@cleocode/caamp 2026.10.8 → 2026.10.9

package/dist/index.js

@@ -82,14 +82,12 @@ import {
   validateRecommendationCriteria,
   validateSkill,
   writeConfig
-} from "./chunk-ZL6FLO2H.js";
+} from "./chunk-5UAFS46N.js";
 import {
   EmbeddedDeliveryDowngradeError,
   HITL_REQUEST_FALLBACK,
   HomeInstructionFileError,
-  JsonConfigParseError,
   PROVIDER_ASK_TOOLS,
-  assertNotTornRead,
   blockPattern,
   buildBlock,
   buildInjectionContent,
@@ -143,10 +141,14 @@ import {
   resolveAlias,
   resolveGlobalInstructionPath,
   resolveInstructionDelivery,
-  updateJsonConfigFile,
-  withFileLock,
   writeAgentFileToAllProviders
-} from "./chunk-2FQWBKEG.js";
+} from "./chunk-2RZGY4XT.js";
+import {
+  JsonConfigParseError,
+  assertNotTornRead,
+  updateJsonConfigFile,
+  withFileLock
+} from "./chunk-D6CWC4BX.js";
 import {
   CANONICAL_HOOK_EVENTS,
   HOOK_CATEGORIES,
@@ -172,7 +174,7 @@ import {
   toNative,
   toNativeBatch,
   translateToAll
-} from "./chunk-YCAANESR.js";
+} from "./chunk-IYSZL7N7.js";
 import {
   _resetPlatformPathsCache,
   getAgentsConfigPath,
@@ -190,7 +192,8 @@ import {
   getSystemInfo,
   resolveProviderSkillsDirs,
   resolveRegistryTemplatePath
-} from "./chunk-HDZYZTR2.js";
+} from "./chunk-5INWYMO4.js";
+import "./chunk-PZ5AY32C.js";
 
 // src/core/artifacts/validation.ts
 import { posix } from "path";
@@ -202,13 +205,15 @@ var CLEO_ARTIFACT_BUDGETS = Object.freeze({
 var CLEO_SHIPPED_JS_ENTRIES = /* @__PURE__ */ new Set([
   "dist/cli/index.js",
   "dist/cli/hook-entry.js",
-  "dist/cli/update-check-entry.js"
+  "dist/cli/update-check-entry.js",
+  "dist/cli/project-hook-entry.js"
 ]);
 var CLEO_CLI_CHUNK_PATTERN = /^dist\/cli\/[A-Za-z0-9_.-]+-[A-Z0-9]{8}\.js$/;
 var CLEO_ARTIFACT_REQUIREMENTS = Object.freeze([
   { id: "cli-entry", path: "dist/cli/index.js", match: "exact" },
   { id: "cli-hook-entry", path: "dist/cli/hook-entry.js", match: "exact" },
   { id: "cli-update-check-entry", path: "dist/cli/update-check-entry.js", match: "exact" },
+  { id: "cli-project-hook-entry", path: "dist/cli/project-hook-entry.js", match: "exact" },
   { id: "studio-server-entry", path: "studio-dist/index.js", match: "exact" },
   { id: "studio-handler", path: "studio-dist/handler.js", match: "exact" },
   { id: "studio-server", path: "studio-dist/server/index.js", match: "exact" },
@@ -530,7 +535,7 @@ function shouldOverrideSkill(skillName, incomingSource, existingEntry) {
   return true;
 }
 async function validateInstructionIntegrity(providers, projectDir, scope, expectedContent) {
-  const { checkAllInjections: checkAllInjections2 } = await import("./injector-FDRZD2DB.js");
+  const { checkAllInjections: checkAllInjections2 } = await import("./injector-3SMMI2FO.js");
   const results = await checkAllInjections2(providers, projectDir, scope, expectedContent);
   const issues = [];
   for (const result of results) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/artifacts/validation.ts","../src/core/skills/integrity.ts"],"sourcesContent":["/**\n * Pure semantic validation of npm-produced package inventories.\n *\n * Code placed in `packages/caamp/` per Package-Boundary Check — verified\n * against AGENTS.md. No filesystem, process, model, or runtime-store access.\n */\n\nimport { posix } from 'node:path';\nimport type {\n  PackageArtifactBudgets,\n  PackageArtifactFile,\n  PackageArtifactInventory,\n  PackageArtifactIssue,\n  PackageArtifactPolicy,\n  PackageArtifactRequirement,\n  PackageArtifactValidation,\n  PackageFilesEntry,\n} from '@cleocode/contracts/package-artifact';\n\n/** Existing CLI upper budgets: 20 MiB packed, 36 MiB unpacked, and 800 files. */\nexport const CLEO_ARTIFACT_BUDGETS: Readonly<PackageArtifactBudgets> = Object.freeze({\n  packedBytes: 20 * 1024 * 1024,\n  unpackedBytes: 36 * 1024 * 1024,\n  fileCount: 800,\n});\n\n/**\n * The JavaScript files `build.mjs` declares for the published CLI: the CLI\n * bundle, the provider hook runtime that `bin/cleo.js` imports directly for\n * `cleo hook heavy-command` (T12983), skipping the CLI bootstrap, and the\n * detached dist-tags check the CLI spawns for its update notice (T13137). Any\n * other `.js` under `dist/` is development output.