@skillsmith/core 0.8.2 → 0.9.0

package/dist/src/sync/inventory-client.js

@@ -0,0 +1,150 @@
+/**
+ * Inventory upload HTTP client (SMI-5392, umbrella SMI-5382).
+ *
+ * Authenticates with the stored device-login session (JWT + refresh) and POSTs a
+ * full inventory snapshot to the gateway-verified `inventory-upload` edge
+ * function. Maps the edge function's status codes onto typed errors so callers
+ * (CLI command, MCP tool) can render precise, actionable messages.
+ *
+ * @module @skillsmith/core/sync/inventory-client
+ */
+import { loadCredentials, refreshAccessToken, storeCredentials, } from '../config/token-credentials.js';
+import { DEFAULT_BASE_URL, PRODUCTION_ANON_KEY } from '../api/utils.js';
+/**
+ * No usable session (no stored credentials, or a refresh that failed). The
+ * message hints at the recovery action so the CLI/MCP surface can relay it.
+ *
+ * @see SMI-5392
+ */
+export class InventoryAuthError extends Error {
+    constructor(message = 'Not authenticated. Run `skillsmith login` and try again.') {
+        super(message);
+        this.name = 'InventoryAuthError';
+    }
+}
+/**
+ * The `device_id` is already owned by another user (HTTP 409). The user must
+ * forget the local device and re-register before retrying.
+ *
+ * @see SMI-5392
+ */
+export class InventoryConflictError extends Error {
+    constructor(message = 'device_conflict') {
+        super(message);
+        this.name = 'InventoryConflictError';
+    }
+}
+/**
+ * The server rejected the payload as malformed (HTTP 400) — e.g.
+ * `device_id_required`, `too_many_skills`, or an invalid field.
+ *
+ * @see SMI-5392
+ */
+export class InventoryValidationError extends Error {
+    constructor(message = 'invalid payload') {
+        super(message);
+        this.name = 'InventoryValidationError';
+    }
+}
+/**
+ * Catch-all for transport failures and unexpected server responses (HTTP 5xx,
+ * network errors, unparseable bodies).
+ *
+ * @see SMI-5392
+ */
+export class InventoryUploadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'InventoryUploadError';
+    }
+}
+/** Refresh the access token this many ms before it actually expires. */
+const TOKEN_REFRESH_SKEW_MS = 60_000;
+/**
+ * Resolve a fresh access token, refreshing (and persisting) if the stored one is
+ * within {@link TOKEN_REFRESH_SKEW_MS} of expiry.
+ *
+ * @throws {InventoryAuthError} When no credentials exist or the refresh fails.
+ */
+async function resolveAccessToken() {
+    const creds = await loadCredentials();
+    if (!creds)
+        throw new InventoryAuthError();
+    if (creds.expiresAt <= Date.now() + TOKEN_REFRESH_SKEW_MS) {
+        const refreshed = await refreshAccessToken(creds.refreshToken);
+        if (!refreshed)
+            throw new InventoryAuthError();
+        await storeCredentials(refreshed);
+        return refreshed.accessToken;
+    }
+    return creds.accessToken;
+}
+/**
+ * Best-effort extraction of the server's `{ error: string }` body so a typed
+ * error can carry the precise server message. Returns `null` when the body is
+ * absent or not JSON.
+ */
+async function readServerError(res) {
+    try {
+        const body = (await res.json());
+        return typeof body.error === 'string' ? body.error : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Upload a full inventory snapshot for this device.
+ *
+ * A `200` response is returned verbatim — this INCLUDES the consent-off no-op
+ * `{ ok: true, applied: false, reason: 'consent_disabled' }`, which is a success,
+ * not an error.
+ *
+ * @param payload - The device + skills snapshot to upload.
+ * @returns The edge function's {@link InventoryUploadResult}.
+ * @throws {InventoryAuthError} HTTP 401, or no/expired session.
+ * @throws {InventoryConflictError} HTTP 409 (device owned by another user).
+ * @throws {InventoryValidationError} HTTP 400 (malformed / oversized payload).
+ * @throws {InventoryUploadError} HTTP 5xx, network failure, or unparseable 200 body.
