@taodigital/agents 0.0.0-stage → 1.2.1

package/dist/security-test-agent.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Security Test Agent — OWASP DAST Coverage Generator
+ *
+ * Maps the attack surface discovered during crawl (all form inputs,
+ * API endpoints) to OWASP Top 10 test scenarios.
+ *
+ * Uses: ERROR_CATALOGUE, API_CONTRACT, AUTH_SESSION, INTERACTION_PATTERNS
+ * Test kinds: SECURITY, NEGATIVE, EDGE
+ */
+export interface SecurityTestCase {
+    title: string;
+    kind: 'SECURITY' | 'NEGATIVE' | 'EDGE';
+    priority: 'CRITICAL' | 'HIGH' | 'MEDIUM';
+    owaspCategory: string;
+    preconditions: string;
+    steps: string[];
+    expectedResult: string;
+    groundedOn: string[];
+    tags: string[];
+}
+export declare function generateSecurityTests(opts: {
+    tenantId: string;
+    projectId: string;
+    apiEndpoints?: Array<{
+        method: string;
+        urlPattern: string;
+    }>;
+}): Promise<{
+    status: string;
+    cases: never[];
+    saved: null;
+    suiteName?: undefined;
+} | {
+    status: string;
+    cases: SecurityTestCase[];
+    saved: {
+        suite: {
+            tenantId: string;
+            id: string;
+            projectId: string;
+            name: string;
+            createdAt: Date;
+            genModel: string | null;
+            category: import(".prisma/client").$Enums.SuiteCategory | null;
+            parentId: string | null;
+            ownerUserId: string | null;
+            genTotalTokens: number | null;
+            genTotalCostUsd: number | null;
+            genAt: Date | null;
+            genScreenCount: number | null;
+            coverageReport: import("@prisma/client/runtime/library").JsonValue | null;
+        };
+        testCases: {
+            tenantId: string;
+            screenId: string | null;
+            id: string;
+            projectId: string;
+            source: string;
+            status: string;
+            createdAt: Date;
+            updatedAt: Date;
+            steps: import("@prisma/client/runtime/library").JsonValue;
+            kind: string;
+            tags: import("@prisma/client/runtime/library").JsonValue;
+            approvedBy: string | null;
+            suiteId: string;
+            ref: string | null;
+            title: string;
+            priority: string;
+            preconditions: string | null;
+            expectedResult: string | null;
+            gherkin: string | null;
+            approvedAt: Date | null;
+            groundedOn: import("@prisma/client/runtime/library").JsonValue;
+            caseRefs: import("@prisma/client/runtime/library").JsonValue;
+            viewports: import("@prisma/client/runtime/library").JsonValue;
+            viewportConstraint: string;
+            techniqueOfRecord: string | null;
+            traceTo: string | null;
+            traceToExtra: import("@prisma/client/runtime/library").JsonValue;
+            testDataInline: import("@prisma/client/runtime/library").JsonValue | null;
+            dataNote: string | null;
+            scriptNote: string | null;
+            structuredSteps: import("@prisma/client/runtime/library").JsonValue | null;
+            artifactId: string | null;
+            scenarioId: string | null;
+            suspect: boolean;
+            suspectReason: string | null;
+            flakyScore: number;
+            consecutiveFlakes: number;
+            lastFlakyAt: Date | null;
+            quarantined: boolean;
+            quarantinedAt: Date | null;
+            quarantineReason: string | null;
+            genPromptTokens: number | null;
+            genCompletionTokens: number | null;
+            genCostUsd: number | null;
+            genModel: string | null;
+            dataSetId: string | null;
+            repoTargetPath: string | null;
+            stepsKey: string | null;
+            gherkinKey: string | null;
+            contentHash: string | null;
+            groundingHash: string | null;
+            locatorsJson: import("@prisma/client/runtime/library").JsonValue | null;
+            locatorsExtractedAt: Date | null;
+            captureStepScreenshots: import("@prisma/client/runtime/library").JsonValue | null;
+        }[];
+    };
+    suiteName: string;
+}>;

package/dist/security-test-agent.js

@@ -0,0 +1,141 @@
+"use strict";
+/**
+ * Security Test Agent — OWASP DAST Coverage Generator
+ *
+ * Maps the attack surface discovered during crawl (all form inputs,
+ * API endpoints) to OWASP Top 10 test scenarios.