\n */\nconst CLEO_SHIPPED_JS_ENTRIES: ReadonlySet<string> = new Set([\n  'dist/cli/index.js',\n  'dist/cli/hook-entry.js',\n  'dist/cli/update-check-entry.js',\n]);\n\n/**\n * A code-split chunk of the CLI bundle (T13126): `dist/cli/<name>-<HASH>.js`,\n * where `<HASH>` is esbuild's 8-character content hash.\n *\n * `build.mjs` bundles the CLI with `splitting` so each `import()` loads its own\n * chunk instead of the whole CLI and all of CORE at startup. Its\n * `CLEO_CHUNK_NAMES` (`cli/[name]-[hash]`) writes every chunk directly beside\n * `cli/index.js`; change both together. A chunk in any other directory is not\n * build output and stays rejected. `<name>` is the source file's basename in\n * any case (T13159): a source file named `TaskCard.ts` must not fail the\n * artifact check.\n */\nexport const CLEO_CLI_CHUNK_PATTERN: RegExp = /^dist\\/cli\\/[A-Za-z0-9_.-]+-[A-Z0-9]{8}\\.js$/;\n\n/** Required CLI and adapter-node resources, independent of historical byte/file-count floors. */\nexport const CLEO_ARTIFACT_REQUIREMENTS: readonly PackageArtifactRequirement[] = Object.freeze([\n  { id: 'cli-entry', path: 'dist/cli/index.js', match: 'exact' },\n  { id: 'cli-hook-entry', path: 'dist/cli/hook-entry.js', match: 'exact' },\n  { id: 'cli-update-check-entry', path: 'dist/cli/update-check-entry.js', match: 'exact' },\n  { id: 'studio-server-entry', path: 'studio-dist/index.js', match: 'exact' },\n  { id: 'studio-handler', path: 'studio-dist/handler.js', match: 'exact' },\n  { id: 'studio-server', path: 'studio-dist/server/index.js', match: 'exact' },\n  { id: 'studio-manifest', path: 'studio-dist/server/manifest.js', match: 'exact' },\n  {\n    id: 'studio-client-start',\n    path: 'studio-dist/client/_app/immutable/entry/start.*.js',\n    match: 'glob',\n  },\n  {\n    id: 'studio-client-app',\n    path: 'studio-dist/client/_app/immutable/entry/app.*.js',\n    match: 'glob',\n  },\n]);\n\nconst SHA256 = /^[a-f0-9]{64}$/;\nconst GLOB = /[*?{}[\\]]|[+@!]\\(/;\n\nfunction pathProblem(path: string): string | null {\n  if (!path || path.trim() !== path) return 'Path is empty or has surrounding whitespace.';\n  if (path.includes('\\\\') || /[\\x00-\\x1f\\x7f]/.test(path))\n    return 'Path is not a portable POSIX package path.';\n  if (posix.isAbsolute(path) || /^[A-Za-z]:/.test(path))\n    return 'Path must be relative to the package.';\n  if (path.split('/').some((part) => !part || part === '.' || part === '..')) {\n    return 'Path must not contain empty, current-directory, or parent-directory segments.';\n  }\n  return null;\n}\n\n/**\n * Classify a manifest files entry without evaluating exclusions as disk paths.\n *\n * @param entry - Original npm manifest entry.\n * @returns Classification only; actual selected content must come from the packer.\n * @example\n * ```ts\n * classifyPackageFilesEntry('!dist/index.js.map').kind; // 'exclusion'\n * ```\n */\nexport function classifyPackageFilesEntry(entry: string): PackageFilesEntry {\n  const exclusion = entry.startsWith('!');\n  const pattern = (exclusion ? entry.slice(1) : entry).replace(/^\\.\\//, '').replace(/\\/$/, '');\n  const reason = pattern.startsWith('!')\n    ? 'Repeated exclusion markers are not assessed.'