+ * @see SMI-5392
+ */
+export async function uploadInventory(payload) {
+    const accessToken = await resolveAccessToken();
+    let res;
+    try {
+        res = await fetch(`${DEFAULT_BASE_URL}/inventory-upload`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                apikey: PRODUCTION_ANON_KEY,
+                Authorization: `Bearer ${accessToken}`,
+            },
+            body: JSON.stringify(payload),
+        });
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new InventoryUploadError(`Inventory upload request failed: ${detail}`);
+    }
+    if (res.ok) {
+        try {
+            return (await res.json());
+        }
+        catch (error) {
+            const detail = error instanceof Error ? error.message : String(error);
+            throw new InventoryUploadError(`Inventory upload returned an unreadable body: ${detail}`);
+        }
+    }
+    const serverError = await readServerError(res);
+    switch (res.status) {
+        case 401:
+            throw new InventoryAuthError();
+        case 409:
+            throw new InventoryConflictError(serverError ?? 'device_conflict');
+        case 400:
+            throw new InventoryValidationError(serverError ?? 'invalid payload');
+        default:
+            throw new InventoryUploadError(`Inventory upload failed (HTTP ${res.status})${serverError ? `: ${serverError}` : ''}`);
+    }
+}
+//# sourceMappingURL=inventory-client.js.map

package/dist/src/sync/inventory-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-client.js","sourceRoot":"","sources":["../../../src/sync/inventory-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGvE;;;;;GAKG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,OAAO,GAAG,0DAA0D;QAC9E,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,OAAO,GAAG,iBAAiB;QACrC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,iBAAiB;QACrC,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED,wEAAwE;AACxE,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAEpC;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB;IAC/B,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAA;IACrC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;IAE1C,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,qBAAqB,EAAE,CAAC;QAC1D,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAA;QAC9D,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,kBAAkB,EAAE,CAAA;QAC9C,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAA;QACjC,OAAO,SAAS,CAAC,WAAW,CAAA;IAC9B,CAAC;IAED,OAAO,KAAK,CAAC,WAAW,CAAA;AAC1B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,GAAa;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwB,CAAA;QACtD,OAAO,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA+B;IAE/B,MAAM,WAAW,GAAG,MAAM,kBAAkB,EAAE,CAAA;IAE9C,IAAI,GAAa,CAAA;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,gBAAgB,mBAAmB,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,MAAM,EAAE,mBAAmB;gBAC3B,aAAa,EAAE,UAAU,WAAW,EAAE;aACvC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;SAC9B,CAAC,CAAA;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QACrE,MAAM,IAAI,oBAAoB,CAAC,oCAAoC,MAAM,EAAE,CAAC,CAAA;IAC9E,CAAC;IAED,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAA;QACpD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACrE,MAAM,IAAI,oBAAoB,CAAC,iDAAiD,MAAM,EAAE,CAAC,CAAA;QAC3F,CAAC;IACH,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAA;IAC9C,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;QACnB,KAAK,GAAG;YACN,MAAM,IAAI,kBAAkB,EAAE,CAAA;QAChC,KAAK,GAAG;YACN,MAAM,IAAI,sBAAsB,CAAC,WAAW,IAAI,iBAAiB,CAAC,CAAA;QACpE,KAAK,GAAG;YACN,MAAM,IAAI,wBAAwB,CAAC,WAAW,IAAI,iBAAiB,CAAC,CAAA;QACtE;YACE,MAAM,IAAI,oBAAoB,CAC5B,iCAAiC,GAAG,CAAC,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACvF,CAAA;IACL,CAAC;AACH,CAAC"}

package/dist/src/sync/inventory-client.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * inventory-client tests (SMI-5392).
+ *
+ * Mocks the token-credentials module and global fetch.
+ *
+ * UC-1: no credentials -> InventoryAuthError, no fetch.
+ * UC-2: expired credentials -> refresh path runs, new creds stored, new token used.
+ * UC-3: expired credentials + failed refresh -> InventoryAuthError.
+ * UC-4: 200 body returned verbatim (incl. the consent-off no-op).
+ * UC-5: 401 / 409 / 400 / 500 -> the matching typed error.
+ * UC-6: network throw -> InventoryUploadError.
+ */
+export {};
+//# sourceMappingURL=inventory-client.test.d.ts.map

package/dist/src/sync/inventory-client.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-client.test.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-client.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/src/sync/inventory-client.test.js

@@ -0,0 +1,146 @@
+/**
+ * inventory-client tests (SMI-5392).
+ *
+ * Mocks the token-credentials module and global fetch.
+ *
+ * UC-1: no credentials -> InventoryAuthError, no fetch.
+ * UC-2: expired credentials -> refresh path runs, new creds stored, new token used.
+ * UC-3: expired credentials + failed refresh -> InventoryAuthError.
+ * UC-4: 200 body returned verbatim (incl. the consent-off no-op).
+ * UC-5: 401 / 409 / 400 / 500 -> the matching typed error.