+ *
+ * Uses: ERROR_CATALOGUE, API_CONTRACT, AUTH_SESSION, INTERACTION_PATTERNS
+ * Test kinds: SECURITY, NEGATIVE, EDGE
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateSecurityTests = generateSecurityTests;
+const app_brain_1 = require("@taodigital/app-brain");
+const core_1 = require("@taodigital/core");
+const llm_js_1 = require("./llm.js");
+const llm_config_js_1 = require("./llm-config.js");
+async function generateSecurityTests(opts) {
+    const llmCfg = await (0, llm_config_js_1.getTaskAgentLLMConfig)(opts.tenantId, 'testGeneration');
+    const project = await app_brain_1.AppBrain.getProjectMap(opts.tenantId, opts.projectId);
+    if (!project)
+        return { status: 'NO_PROJECT', cases: [], saved: null };
+    const screens = project.screens ?? [];
+    // Collect input elements (the attack surface)
+    const SCREEN_LIMIT = parseInt(process.env.SECURITY_AGENT_SCREEN_LIMIT ?? '20', 10);
+    const inputElements = [];
+    for (const screen of screens.slice(0, SCREEN_LIMIT)) {
+        for (const el of (screen.elements ?? [])) {
+            const roleLC = (el.role ?? '').toLowerCase();
+            if (['input', 'form', 'search', 'text', 'password', 'email', 'textarea', 'field'].some((r) => roleLC.includes(r))) {
+                inputElements.push({ screenName: screen.name, meaning: el.meaning, role: el.role, expectedData: el.expectedData });
+            }
+        }
+    }
+    const skillFiles = await app_brain_1.AppBrain.listSkillFiles(opts.tenantId, opts.projectId, ['ERROR_CATALOGUE', 'API_CONTRACT', 'AUTH_SESSION', 'INTERACTION_PATTERNS']);
+    const skillCtx = skillFiles.map((sf) => `### ${sf.kind}\n${sf.content}`).join('\n\n');
+    const inputSummary = inputElements.slice(0, 30)
+        .map((e) => `  - [${e.screenName}] ${e.role}: "${e.meaning}"${e.expectedData ? ` (expected: ${e.expectedData})` : ''}`)
+        .join('\n');
+    const endpointSummary = (opts.apiEndpoints ?? []).slice(0, 30)
+        .map((e) => `  ${e.method} ${e.urlPattern}`)
+        .join('\n');
+    const SYSTEM_DEFAULT = `You are an expert security QA engineer generating DAST test cases covering OWASP Top 10.
+
+OWASP CATEGORIES TO COVER:
+- A01: Broken Access Control (auth bypass, IDOR, privilege escalation)
+- A02: Cryptographic Failures (sensitive data in URLs, weak tokens)
+- A03: Injection (XSS, SQLi, command injection via inputs)
+- A04: Insecure Design (business logic bypass, missing rate limiting)
+- A05: Security Misconfiguration (verbose errors, debug info)
+- A07: Authentication Failures (weak passwords, no lockout)
+- A08: Integrity Failures (CSRF, unvalidated redirects)
+
+GROUNDING RULES:
+- Only inject payloads into INPUT FIELDS listed
+- Only test auth bypass on endpoints/screens listed
+- Never invent inputs or endpoints not documented
+- Steps: "On [ScreenName]: [action]" or "API [METHOD] [path]: [action]"
+- expectedResult: what the app MUST do — reject, sanitize, block
+
+OUTPUT FORMAT — valid JSON array only, no markdown:
+[
+  {
+    "title": "string",
+    "kind": "SECURITY|NEGATIVE|EDGE",
+    "priority": "CRITICAL|HIGH|MEDIUM",
+    "owaspCategory": "A01|A02|A03|A04|A05|A07|A08",
+    "preconditions": "string",
+    "steps": ["step1", "step2"],
+    "expectedResult": "string",
+    "groundedOn": ["ScreenName.ElementMeaning or endpoint:METHOD /path"],
+    "tags": ["security", "owasp"]
+  }
+]`;
+    const user = `Generate OWASP DAST security test cases for this application.