\n    : pathProblem(pattern);\n  return {\n    entry,\n    pattern,\n    kind: reason ? 'invalid' : exclusion ? 'exclusion' : GLOB.test(pattern) ? 'glob' : 'literal',\n    reason,\n  };\n}\n\nfunction fileProblems(file: PackageArtifactFile): string[] {\n  const problems: string[] = [];\n  const pathError = pathProblem(file.path);\n  if (pathError) problems.push(pathError);\n  if (!Number.isSafeInteger(file.size) || file.size < 0)\n    problems.push('File size must be a nonnegative safe integer.');\n  if (file.sha256 !== undefined && !SHA256.test(file.sha256))\n    problems.push('File SHA-256 must be 64 lowercase hexadecimal characters.');\n  return problems;\n}\n\n/**\n * Validate nonempty semantic resources, inventory identity, expected hashes and upper budgets.\n *\n * @param inventory - Packer-produced evidence or an explicitly identified fixture.\n * @param policy - Independently specified resources, expected files and cost ceilings.\n * @returns A copied evidence receipt; valid means only the supplied checks passed.\n * @example\n * ```ts\n * const result = validatePackageArtifact(inventory, {\n *   requirements: CLEO_ARTIFACT_REQUIREMENTS,\n *   budgets: CLEO_ARTIFACT_BUDGETS,\n * });\n * // result.runtime remains 'not-assessed', even when result.valid is true.\n * ```\n */\nexport function validatePackageArtifact(\n  inventory: PackageArtifactInventory,\n  policy: PackageArtifactPolicy,\n): PackageArtifactValidation {\n  const issues: PackageArtifactIssue[] = [];\n  const add = (code: PackageArtifactIssue['code'], subject: string, message: string): void => {\n    issues.push({ code, subject, message });\n  };\n  if (!inventory.packageName.trim() || !inventory.version.trim()) {\n    add('invalid-inventory', 'identity', 'Package name and version must be recorded.');\n  }\n  if (!['npm-pack', 'npm-pack-dry-run', 'fixture'].includes(inventory.source)) {\n    add('invalid-inventory', 'source', 'Inventory provenance is not recognized.');\n  }\n  if (!Number.isSafeInteger(inventory.packedBytes) || inventory.packedBytes < 0) {\n    add('invalid-inventory', 'packedBytes', 'Packed bytes must be a nonnegative safe integer.');\n  }\n  if (inventory.tarballSha256 !== undefined && !SHA256.test(inventory.tarballSha256)) {\n    add(\n      'invalid-inventory',\n      'tarballSha256',\n      'Tarball SHA-256 must be 64 lowercase hexadecimal characters.',\n    );\n  }\n  if (inventory.source === 'npm-pack-dry-run' && inventory.tarballSha256 !== undefined) {\n    add(\n      'invalid-inventory',\n      'tarballSha256',\n      'A dry run cannot establish a retained tarball hash.',\n    );\n  }\n  const files = new Map<string, PackageArtifactFile>();\n  let unpackedBytes: number | null = 0;\n  for (const file of inventory.files) {\n    for (const problem of fileProblems(file)) add('invalid-inventory', file.path, problem);\n    if (files.has(file.path)) add('invalid-inventory', file.path, 'Duplicate inventory path.');\n    files.set(file.path, file);\n    if (unpackedBytes !== null) {\n      const total: number = unpackedBytes + file.size;\n      unpackedBytes = Number.isSafeInteger(total) && file.size >= 0 ? total : null;\n    }\n  }\n  if (unpackedBytes === null)\n    add('invalid-inventory', 'unpackedBytes', 'File bytes cannot be safely totaled.');\n  const entries = (policy.filesEntries ?? []).map(classifyPackageFilesEntry);\n  for (const entry of entries) {\n    if (entry.reason) add('invalid-policy', entry.entry, entry.reason);\n  }\n  if (!policy.requirements.length)\n    add('invalid-policy', 'requirements', 'At least one semantic content requirement is required.');\n  const ids = new Set<string>();\n  const requirements = policy.requirements.map((requirement) => {\n    const invalid = pathProblem(requirement.path);\n    const duplicate = ids.has(requirement.id);\n    ids.add(requirement.id);\n    if (\n      !requirement.id.trim() ||\n      duplicate ||\n      invalid ||\n      !