upload errors are SWALLOWED — an auto-push must never
+ * throw into a session hook — logged to `console.error` and reported as `null`.
+ *
+ * @param opts - Optional CLI version + injectable clock.
+ * @returns The upload result, or `null` when skipped / throttled / errored.
+ * @see SMI-5392
+ */
+export async function maybeAutoPush(opts) {
+    if (isInventorySyncDisabledLocally())
+        return null;
+    const now = opts?.now ?? Date.now();
+    if (!shouldAutoPush(now, getLastInventoryPushAt()))
+        return null;
+    try {
+        return await pushInventory(opts);
+    }
+    catch (error) {
+        console.error('[skillsmith] inventory auto-push failed:', error);
+        return null;
+    }
+}
+//# sourceMappingURL=inventory-push.js.map

package/dist/src/sync/inventory-push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-push.js","sourceRoot":"","sources":["../../../src/sync/inventory-push.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,mBAAmB,EACnB,cAAc,GACf,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAA;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAavD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA2B;IAC7D,IAAI,8BAA8B,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;IACjE,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,qBAAqB,CAAC,IAAI,CAAC,CAAA;IACjD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;IAE7C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,mBAAmB,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAA2B;IAE3B,IAAI,8BAA8B,EAAE;QAAE,OAAO,IAAI,CAAA;IAEjD,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAA;IACnC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,sBAAsB,EAAE,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/D,IAAI,CAAC;QACH,OAAO,MAAM,aAAa,CAAC,IAAI,CAAC,CAAA;IAClC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,KAAK,CAAC,CAAA;QAChE,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/src/sync/inventory-push.test.d.ts

@@ -0,0 +1,16 @@
+/**
+ * inventory-push tests (SMI-5392).
+ *
+ * Mocks the payload builder and upload client; keeps the real (pure)
+ * `isInventorySyncDisabledLocally` + `shouldAutoPush` so the env-flag and
+ * throttle paths exercise production logic, while `recordInventoryPush` and
+ * `getLastInventoryPushAt` are stubbed for observation/control.
+ *
+ * IP-1: SKILLSMITH_INVENTORY_DISABLE set -> disabled_locally no-op, no upload.
+ * IP-2: applied result -> recordInventoryPush called.
+ * IP-3: consent-off result -> recordInventoryPush NOT called.
+ * IP-4: maybeAutoPush throttled (recent lastPushAt) -> null without pushing.
+ * IP-5: maybeAutoPush swallows an upload error and returns null.
+ */
+export {};
+//# sourceMappingURL=inventory-push.test.d.ts.map

package/dist/src/sync/inventory-push.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-push.test.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-push.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG"}