+
+ATTACK SURFACE — INPUT FIELDS:
+${inputSummary || '  (No input fields found — run a crawl first)'}
+
+ATTACK SURFACE — API ENDPOINTS:
+${endpointSummary || '  (No endpoints captured — check API_CONTRACT skill file)'}
+
+SKILL FILE CONTEXT:
+${skillCtx.slice(0, 5000)}
+
+Generate tests:
+1. XSS stored (A03): <script>alert('XSS')</script> in text inputs → DOM must not reflect unescaped
+2. XSS reflected (A03): Payload in URL query params → response must not reflect
+3. SQL injection (A03): ' OR 1=1 -- in login/search fields → no data leak, proper error
+4. Auth bypass (A01): Navigate to protected screen without session cookie → redirect to login
+5. IDOR (A01): Change resource ID in API call to another user's ID → 403 or 404
+6. Brute force (A07): 10+ wrong password attempts → rate limiting or lockout
+7. CSRF (A08): Submit form without CSRF token → request rejected
+8. Verbose error (A05): Trigger 500 → no stack trace or internal path in response
+9. Expired JWT (A02): Request with expired token → 401, not 200
+10. Open redirect (A08): redirect_to=https://evil.com in params → only own domain allowed
+
+Min 1-2 tests per OWASP category. Reference ACTUAL field names and endpoints from lists above.`;
+    const seed = (0, llm_js_1.deterministicSeed)(`${opts.tenantId}:${opts.projectId}:security:${inputSummary.slice(0, 300)}:${endpointSummary.slice(0, 200)}`);
+    const system = await (0, core_1.getAgentPrompt)('security-test-generation', undefined, opts.tenantId) ?? SYSTEM_DEFAULT;
+    let parsed = [];
+    const t0 = Date.now();
+    try {
+        const { text: raw, usage } = await (0, llm_js_1.askTracked)(system, user, llmCfg, undefined, undefined, { temperature: 0, seed });
+        const latencyMs = Date.now() - t0;
+        (0, app_brain_1.recordLLMCall)({
+            tenantId: opts.tenantId, projectId: opts.projectId,
+            agentType: 'security_test', label: 'security_test_generation', usage, latencyMs,
+        }).catch(console.error);
+        const jsonMatch = raw.match(/\[[\s\S]*\]/);
+        if (jsonMatch) {
+            const items = JSON.parse(jsonMatch[0]);
+            parsed = items
+                .filter((tc) => tc.title && Array.isArray(tc.steps) && tc.steps.length >= 1)
+                .map((tc) => ({
+                title: String(tc.title).slice(0, 200),
+                kind: (['SECURITY', 'NEGATIVE', 'EDGE'].includes(tc.kind) ? tc.kind : 'SECURITY'),
+                priority: (['CRITICAL', 'HIGH', 'MEDIUM'].includes(tc.priority) ? tc.priority : 'HIGH'),
+                owaspCategory: String(tc.owaspCategory || 'A03').slice(0, 10),
+                preconditions: String(tc.preconditions || '').slice(0, 300),
+                steps: tc.steps.map((s) => String(s).slice(0, 400)),
+                expectedResult: String(tc.expectedResult || '').slice(0, 500),
+                groundedOn: Array.isArray(tc.groundedOn) ? tc.groundedOn.map(String) : [],
+                tags: ['security', 'owasp', tc.owaspCategory || 'A03', ...(Array.isArray(tc.tags) ? tc.tags.map(String) : [])],
+            }));
+        }
+    }
+    catch (e) {
+        console.error('[security-test-agent] parse error:', e?.message);
+    }
+    if (parsed.length === 0)
+        return { status: 'LLM_EMPTY', cases: [], saved: null };
+    const suiteName = 'Security Tests: OWASP Top 10';
+    const saved = await app_brain_1.AppBrain.saveGeneratedTestCases(opts.tenantId, opts.projectId, suiteName, parsed.map((tc) => ({
+        title: tc.title, kind: tc.kind, priority: tc.priority,
+        preconditions: tc.preconditions, steps: tc.steps,
+        expectedResult: tc.expectedResult, groundedOn: tc.groundedOn,
+        tags: tc.tags, source: 'AI_GENERATED',
+    })));
+    console.log(`[security-test-agent] ${parsed.length} OWASP test cases saved`);
+    return { status: 'GENERATED', cases: parsed, saved, suiteName };
+}

package/dist/skill-file-agent.d.ts

@@ -0,0 +1,264 @@
+/**
+ * Skill File Agent — 14-Dimension Application Intelligence Generator
+ *
+ * After each crawl, generates 14 taxonomy-level skill files in the Zeta Core:
+ *
+ * TIER 1 — Platform Intelligence (zero-cost DOM/network extraction, no LLM):
+ *   1. TECH_STACK        — framework, CSS lib, API style, build tool