['exact', 'glob'].includes(requirement.match)\n    ) {\n      add(\n        'invalid-policy',\n        requirement.id,\n        invalid ?? 'Requirement identity or match mode is invalid or duplicated.',\n      );\n      return { id: requirement.id, matchedPaths: [], satisfied: false };\n    }\n    const matches = inventory.files.filter((file) =>\n      requirement.match === 'exact'\n        ? file.path === requirement.path\n        : posix.matchesGlob(file.path, requirement.path),\n    );\n    if (!matches.length)\n      add(\n        'missing',\n        requirement.id,\n        `Required resource ${requirement.path} is absent from the selected inventory.`,\n      );\n    for (const file of matches) {\n      if (file.size === 0) add('empty', file.path, `Required resource ${requirement.id} is empty.`);\n    }\n    return {\n      id: requirement.id,\n      matchedPaths: matches.map((file) => file.path),\n      satisfied: matches.length > 0 && matches.every((file) => file.size > 0),\n    };\n  });\n  for (const pattern of policy.forbiddenPatterns ?? []) {\n    const invalid = pathProblem(pattern);\n    if (invalid) {\n      add('invalid-policy', pattern, invalid);\n      continue;\n    }\n    for (const file of inventory.files) {\n      if (posix.matchesGlob(file.path, pattern))\n        add('forbidden', file.path, `Selected file matches forbidden pattern ${pattern}.`);\n    }\n  }\n  let hashComparison: PackageArtifactValidation['hashComparison'] = 'not-requested';\n  for (const expected of policy.expectedFiles ?? []) {\n    const problems = fileProblems(expected);\n    for (const problem of problems) add('invalid-policy', expected.path, problem);\n    const actual = files.get(expected.path);\n    if (!actual) add('missing', expected.path, 'An independently expected file is missing.');\n    else if (actual.size !== expected.size)\n      add('mismatch', expected.path, 'File bytes differ from independently expected inventory.');\n    if (expected.sha256 !== undefined) {\n      if (hashComparison !== 'failed') hashComparison = 'matched';\n      if (problems.length || actual?.sha256 !== expected.sha256) {\n        hashComparison = 'failed';\n        add(\n          'mismatch',\n          expected.path,\n          'Actual hash is missing or differs from the independently expected SHA-256.',\n        );\n      }\n    }\n  }\n  for (const [field, limit] of Object.entries(policy.budgets)) {\n    if (!Number.isSafeInteger(limit) || limit < 0)\n      add('invalid-policy', field, 'Budget must be a nonnegative safe integer.');\n  }\n  if (inventory.packedBytes > policy.budgets.packedBytes)\n    add('budget', 'packedBytes', 'Packed bytes exceed the configured upper budget.');\n  if (unpackedBytes !== null && unpackedBytes > policy.budgets.unpackedBytes)\n    add('budget', 'unpackedBytes', 'Unpacked bytes exceed the configured upper budget.');\n  if (inventory.files.length > policy.budgets.fileCount)\n    add('budget', 'fileCount', 'Selected file count exceeds the configured upper budget.');\n  return {\n    valid: issues.length === 0,\n    inventory: { ...inventory, files: inventory.files.map((file) => ({ ...file })) },\n    unpackedBytes,\n    issues,\n    filesEntries: entries,\n    requirements,\n    hashComparison,\n    runtime: 'not-assessed',\n    limitations: [\n      'Manifest entries are classified only; the supplied packer inventory is the content authority.',\n      'Hashes are recorded and compared to supplied expected evidence; this validator does not read or authenticate tarball bytes.',\n      'Installability, module/dependency resolution, local-reference closure and native/dynamic runtime behavior are not assessed.',\n    ],\n  };\n}\n\n/**\n * Reject declaration and stray JavaScript output absent from the published CLI\n * bundle: only `build.mjs`'s declared entries (the CLI bundle and the hook\n * runtime) and their code-split chunks ({@link CLEO_CLI_CHUNK_PATTERN}) may ship\n * as `.js` under `dist/`.