+ * UC-6: network throw -> InventoryUploadError.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+vi.mock('../config/token-credentials.js', () => ({
+    loadCredentials: vi.fn(),
+    refreshAccessToken: vi.fn(),
+    storeCredentials: vi.fn(),
+}));
+import { loadCredentials, refreshAccessToken, storeCredentials, } from '../config/token-credentials.js';
+import { uploadInventory, InventoryAuthError, InventoryConflictError, InventoryValidationError, InventoryUploadError, } from './inventory-client.js';
+const fetchMock = vi.fn();
+const payload = {
+    device: { device_id: '11111111-1111-4111-8111-111111111111' },
+    skills: [],
+};
+function jsonResponse(body, status) {
+    return new Response(JSON.stringify(body), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+    });
+}
+const futureCreds = {
+    accessToken: 'at_valid',
+    refreshToken: 'rt_valid',
+    expiresAt: Date.now() + 3_600_000,
+    version: 2,
+};
+describe('inventory-client', () => {
+    beforeEach(() => {
+        vi.clearAllMocks();
+        vi.stubGlobal('fetch', fetchMock);
+    });
+    afterEach(() => {
+        vi.unstubAllGlobals();
+    });
+    it('UC-1: throws InventoryAuthError when no credentials are stored', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(null);
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryAuthError);
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+    it('UC-2: refreshes + stores when the access token is near expiry, then uses the new token', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'at_expired',
+            refreshToken: 'rt_old',
+            expiresAt: Date.now() - 1_000,
+            version: 2,
+        });
+        vi.mocked(refreshAccessToken).mockResolvedValue({
+            accessToken: 'at_new',
+            refreshToken: 'rt_new',
+            expiresAt: Date.now() + 3_600_000,
+            version: 2,
+        });
+        fetchMock.mockResolvedValue(jsonResponse({ ok: true, applied: true, device_id: 'd' }, 200));
+        const result = await uploadInventory(payload);
+        expect(refreshAccessToken).toHaveBeenCalledWith('rt_old');
+        expect(storeCredentials).toHaveBeenCalledWith(expect.objectContaining({ accessToken: 'at_new', version: 2 }));
+        expect(fetchMock).toHaveBeenCalledWith(expect.stringContaining('/inventory-upload'), expect.objectContaining({
+            method: 'POST',
+            headers: expect.objectContaining({ Authorization: 'Bearer at_new' }),
+        }));
+        expect(result.applied).toBe(true);
+    });
+    it('UC-3: throws InventoryAuthError when the refresh fails', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue({
+            accessToken: 'at_expired',
+            refreshToken: 'rt_old',
+            expiresAt: Date.now() - 1_000,
+            version: 2,
+        });
+        vi.mocked(refreshAccessToken).mockResolvedValue(null);
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryAuthError);
+        expect(fetchMock).not.toHaveBeenCalled();
+    });
+    it('UC-4: returns the 200 body verbatim, including the consent-off no-op', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        const consentOff = { ok: true, applied: false, reason: 'consent_disabled' };
+        fetchMock.mockResolvedValue(jsonResponse(consentOff, 200));
+        const result = await uploadInventory(payload);
+        expect(result).toEqual(consentOff);
+        expect(refreshAccessToken).not.toHaveBeenCalled();
+    });
+    it('UC-5a: maps 401 to InventoryAuthError', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        fetchMock.mockResolvedValue(jsonResponse({ error: 'authentication_required' }, 401));
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryAuthError);
+    });
+    it('UC-5b: maps 409 to InventoryConflictError', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        fetchMock.mockResolvedValue(jsonResponse({ error: 'device_conflict' }, 409));
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryConflictError);
+    });
+    it('UC-5c: maps 400 to InventoryValidationError carrying the server message', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        fetchMock.mockResolvedValue(jsonResponse({ error: 'too_many_skills' }, 400));
+        // Single call: the mocked Response body can only be read once.
+        const error = await uploadInventory(payload).catch((e) => e);
+        expect(error).toBeInstanceOf(InventoryValidationError);
+        expect(error.message).toBe('too_many_skills');
+    });
+    it('UC-5d: maps 500 to InventoryUploadError', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        fetchMock.mockResolvedValue(jsonResponse({ error: 'server_error' }, 500));
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryUploadError);
+    });
+    it('UC-6: wraps a network throw in InventoryUploadError', async () => {
+        vi.mocked(loadCredentials).mockResolvedValue(futureCreds);
+        fetchMock.mockRejectedValue(new Error('ECONNREFUSED'));
+        await expect(uploadInventory(payload)).rejects.toBeInstanceOf(InventoryUploadError);
+    });
+    // Security invariant: tokens must never appear in error message strings.
+    // Covers both the non-200 response path and the network-throw path.
+    it('UC-7: error messages do not leak access tokens or refresh tokens (security invariant)', async () => {
+        const sentinelCreds = {
+            accessToken: 'at_SECRET_5392',
+            refreshToken: 'rt_SECRET_5392',
+            expiresAt: Date.now() + 3_600_000,
+            version: 2,
+        };
+        // Non-200 path: 500 → InventoryUploadError whose message must not contain tokens.