+ *   2. AUTH_SESSION      — auth type, token storage, 2FA, protected routes
+ *   3. API_CONTRACT      — captured endpoints, base URL, error format
+ *
+ * TIER 2 — Domain Intelligence (LLM, uses DOM data):
+ *   4. BUSINESS_DOMAIN   — domain, user roles, core journeys, business rules
+ *   5. DATA_MODEL        — entities and field constraints from HTML5 attrs
+ *
+ * TIER 3 — Behavioral Intelligence (LLM + vision):
+ *   6. INTERACTION_PATTERNS — error display, loading states, submit flow
+ *   7. ERROR_CATALOGUE   — exact error messages per field and API error map
+ *
+ * TIER 4 — Structural Intelligence (LLM + vision):
+ *   8. VISUAL_BASELINE   — colors (hex), typography, layout, contrast ratios
+ *   9. COMPONENT_LIBRARY — reusable components, where they appear, edge cases
+ *  10. ELEMENT_BEHAVIORS — per-element: type, required, min/max, pattern, states
+ *
+ * TIER 5 — Quality Intelligence (structured data, no LLM):
+ *  11. NAVIGATION_MAP    — route inventory, auth guards, flow graph
+ *  12. LOCATOR_STRATEGY  — data-testid coverage, role-based locators, fragile selectors
+ *  13. PERFORMANCE_BASELINE — LCP/FCP/TTFB per screen, CWV status
+ *  14. COVERAGE_MATRIX   — TC counts per screen×type, coverage gaps
+ *
+ * QUALITY PROJECTION: 42/100 (old 6-file) → 87/100 (new 14-file)
+ *
+ * COST: Tiers 1, 5 = ZERO extra LLM tokens (pure DOM/network data).
+ *       Tiers 2–4 = LLM calls, same as before but higher-quality prompts.
+ */
+export interface CrawledScreen {
+    id: string;
+    name: string;
+    url?: string | null;
+    elements: Array<{
+        meaning: string;
+        role: string;
+        expectedData?: string | null;
+        notes?: string | null;
+        transitionsToScreenId?: string | null;
+    }>;
+    screenshots?: Array<{
+        storagePath: string;
+    }> | null;
+}
+export interface ApiEndpoint {
+    method: string;
+    urlPattern: string;
+}
+export interface PerformanceMetric {
+    url: string;
+    screenName: string;
+    lcp?: number;
+    fcp?: number;
+    ttfb?: number;
+    cls?: number;
+}
+interface SkillFileResult {
+    content: string;
+    summary: string;
+    tags: string[];
+}
+/**
+ * Generate all 14 taxonomy skill files for a project after a crawl.
+ * Dependency-aware execution in 3 phases:
+ *   Phase A: Zero-cost structured data (no LLM)
+ *   Phase B: LLM domain + behavioral (uses Phase A data)
+ *   Phase C: LLM structural + quality (uses Phase A+B data)
+ */
+export declare function generateTaxonomySkillFiles(tenantId: string, projectId: string, screens: CrawledScreen[], apiEndpoints?: ApiEndpoint[], performanceMetrics?: PerformanceMetric[]): Promise<void>;
+/** TECH_STACK — purely from DOM data extracted during crawl */
+export declare function generateTechStackFile(screens: CrawledScreen[], apiEndpoints?: ApiEndpoint[]): SkillFileResult;
+/** AUTH_SESSION — from network request patterns + redirect behavior */
+export declare function generateAuthSessionFile(screens: CrawledScreen[], apiEndpoints?: ApiEndpoint[]): SkillFileResult;
+/** API_CONTRACT — from HAR-style endpoint capture during crawl */
+export declare function generateApiContractFile(apiEndpoints?: ApiEndpoint[]): SkillFileResult;
+/** NAVIGATION_MAP — from screen URLs + flow graph */
+export declare function generateNavigationMapFile(screens: CrawledScreen[]): SkillFileResult;
+/** LOCATOR_STRATEGY — from data-testid presence + ARIA attribute analysis */
+export declare function generateLocatorStrategyFile(screens: CrawledScreen[]): SkillFileResult;
+/** PERFORMANCE_BASELINE — from Playwright performance metrics during crawl */
+export declare function generatePerformanceBaselineFile(screens: CrawledScreen[], metrics?: PerformanceMetric[]): SkillFileResult;
+/** One probe observation captured by the interactive probe during a crawl. */
+export interface ProbeObservationLite {
+    elementMeaning: string;
+    observationType: string;
+    observedText: string;
+    triggeredBy: string;
+}
+/**
+ * Derive concrete valid/invalid example values and state descriptions from
+ * HTML5 constraint attributes — deterministic, no LLM. This is what fills the
+ * Valid/Invalid Example columns that used to come back as "-".