\n *\n * @param files - Actual selected package files, not a development directory listing.\n * @returns Concrete build-shape failures; this does not load the bundle.\n * @example\n * ```ts\n * assertCleoShippedBuildShape([{ path: 'dist/cli/index.js', size: 1 }]); // []\n * ```\n */\nexport function assertCleoShippedBuildShape(files: readonly PackageArtifactFile[]): string[] {\n  const reasons: string[] = [];\n  const dist = files.filter((file) => file.path.startsWith('dist/'));\n  const declarations = dist.filter(\n    (file) => file.path.endsWith('.d.ts') || file.path.endsWith('.d.ts.map'),\n  );\n  if (declarations.length)\n    reasons.push(\n      `${declarations.length} declaration file(s) under dist/ — the esbuild bundle emits none`,\n    );\n  const stray = dist.filter(\n    (file) =>\n      file.path.endsWith('.js') &&\n      !CLEO_SHIPPED_JS_ENTRIES.has(file.path) &&\n      !CLEO_CLI_CHUNK_PATTERN.test(file.path),\n  );\n  if (stray.length)\n    reasons.push(\n      `${stray.length} .js file(s) under dist/ outside the declared entries ${[...CLEO_SHIPPED_JS_ENTRIES].join(', ')} and their chunks, e.g. ${stray[0]?.path}`,\n    );\n  return reasons;\n}\n","/**\n * Skill integrity checking\n *\n * Validates that installed skills have intact symlinks, correct canonical paths,\n * and enforces ct-* prefix priority for CAAMP-shipped skills.\n */\n\nimport { existsSync, lstatSync, readlinkSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { resolveSkillsRoot } from '@cleocode/core/skills/skill-root.js';\nimport type { LockEntry, Provider } from '../../types.js';\nimport { readLockFile } from '../lock-utils.js';\nimport { resolveProviderSkillsDirs } from '../paths/standard.js';\n\n/** CAAMP-reserved skill prefix. Skills with this prefix are owned by CAAMP. */\nconst CAAMP_SKILL_PREFIX = 'ct-';\n\n/**\n * Status of a single skill's integrity check.\n *\n * @public\n */\nexport type SkillIntegrityStatus =\n  | 'intact'\n  | 'broken-symlink'\n  | 'missing-canonical'\n  | 'missing-link'\n  | 'not-tracked'\n  | 'tampered';\n\n/**\n * Result of checking a single skill's integrity.\n *\n * @public\n */\nexport interface SkillIntegrityResult {\n  /** Skill name. */\n  name: string;\n  /** Overall integrity status. */\n  status: SkillIntegrityStatus;\n  /** Whether the canonical directory exists. */\n  canonicalExists: boolean;\n  /** Expected canonical path from lock file. */\n  canonicalPath: string | null;\n  /** Provider link statuses — which agents have valid symlinks. */\n  linkStatuses: Array<{\n    providerId: string;\n    linkPath: string;\n    exists: boolean;\n    isSymlink: boolean;\n    pointsToCanonical: boolean;\n  }>;\n  /** Whether this is a CAAMP-reserved (ct-*) skill. */\n  isCaampOwned: boolean;\n  /** Human-readable issue description, if any. */\n  issue?: string;\n}\n\n/**\n * Check whether a skill name is reserved by CAAMP (ct-* prefix).\n *\n * @remarks\n * Skills with the `ct-` prefix are considered CAAMP-owned and receive\n * special treatment during installation conflict resolution.