+        vi.mocked(loadCredentials).mockResolvedValue(sentinelCreds);
+        fetchMock.mockResolvedValue(jsonResponse({ error: 'server_error' }, 500));
+        const err500 = await uploadInventory(payload).catch((e) => e);
+        expect(err500).toBeInstanceOf(InventoryUploadError);
+        expect(err500.message).not.toContain('at_SECRET_5392');
+        expect(err500.message).not.toContain('rt_SECRET_5392');
+        // Network-throw path: fetch rejects → InventoryUploadError whose message must not contain tokens.
+        vi.mocked(loadCredentials).mockResolvedValue(sentinelCreds);
+        fetchMock.mockRejectedValue(new Error('ECONNREFUSED'));
+        const errNet = await uploadInventory(payload).catch((e) => e);
+        expect(errNet).toBeInstanceOf(InventoryUploadError);
+        expect(errNet.message).not.toContain('at_SECRET_5392');
+        expect(errNet.message).not.toContain('rt_SECRET_5392');
+    });
+});
+//# sourceMappingURL=inventory-client.test.js.map

package/dist/src/sync/inventory-client.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-client.test.js","sourceRoot":"","sources":["../../../src/sync/inventory-client.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAA;AAExE,EAAE,CAAC,IAAI,CAAC,gCAAgC,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,eAAe,EAAE,EAAE,CAAC,EAAE,EAAE;IACxB,kBAAkB,EAAE,EAAE,CAAC,EAAE,EAAE;IAC3B,gBAAgB,EAAE,EAAE,CAAC,EAAE,EAAE;CAC1B,CAAC,CAAC,CAAA;AAEH,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,wBAAwB,EACxB,oBAAoB,GACrB,MAAM,uBAAuB,CAAA;AAG9B,MAAM,SAAS,GAAG,EAAE,CAAC,EAAE,EAAgB,CAAA;AAEvC,MAAM,OAAO,GAA2B;IACtC,MAAM,EAAE,EAAE,SAAS,EAAE,sCAAsC,EAAE;IAC7D,MAAM,EAAE,EAAE;CACX,CAAA;AAED,SAAS,YAAY,CAAC,IAAa,EAAE,MAAc;IACjD,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;QACxC,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,MAAM,WAAW,GAAG;IAClB,WAAW,EAAE,UAAU;IACvB,YAAY,EAAE,UAAU;IACxB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;IACjC,OAAO,EAAE,CAAU;CACpB,CAAA;AAED,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,CAAC,aAAa,EAAE,CAAA;QAClB,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,SAAS,CAAC,GAAG,EAAE;QACb,EAAE,CAAC,gBAAgB,EAAE,CAAA;IACvB,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,gEAAgE,EAAE,KAAK,IAAI,EAAE;QAC9E,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAElD,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAA;QACjF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,YAAY;YACzB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC;YAC9C,WAAW,EAAE,QAAQ;YACrB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAE3F,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;QAE7C,MAAM,CAAC,kBAAkB,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAA;QACzD,MAAM,CAAC,gBAAgB,CAAC,CAAC,oBAAoB,CAC3C,MAAM,CAAC,gBAAgB,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAC/D,CAAA;QACD,MAAM,CAAC,SAAS,CAAC,CAAC,oBAAoB,CACpC,MAAM,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAC5C,MAAM,CAAC,gBAAgB,CAAC;YACtB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC;SACrE,CAAC,CACH,CAAA;QACD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACnC,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC;YAC3C,WAAW,EAAE,YAAY;YACzB,YAAY,EAAE,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC7B,OAAO,EAAE,CAAC;SACX,CAAC,CAAA;QACF,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAA;QAErD,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAA;QACjF,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IAC1C,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,sEAAsE,EAAE,KAAK,IAAI,EAAE;QACpF,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,MAAM,UAAU,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAA;QAC3E,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAA;QAE1D,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAA;QAE7C,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;QAClC,MAAM,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAA;IACnD,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,uCAAuC,EAAE,KAAK,IAAI,EAAE;QACrD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAEpF,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,kBAAkB,CAAC,CAAA;IACnF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAE5E,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAA;IACvF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yEAAyE,EAAE,KAAK,IAAI,EAAE;QACvF,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAE5E,+DAA+D;QAC/D,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;QACrE,MAAM,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,wBAAwB,CAAC,CAAA;QACtD,MAAM,CAAE,KAAe,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IAC1D,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,yCAAyC,EAAE,KAAK,IAAI,EAAE;QACvD,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAEzE,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,EAAE,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;QACnE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAA;QACzD,SAAS,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;QAEtD,MAAM,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;IACrF,CAAC,CAAC,CAAA;IAEF,yEAAyE;IACzE,oEAAoE;IACpE,EAAE,CAAC,uFAAuF,EAAE,KAAK,IAAI,EAAE;QACrG,MAAM,aAAa,GAAG;YACpB,WAAW,EAAE,gBAAgB;YAC7B,YAAY,EAAE,gBAAgB;YAC9B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;YACjC,OAAO,EAAE,CAAU;SACpB,CAAA;QAED,kFAAkF;QAClF,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;QAC3D,SAAS,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC,CAAA;QAEzE,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;QACtE,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;QACnD,MAAM,CAAE,MAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QACjE,MAAM,CAAE,MAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QAEjE,kGAAkG;QAClG,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;QAC3D,SAAS,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAA;QAEtD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;QACtE,MAAM,CAAC,MAAM,CAAC,CAAC,cAAc,CAAC,oBAAoB,CAAC,CAAA;QACnD,MAAM,CAAE,MAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;QACjE,MAAM,CAAE,MAAgB,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAA;IACnE,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/dist/src/sync/inventory-collector.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Cross-harness skill collector (SMI-5392, umbrella SMI-5382).