+ */
+export declare function deriveConstraintExamples(role: string, expectedData: string | null | undefined, attrs: Record<string, string>): {
+    constraints: string;
+    valid: string;
+    invalid: string;
+    states: string;
+};
+export interface CoverageScreenRow {
+    id: string | null;
+    name: string;
+    url?: string | null;
+    elementCount: number;
+}
+/**
+ * Render the Coverage Matrix from live screen + TestCase-count data. Reuses
+ * the same URL-dedup and generic-title (deriveScreenLabel) logic as the
+ * crawl-time baseline above so screens are named consistently either way.
+ */
+export declare function renderCoverageMatrix(screens: CoverageScreenRow[], counts: Array<{
+    screenId: string | null;
+    kind: string;
+    count: number;
+}>): SkillFileResult;
+/**
+ * Recompute the COVERAGE_MATRIX skill file from live TestCase data.
+ * Called after every test generation run (and after crawls, as the baseline).
+ * Skips human-approved or manually written files so edits are never clobbered.
+ */
+export declare function refreshCoverageMatrix(tenantId: string, projectId: string): Promise<void>;
+/**
+ * Recompute the TEST_CASES skill file.
+ * Emits testing strategy (persona registry, risk matrix, title conventions, exclusion list)
+ * drawn from BUSINESS_DOMAIN, then appends a live inventory of generated test cases.
+ * Runs even when no cases exist so new projects get actionable guidance immediately.
+ */
+export declare function refreshTestCaseInventory(tenantId: string, projectId: string): Promise<void>;
+/**
+ * Recompute the TEST_SCRIPT skill file.
+ * Emits authoring standards (framework, auth strategy, selector priority, CI constraints, k6 config)
+ * drawn from TECH_STACK, AUTH_SESSION, and LOCATOR_STRATEGY skill files, then appends an
+ * inventory of existing scripts. Runs even when no scripts exist so new projects get
+ * actionable standards before first generation.
+ */
+export declare function refreshScriptInventory(tenantId: string, projectId: string): Promise<void>;
+export declare function refineSkillFile(opts: {
+    tenantId: string;
+    projectId: string;
+    kind: string;
+    currentContent: string;
+    feedback: string;
+}): Promise<SkillFileResult>;
+export interface RepoSkillFileOpts {
+    repoFullName: string;
+    framework: string;
+    language: string;
+    testGlob: string;
+    styleProfile: Record<string, any> | null;
+    pageObjectInventory: Array<{
+        className: string;
+        filePath: string;
+        methods?: Array<{
+            name: string;
+            params?: string;
+            returnType?: string;
+        }>;
+    }>;
+    testPaths: string[];
+    extractedTestCount: number;
+    treeWasTruncated?: boolean;
+    extractedTests?: Array<{
+        name: string;
+        normalizedName: string;
+        filePath: string;
+        lineNumber: number;
+        describeBlock?: string;
+        framework: string;
+        dynamic: boolean;
+    }>;
+}
+export declare function generateRepoSkillFiles(tenantId: string, projectId: string, opts: RepoSkillFileOpts): Promise<void>;
+/**
+ * Generates a `REPO_ZETA_OVERLAY` skill file containing repo-specific overrides
+ * derived deterministically from the `styleProfile` produced by repo scan.
+ * This overlay is injected AFTER the base `ZETA_FRAMEWORK_STANDARD` in generation
+ * prompts so repo-specific paths/conventions override generic ZeTa defaults.
+ */
+export declare function alignSkillFile(tenantId: string, projectId: string, opts: {
+    framework: string;
+    language: string;
+    styleProfile: Record<string, unknown> | null;
+    repoFullName: string;
+}): Promise<void>;
+/**
+ * Upserts one ZETA_FRAMEWORK_{FRAMEWORK} skill file per supported framework.