\n *\n * @param skillName - Skill name to check\n * @returns `true` if the skill name starts with `ct-`\n *\n * @example\n * ```typescript\n * isCaampOwnedSkill(\"ct-research-agent\"); // true\n * isCaampOwnedSkill(\"my-custom-skill\");   // false\n * ```\n *\n * @public\n */\nexport function isCaampOwnedSkill(skillName: string): boolean {\n  return skillName.startsWith(CAAMP_SKILL_PREFIX);\n}\n\n/**\n * Check the integrity of a single installed skill.\n *\n * @remarks\n * Validates that the canonical directory exists on disk, the lock file entry\n * matches the actual state, and symlinks from provider skill directories\n * point to the canonical path.\n *\n * @param skillName - Name of the skill to check\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Integrity check result\n *\n * @example\n * ```typescript\n * const result = await checkSkillIntegrity(\"ct-research-agent\", providers, \"global\");\n * if (result.status !== \"intact\") {\n *   console.log(`Issue: ${result.issue}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkSkillIntegrity(\n  skillName: string,\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<SkillIntegrityResult> {\n  const lock = await readLockFile();\n  const entry = lock.skills[skillName];\n  const isCaampOwned = isCaampOwnedSkill(skillName);\n\n  // Not tracked in lock file\n  if (!entry) {\n    const canonicalPath = join(resolveSkillsRoot(), skillName);\n    return {\n      name: skillName,\n      status: 'not-tracked',\n      canonicalExists: existsSync(canonicalPath),\n      canonicalPath: null,\n      linkStatuses: [],\n      isCaampOwned,\n      issue: 'Skill is not tracked in the CAAMP lock file',\n    };\n  }\n\n  const canonicalPath = entry.canonicalPath;\n  const canonicalExists = existsSync(canonicalPath);\n\n  // Check symlinks for each provider\n  const linkStatuses: SkillIntegrityResult['linkStatuses'] = [];\n\n  for (const provider of providers) {\n    const targetDirs = resolveProviderSkillsDirs(provider, scope, projectDir);\n    for (const skillsDir of targetDirs) {\n      if (!skillsDir) continue;\n\n      const linkPath = join(skillsDir, skillName);\n      const exists = existsSync(linkPath);\n      let isSymlink = false;\n      let pointsToCanonical = false;\n\n      if (exists) {\n        try {\n          const stat = lstatSync(linkPath);\n          isSymlink = stat.isSymbolicLink();\n          if (isSymlink) {\n            const target = resolve(readlinkSync(linkPath));\n            pointsToCanonical = target === resolve(canonicalPath);\n          }\n        } catch {\n          // Can't stat — treat as broken\n        }\n      }\n\n      linkStatuses.push({\n        providerId: provider.id,\n        linkPath,\n        exists,\n        isSymlink,\n        pointsToCanonical,\n      });\n    }\n  }\n\n  // Determine overall status\n  if (!canonicalExists) {\n    return {\n      name: skillName,\n      status: 'missing-canonical',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `Canonical directory missing: ${canonicalPath}`,\n    };\n  }\n\n  const brokenLinks = linkStatuses.filter((l) => !l.exists);\n  const tamperedLinks = linkStatuses.filter((l) => l.exists && !l.pointsToCanonical);\n\n  if (tamperedLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'tampered',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${tamperedLinks.length} link(s) do not point to canonical path`,\n    };\n  }\n\n  if (brokenLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'broken-symlink',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${brokenLinks.length} symlink(s) missing`,\n    };\n  }\n\n  return {\n    name: skillName,\n    status: 'intact',\n    canonicalExists,\n    canonicalPath,\n    linkStatuses,\n    isCaampOwned,\n  };\n}\n\n/**\n * Check integrity of all tracked skills.\n *\n * @remarks\n * Iterates over every skill in the lock file and runs\n * {@link checkSkillIntegrity} on each.