+ *
+ * Walks every known harness skill directory (`CLIENT_NATIVE_PATHS`) and emits
+ * one {@link InventorySkillEntry} per (harness, skill) observed on disk. This is
+ * the shared scanner that both the CLI `inventory push` command (Wave 3) and the
+ * MCP inventory tool call before handing the snapshot to {@link uploadInventory}.
+ *
+ * Design parity with the CLI scanner at
+ * `packages/cli/src/utils/skills-directory.ts`:
+ * - Uses the SAME {@link SkillParser} to resolve `skill_id` / `version`.
+ * - Realpath-deduplicates ACROSS harnesses (collapses symlink aliases), but does
+ *   NOT name-deduplicate — the same skill independently installed under two
+ *   harnesses is two distinct rows (the `device_skills` PK is `(harness, skill_id)`).
+ *
+ * @module @skillsmith/core/sync/inventory-collector
+ */
+import type { InventorySkillEntry } from './inventory-types.js';
+/**
+ * Collect every harness-installed skill on this device as inventory entries.
+ *
+ * Scans each harness in {@link CLIENT_IDS} order. Repo-local `./.claude/skills`
+ * is intentionally excluded — inventory tracks harness-installed skills only, and
+ * `harness` is always a {@link ClientId}, never `'local'`.
+ *
+ * The result is NOT truncated to `INVENTORY_LIMITS.MAX_SKILLS`. Exceeding
+ * the cap is a real condition the caller / edge function must enforce (returning
+ * a `too_many_skills` 400) — silently dropping skills here would corrupt the
+ * server-side reconcile by making present skills look absent.
+ *
+ * @returns One entry per (harness, skill), realpath-deduplicated across harnesses.
+ * @see SMI-5392
+ */
+export declare function collectDeviceSkills(): Promise<InventorySkillEntry[]>;
+//# sourceMappingURL=inventory-collector.d.ts.map

package/dist/src/sync/inventory-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-collector.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAQH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAA;AAoH/D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAO1E"}

package/dist/src/sync/inventory-collector.js

@@ -0,0 +1,149 @@
+/**
+ * Cross-harness skill collector (SMI-5392, umbrella SMI-5382).
+ *
+ * Walks every known harness skill directory (`CLIENT_NATIVE_PATHS`) and emits
+ * one {@link InventorySkillEntry} per (harness, skill) observed on disk. This is
+ * the shared scanner that both the CLI `inventory push` command (Wave 3) and the
+ * MCP inventory tool call before handing the snapshot to {@link uploadInventory}.
+ *
+ * Design parity with the CLI scanner at
+ * `packages/cli/src/utils/skills-directory.ts`:
+ * - Uses the SAME {@link SkillParser} to resolve `skill_id` / `version`.
+ * - Realpath-deduplicates ACROSS harnesses (collapses symlink aliases), but does
+ *   NOT name-deduplicate — the same skill independently installed under two
+ *   harnesses is two distinct rows (the `device_skills` PK is `(harness, skill_id)`).
+ *
+ * @module @skillsmith/core/sync/inventory-collector
+ */
+import { readdir, readFile, realpath, stat } from 'node:fs/promises';
+import { createHash } from 'node:crypto';
+import { join } from 'node:path';
+import { SkillParser } from '../indexer/SkillParser.js';
+import { CLIENT_IDS, CLIENT_NATIVE_PATHS } from '../install/paths.js';
+/**
+ * Resolve a path through `realpath` defensively. Returns the resolved path on
+ * success, or the input path unchanged when the link is broken / unreadable —
+ * dedup keying still works either way (we just can't collapse a broken alias).