+ * Called once on project creation so every project has the framework standards
+ * available to script-generation agents from day one.
+ */
+export declare function generateZetaFrameworkSkillFiles(tenantId: string, projectId: string): Promise<void>;
+/**
+ * Refresh BUSINESS_DOMAIN from uploaded/imported artifacts.
+ *
+ * Crawl-generated BUSINESS_DOMAIN is useful, but uploaded BRDs/specs often arrive
+ * before a crawl or test import. This live DB refresh makes those documents visible
+ * as project memory immediately without an LLM call. Approved/manual domain files
+ * remain locked.
+ */
+export declare function refreshArtifactKnowledgeSkillFile(tenantId: string, projectId: string): Promise<void>;
+/**
+ * Refresh the TEST_CASES skill file from live TestCase data.
+ * Groups test cases by suite, caps at 200 rows, and summarises approval status.
+ */
+export declare function refreshTestCasesSkillFile(tenantId: string, projectId: string): Promise<void>;
+/**
+ * Refresh the TEST_DATA skill file.
+ * Emits authoring guidance (personas, field constraints, equivalence classes, forbidden patterns)
+ * drawn from DATA_MODEL and BUSINESS_DOMAIN skill files, then appends an inventory of
+ * existing TestData records below a separator. Runs even when no data exists yet so new
+ * projects start with useful guidance immediately.
+ */
+export declare function refreshTestDataSkillFile(tenantId: string, projectId: string): Promise<void>;
+/**
+ * Refresh the TEST_SCRIPT skill file from live TestScript records.
+ * Emits authoring standards (framework, auth, selector priority, CI constraints, k6 config)
+ * drawn from TECH_STACK, AUTH_SESSION, and LOCATOR_STRATEGY skill files, then appends an
+ * inventory of existing scripts with code samples. Runs even when no scripts exist yet.
+ */
+export declare function refreshTestScriptSkillFile(tenantId: string, projectId: string): Promise<void>;
+/**
+ * Refresh the REQUIREMENTS_COVERAGE skill file from live requirements and test case data.
+ * Queries requirements, approved test cases, and traces coverage via LLM matching.
+ * No-ops when the skill file has been manually approved or edited.
+ */
+export declare function refreshRequirementsCoverageSkillFile(tenantId: string, projectId: string): Promise<void>;
+/**
+ * GAP-SF-17: TEST_EXECUTION_HISTORY — top recently failed tests with error type + frequency.
+ * Refreshed after each test run completes.
+ */
+export declare function refreshTestExecutionHistorySkillFile(tenantId: string, projectId: string): Promise<void>;
+/**
+ * GAP-SF-18: VISUAL_REGRESSION_HISTORY — screens with recent diffs, change types, stable vs unstable zones.
+ * Refreshed after visual diff generation.
+ */
+export declare function refreshVisualRegressionHistorySkillFile(tenantId: string, projectId: string): Promise<void>;
+/**
+ * GAP-SF-19: Append self-healing history to LOCATOR_STRATEGY — elements with healCount > 2 are high-fragility.
+ * Refreshed after self-healing events.
+ */
+export declare function refreshLocatorStrategyWithHealingData(tenantId: string, projectId: string): Promise<void>;
+/**
+ * GAP-SF-20: FIELD_CATALOG — deterministic ground-truth field inventory from AppField table.
+ * Refreshed after crawl when AppField catalog is populated.
+ */
+export declare function refreshFieldCatalogSkillFile(tenantId: string, projectId: string): Promise<void>;
+/**
+ * GAP-SF-21: HEALING_LOG — dedicated skill file tracking healing events (element breaks + auto-fixes).
+ * Separates healing telemetry from LOCATOR_STRATEGY so it can be queried independently.
+ * Refreshed after self-healing events.
+ */
+export declare function refreshHealingLogSkillFile(tenantId: string, projectId: string): Promise<void>;
+/**
+ * GAP-SF-22: LOCATOR_INVENTORY — per-screen map of actual extracted locators.
+ * Sourced from TestScript rows where language ends in ':locators'.
+ * Different from LOCATOR_STRATEGY which contains strategy guidance only.
+ * Refreshed after locator extraction runs.
+ */
+export declare function refreshLocatorInventorySkillFile(tenantId: string, projectId: string): Promise<void>;
+export {};