\n *\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Map of skill name to integrity result\n *\n * @example\n * ```typescript\n * const results = await checkAllSkillIntegrity(providers);\n * for (const [name, result] of results) {\n *   console.log(`${name}: ${result.status}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkAllSkillIntegrity(\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<Map<string, SkillIntegrityResult>> {\n  const lock = await readLockFile();\n  const results = new Map<string, SkillIntegrityResult>();\n\n  for (const skillName of Object.keys(lock.skills)) {\n    const result = await checkSkillIntegrity(skillName, providers, scope, projectDir);\n    results.set(skillName, result);\n  }\n\n  return results;\n}\n\n/**\n * Resolve a skill name conflict where a user-installed skill collides\n * with a CAAMP-owned (ct-*) skill.\n *\n * @remarks\n * CAAMP-owned skills always win. Returns `true` if the incoming skill\n * should take precedence over the existing installation.\n *\n * @param skillName - Skill name to check\n * @param incomingSource - Source of the incoming skill installation\n * @param existingEntry - Existing lock entry, if any\n * @returns `true` if the incoming installation should proceed\n *\n * @example\n * ```typescript\n * const proceed = shouldOverrideSkill(\"ct-research-agent\", \"library\", existingEntry);\n * if (proceed) {\n *   // Safe to install/override\n * }\n * ```\n *\n * @public\n */\nexport function shouldOverrideSkill(\n  skillName: string,\n  incomingSource: string,\n  existingEntry: LockEntry | undefined,\n): boolean {\n  // No existing entry — always allow\n  if (!existingEntry) return true;\n\n  // For ct-* skills, CAAMP package source always wins\n  if (isCaampOwnedSkill(skillName)) {\n    // If incoming is from CAAMP package (library source), it always wins\n    if (existingEntry.sourceType === 'library') return true;\n    // If existing is from CAAMP but incoming is user, CAAMP wins (block user)\n    return true;\n  }\n\n  // Non-ct-* skills: user always wins\n  return true;\n}\n\n/**\n * Validate instruction file injection status across all providers.\n *\n * @remarks\n * Checks that CAAMP blocks exist and are current in all relevant\n * instruction files (CLAUDE.md, AGENTS.md, GEMINI.md).\n *\n * @param providers - Providers to check\n * @param projectDir - Project directory\n * @param scope - Whether to check global or project files\n * @param expectedContent - Expected CAAMP block content\n * @returns Array of file paths with issues\n *\n * @example\n * ```typescript\n * const issues = await validateInstructionIntegrity(providers, process.cwd(), \"project\");\n * for (const issue of issues) {\n *   console.log(`${issue.providerId}: ${issue.issue} (${issue.file})`);\n * }\n * ```\n *\n * @public\n */\nexport async function validateInstructionIntegrity(\n  providers: Provider[],\n  projectDir: string,\n  scope: 'project' | 'global',\n  expectedContent?: string,\n): Promise<Array<{ file: string; providerId: string; issue: string }>> {\n  const { checkAllInjections } = await import('../instructions/injector.js');\n  const results = await checkAllInjections(providers, projectDir, scope, expectedContent);\n  const issues: Array<{ file: string; providerId: string; issue: string }> = [];\n\n  for (const result of results) {\n    if (result.status === 'missing') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'Instruction file does not exist',\n      });\n    } else if (result.status === 'none') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'No CAAMP injection block found',\n      });\n    } else if (result.status === 'outdated') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'CAAMP injection block is