+ */
+async function safeRealpath(path) {
+    try {
+        return await realpath(path);
+    }
+    catch {
+        return path;
+    }
+}
+/**
+ * Return `true` when a directory entry resolves to a directory, following
+ * symlinks. `withFileTypes` reports a symlinked directory as a symlink (not a
+ * directory), so symlinked aliases must be `stat`-resolved to be collected —
+ * which is exactly what makes the cross-harness realpath dedup observable.
+ */
+async function resolvesToDirectory(entryPath, isDirectory, isSymbolicLink) {
+    if (isDirectory)
+        return true;
+    if (!isSymbolicLink)
+        return false;
+    try {
+        return (await stat(entryPath)).isDirectory();
+    }
+    catch {
+        return false; // broken symlink
+    }
+}
+/**
+ * Read `<skillDir>/SKILL.md` and derive the inventory fields.
+ *
+ * - `content_hash` is the sha256 hex digest of the raw SKILL.md content. Wave 5
+ *   validates that this hashing stays drift-aligned with the indexer's hashing.
+ * - `skill_id` is the parsed `id` front-matter field, falling back to the parsed
+ *   `name`, then the directory name (same precedence as the CLI scanner).
+ * - A directory with no readable SKILL.md still counts as a skill: `skill_id` is
+ *   the directory name, with `version` and `content_hash` both `null`.
+ */
+async function readSkillFields(skillDir, dirName) {
+    try {
+        const content = await readFile(join(skillDir, 'SKILL.md'), 'utf-8');
+        const contentHash = createHash('sha256').update(content, 'utf8').digest('hex');
+        const parsed = new SkillParser().parse(content);
+        if (!parsed) {
+            // SKILL.md is readable but has no valid frontmatter — hash still applies.
+            return { skillId: dirName, version: null, contentHash };
+        }
+        // Match the CLI scanner: read `id` off the parsed metadata, then `name`.
+        const parsedId = parsed['id'];
+        return {
+            skillId: parsedId ?? parsed.name ?? dirName,
+            version: parsed.version ?? null,
+            contentHash,
+        };
+    }
+    catch {
+        // No readable SKILL.md — still a skill, but version/hash are unknown.
+        return { skillId: dirName, version: null, contentHash: null };
+    }
+}
+/**
+ * Scan a single harness directory and append its skills to `entries`,
+ * deduplicating by realpath via the shared `seenRealpaths` set.
+ */
+async function collectHarness(harness, entries, seenRealpaths) {
+    const harnessDir = CLIENT_NATIVE_PATHS[harness];
+    let dirents;
+    try {
+        dirents = await readdir(harnessDir, { withFileTypes: true });
+    }
+    catch (error) {
+        const code = error.code;
+        // Absent harness dir is the common case (harness not installed) — skip it.
+        if (code === 'ENOENT' || code === 'ENOTDIR')
+            return;
+        throw error;
+    }
+    for (const dirent of dirents) {
+        const entryPath = join(harnessDir, dirent.name);
+        if (!(await resolvesToDirectory(entryPath, dirent.isDirectory(), dirent.isSymbolicLink()))) {
+            continue;
+        }
+        // Realpath dedup ACROSS harnesses: the first harness in CLIENT_IDS order
+        // wins, so a symlinked alias under a later harness is collapsed away.
+        const realDir = await safeRealpath(entryPath);
+        if (seenRealpaths.has(realDir))
+            continue;
+        seenRealpaths.add(realDir);
+        const { skillId, version, contentHash } = await readSkillFields(entryPath, dirent.name);
+        entries.push({
+            harness,
+            skill_id: skillId,
+            version,
+            content_hash: contentHash,
+            source: null,
+            pinned_version: null,
+            update_policy: null,
+        });
+    }
+}
+/**
+ * Collect every harness-installed skill on this device as inventory entries.
+ *
+ * Scans each harness in {@link CLIENT_IDS} order. Repo-local `./.claude/skills`
+ * is intentionally excluded — inventory tracks harness-installed skills only, and
+ * `harness` is always a {@link ClientId}, never `'local'`.
+ *
+ * The result is NOT truncated to `INVENTORY_LIMITS.MAX_SKILLS`. Exceeding
+ * the cap is a real condition the caller / edge function must enforce (returning
+ * a `too_many_skills` 400) — silently dropping skills here would corrupt the
+ * server-side reconcile by making present skills look absent.
+ *
+ * @returns One entry per (harness, skill), realpath-deduplicated across harnesses.
+ * @see SMI-5392
+ */
+export async function collectDeviceSkills() {
+    const entries = [];
+    const seenRealpaths = new Set();
+    for (const harness of CLIENT_IDS) {
+        await collectHarness(harness, entries, seenRealpaths);
+    }
+    return entries;
+}
+//# sourceMappingURL=inventory-collector.js.map

package/dist/src/sync/inventory-collector.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-collector.js","sourceRoot":"","sources":["../../../src/sync/inventory-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAA;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAiB,MAAM,qBAAqB,CAAA;AAGpF;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,mBAAmB,CAChC,SAAiB,EACjB,WAAoB,EACpB,cAAuB;IAEvB,IAAI,WAAW;QAAE,OAAO,IAAI,CAAA;IAC5B,IAAI,CAAC,cAAc;QAAE,OAAO,KAAK,CAAA;IACjC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA,CAAC,iBAAiB;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,QAAgB,EAChB,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,OAAO,CAAC,CAAA;QACnE,MAAM,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;QAC9E,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,0EAA0E;YAC1E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAA;QACzD,CAAC;QACD,yEAAyE;QACzE,MAAM,QAAQ,GAAI,MAA6C,CAAC,IAAI,CAAuB,CAAA;QAC3F,OAAO;YACL,OAAO,EAAE,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO;YAC3C,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,IAAI;YAC/B,WAAW;SACZ,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;IAC/D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,cAAc,CAC3B,OAAiB,EACjB,OAA8B,EAC9B,aAA0B;IAE1B,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAE/C,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IAC9D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAA;QAClD,2EAA2E;QAC3E,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS;YAAE,OAAM;QACnD,MAAM,KAAK,CAAA;IACb,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,EAAE,CAAC;YAC3F,SAAQ;QACV,CAAC;QAED,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAA;QAC7C,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAQ;QACxC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QAE1B,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,CAAA;QACvF,OAAO,CAAC,IAAI,CAAC;YACX,OAAO;YACP,QAAQ,EAAE,OAAO;YACjB,OAAO;YACP,YAAY,EAAE,WAAW;YACzB,MAAM,EAAE,IAAI;YACZ,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,IAAI;SACpB,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,OAAO,GAA0B,EAAE,CAAA;IACzC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAA;IACvC,KAAK,MAAM,OAAO,IAAI,UAAU,EAAE,CAAC;QACjC,MAAM,cAAc,CAAC,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,CAAA;IACvD,CAAC;IACD,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/src/sync/inventory-collector.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * inventory-collector tests (SMI-5392).
+ *
+ * Controls the harness directory table by mocking `../install/paths.js` so each
+ * `ClientId` points at a real tmp fixture. CLIENT_NATIVE_PATHS is a mutable
+ * object the collector reads at call time, so per-test fixtures are visible
+ * without re-importing the module.
+ *
+ * IC-1: same skill under two harnesses (distinct realpaths) -> two entries.
+ * IC-2: a symlinked alias across harnesses -> one entry (first ClientId wins).
+ * IC-3: readable SKILL.md -> content_hash + version; missing SKILL.md -> nulls.
+ */
+export {};
+//# sourceMappingURL=inventory-collector.test.d.ts.map

package/dist/src/sync/inventory-collector.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inventory-collector.test.d.ts","sourceRoot":"","sources":["../../../src/sync/inventory-collector.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}

package/dist/src/sync/inventory-collector.test.js

@@ -0,0 +1,107 @@
+/**
+ * inventory-collector tests (SMI-5392).
+ *
+ * Controls the harness directory table by mocking `../install/paths.js` so each
+ * `ClientId` points at a real tmp fixture. CLIENT_NATIVE_PATHS is a mutable
+ * object the collector reads at call time, so per-test fixtures are visible
+ * without re-importing the module.
+ *
+ * IC-1: same skill under two harnesses (distinct realpaths) -> two entries.
+ * IC-2: a symlinked alias across harnesses -> one entry (first ClientId wins).
+ * IC-3: readable SKILL.md -> content_hash + version; missing SKILL.md -> nulls.
+ */
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, mkdir, writeFile, symlink, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+const mockPaths = vi.hoisted(() => ({
+    CLIENT_IDS: ['claude-code', 'cursor', 'copilot', 'windsurf', 'agents'],
+    CLIENT_NATIVE_PATHS: {},
+}));
+vi.mock('../install/paths.js', () => ({
+    CLIENT_IDS: mockPaths.CLIENT_IDS,
+    CLIENT_NATIVE_PATHS: mockPaths.CLIENT_NATIVE_PATHS,
+}));
+import { collectDeviceSkills } from './inventory-collector.js';
+import { INVENTORY_LIMITS } from './inventory-types.js';
+function skillMd(name, version) {
+    const versionLine = version ? `\nversion: ${version}` : '';
+    return `---\nname: ${name}${versionLine}\n---\n\n# ${name}\n`;
+}
+async function createSkill(harness, name, opts = {}) {
+    const dir = join(mockPaths.CLIENT_NATIVE_PATHS[harness], name);
+    await mkdir(dir, { recursive: true });
+    if (opts.withSkillMd !== false) {
+        await writeFile(join(dir, 'SKILL.md'), skillMd(name, opts.version));
+    }
+    return dir;
+}
+let root;
+describe('inventory-collector', () => {
+    beforeEach(async () => {
+        root = await mkdtemp(join(tmpdir(), 'inv-collector-'));
+        // Point every harness at its own (initially absent) subdir under root.
+        for (const id of mockPaths.CLIENT_IDS) {
+            mockPaths.CLIENT_NATIVE_PATHS[id] = join(root, id);
+        }
+    });
+    afterEach(async () => {
+        await rm(root, { recursive: true, force: true });
+        vi.restoreAllMocks();
+    });
+    it('IC-1: emits two entries for the same skill installed under two harnesses', async () => {
+        await createSkill('claude-code', 'foo', { version: '1.0.0' });
+        await createSkill('cursor', 'foo', { version: '2.0.0' });
+        const entries = await collectDeviceSkills();
+        const foo = entries.filter((e) => e.skill_id === 'foo');
+        expect(foo).toHaveLength(2);
+        expect(foo.map((e) => e.harness).sort()).toEqual(['claude-code', 'cursor']);
+        // Distinct realpaths -> distinct rows, each carrying its own version + hash.
+        expect(foo.every((e) => typeof e.content_hash === 'string')).toBe(true);
+        // Static fields are always null at the local-agent layer.
+        expect(foo.every((e) => e.source === null && e.pinned_version === null)).toBe(true);
+        expect(foo.every((e) => e.update_policy === null)).toBe(true);
+    });
+    it('IC-2: collapses a symlinked alias across harnesses to one entry (first ClientId wins)', async () => {
+        const real = await createSkill('claude-code', 'bar', { version: '1.0.0' });
+        await mkdir(mockPaths.CLIENT_NATIVE_PATHS['agents'], { recursive: true });
+        await symlink(real, join(mockPaths.CLIENT_NATIVE_PATHS['agents'], 'bar'), 'dir');
+        const entries = await collectDeviceSkills();
+        const bar = entries.filter((e) => e.skill_id === 'bar');
+        expect(bar).toHaveLength(1);
+        // claude-code precedes agents in CLIENT_IDS, so it wins the dedup.
+        expect(bar[0]?.harness).toBe('claude-code');
+    });
+    // IC-4: No truncation at MAX_SKILLS boundary.
+    //
+    // The collector is intentionally uncapped — it returns EVERY on-disk entry.
+    // The >5000 ceiling is enforced server-side via the `too_many_skills` 400 error
+    // (see inventory-client tests) and will be covered end-to-end in Wave 5. This
+    // test verifies the guarantee cheaply using a small K so the suite stays fast.
+    it('IC-4: returned entry count equals the number of on-disk skills with no local cap applied', async () => {
+        const K = 4;
+        for (let i = 0; i < K; i++) {
+            await createSkill('claude-code', `skill-ic4-${i}`, { version: `1.0.${i}` });
+        }
+        const entries = await collectDeviceSkills();
+        const ic4 = entries.filter((e) => e.skill_id.startsWith('skill-ic4-'));
+        // The collector must not truncate: returned count must equal the on-disk count.
+        expect(ic4).toHaveLength(K);
+        // K is well below the server-enforced limit — no false ceiling here.
+        expect(K).toBeLessThan(INVENTORY_LIMITS.MAX_SKILLS);
+    });
+    it('IC-3: populates content_hash + version for readable SKILL.md, nulls for missing', async () => {
+        await createSkill('claude-code', 'withmd', { version: '3.1.4' });
+        await createSkill('cursor', 'nomd', { withSkillMd: false });
+        const entries = await collectDeviceSkills();
+        const withMd = entries.find((e) => e.skill_id === 'withmd');
+        const noMd = entries.find((e) => e.skill_id === 'nomd');
+        expect(withMd?.version).toBe('3.1.4');
+        expect(withMd?.content_hash).toMatch(/^[0-9a-f]{64}$/);
+        // A subdir with no readable SKILL.md still counts, keyed by its dir name.
+        expect(noMd).toBeDefined();
+        expect(noMd?.version).toBeNull();
+        expect(noMd?.content_hash).toBeNull();
+    });
+});
+//# sourceMappingURL=inventory-collector.test.js.map