outdated',\n      });\n    }\n  }\n\n  return issues;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,SAAS,aAAa;AAaf,IAAM,wBAA0D,OAAO,OAAO;AAAA,EACnF,aAAa,KAAK,OAAO;AAAA,EACzB,eAAe,KAAK,OAAO;AAAA,EAC3B,WAAW;AACb,CAAC;AASD,IAAM,0BAA+C,oBAAI,IAAI;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,IAAM,yBAAiC;AAGvC,IAAM,6BAAoE,OAAO,OAAO;AAAA,EAC7F,EAAE,IAAI,aAAa,MAAM,qBAAqB,OAAO,QAAQ;AAAA,EAC7D,EAAE,IAAI,kBAAkB,MAAM,0BAA0B,OAAO,QAAQ;AAAA,EACvE,EAAE,IAAI,0BAA0B,MAAM,kCAAkC,OAAO,QAAQ;AAAA,EACvF,EAAE,IAAI,uBAAuB,MAAM,wBAAwB,OAAO,QAAQ;AAAA,EAC1E,EAAE,IAAI,kBAAkB,MAAM,0BAA0B,OAAO,QAAQ;AAAA,EACvE,EAAE,IAAI,iBAAiB,MAAM,+BAA+B,OAAO,QAAQ;AAAA,EAC3E,EAAE,IAAI,mBAAmB,MAAM,kCAAkC,OAAO,QAAQ;AAAA,EAChF;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AACF,CAAC;AAED,IAAM,SAAS;AACf,IAAM,OAAO;AAEb,SAAS,YAAY,MAA6B;AAChD,MAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,KAAM,QAAO;AAC1C,MAAI,KAAK,SAAS,IAAI,KAAK,kBAAkB,KAAK,IAAI;AACpD,WAAO;AACT,MAAI,MAAM,WAAW,IAAI,KAAK,aAAa,KAAK,IAAI;AAClD,WAAO;AACT,MAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAYO,SAAS,0BAA0B,OAAkC;AAC1E,QAAM,YAAY,MAAM,WAAW,GAAG;AACtC,QAAM,WAAW,YAAY,MAAM,MAAM,CAAC,IAAI,OAAO,QAAQ,SAAS,EAAE,EAAE,QAAQ,OAAO,EAAE;AAC3F,QAAM,SAAS,QAAQ,WAAW,GAAG,IACjC,iDACA,YAAY,OAAO;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,SAAS,YAAY,YAAY,cAAc,KAAK,KAAK,OAAO,IAAI,SAAS;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAqC;AACzD,QAAM,WAAqB,CAAC;AAC5B,QAAM,YAAY,YAAY,KAAK,IAAI;AACvC,MAAI,UAAW,UAAS,KAAK,SAAS;AACtC,MAAI,CAAC,OAAO,cAAc,KAAK,IAAI,KAAK,KAAK,OAAO;AAClD,aAAS,KAAK,+CAA+C;AAC/D,MAAI,KAAK,WAAW,UAAa,CAAC,OAAO,KAAK,KAAK,MAAM;AACvD,aAAS,KAAK,2DAA2D;AAC3E,SAAO;AACT;AAiBO,SAAS,wBACd,WACA,QAC2B;AAC3B,QAAM,SAAiC,CAAC;AACxC,QAAM,MAAM,CAAC,MAAoC,SAAiB,YAA0B;AAC1F,WAAO,KAAK,EAAE,MAAM,SAAS,QAAQ,CAAC;AAAA,EACxC;AACA,MAAI,CAAC,UAAU,YAAY,KAAK,KAAK,CAAC,UAAU,QAAQ,KAAK,GAAG;AAC9D,QAAI,qBAAqB,YAAY,4CAA4C;AAAA,EACnF;AACA,MAAI,CAAC,CAAC,YAAY,oBAAoB,SAAS,EAAE,SAAS,UAAU,MAAM,GAAG;AAC3E,QAAI,qBAAqB,UAAU,yCAAyC;AAAA,EAC9E;AACA,MAAI,CAAC,OAAO,cAAc,UAAU,WAAW,KAAK,UAAU,cAAc,GAAG;AAC7E,QAAI,qBAAqB,eAAe,kDAAkD;AAAA,EAC5F;AACA,MAAI,UAAU,kBAAkB,UAAa,CAAC,OAAO,KAAK,UAAU,aAAa,GAAG;AAClF;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,WAAW,sBAAsB,UAAU,kBAAkB,QAAW;AACpF;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,oBAAI,IAAiC;AACnD,MAAI,gBAA+B;AACnC,aAAW,QAAQ,UAAU,OAAO;AAClC,eAAW,WAAW,aAAa,IAAI,EAAG,KAAI,qBAAqB,KAAK,MAAM,OAAO;AACrF,QAAI,MAAM,IAAI,KAAK,IAAI,EAAG,KAAI,qBAAqB,KAAK,MAAM,2BAA2B;AACzF,UAAM,IAAI,KAAK,MAAM,IAAI;AACzB,QAAI,kBAAkB,MAAM;AAC1B,YAAM,QAAgB,gBAAgB,KAAK;AAC3C,sBAAgB,OAAO,cAAc,KAAK,KAAK,KAAK,QAAQ,IAAI,QAAQ;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,kBAAkB;AACpB,QAAI,qBAAqB,iBAAiB,sCAAsC;AAClF,QAAM,WAAW,OAAO,gBAAgB,CAAC,GAAG,IAAI,yBAAyB;AACzE,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,OAAQ,KAAI,kBAAkB,MAAM,OAAO,MAAM,MAAM;AAAA,EACnE;AACA,MAAI,CAAC,OAAO,aAAa;AACvB,QAAI,kBAAkB,gBAAgB,wDAAwD;AAChG,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,eAAe,OAAO,aAAa,IAAI,CAAC,gBAAgB;AAC5D,UAAM,UAAU,YAAY,YAAY,IAAI;AAC5C,UAAM,YAAY,IAAI,IAAI,YAAY,EAAE;AACxC,QAAI,IAAI,YAAY,EAAE;AACtB,QACE,CAAC,YAAY,GAAG,KAAK,KACrB,aACA,WACA,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,YAAY,KAAK,GAC7C;AACA;AAAA,QACE;AAAA,QACA,YAAY;AAAA,QACZ,WAAW;AAAA,MACb;AACA,aAAO,EAAE,IAAI,YAAY,IAAI,cAAc,CAAC,GAAG,WAAW,MAAM;AAAA,IAClE;AACA,UAAM,UAAU,UAAU,MAAM;AAAA,MAAO,CAAC,SACtC,YAAY,UAAU,UAClB,KAAK,SAAS,YAAY,OAC1B,MAAM,YAAY,KAAK,MAAM,YAAY,IAAI;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ;AACX;AAAA,QACE;AAAA,QACA,YAAY;AAAA,QACZ,qBAAqB,YAAY,IAAI;AAAA,MACvC;AACF,eAAW,QAAQ,SAAS;AAC1B,UAAI,KAAK,SAAS,EAAG,KAAI,SAAS,KAAK,MAAM,qBAAqB,YAAY,EAAE,YAAY;AAAA,IAC9F;AACA,WAAO;AAAA,MACL,IAAI,YAAY;AAAA,MAChB,cAAc,QAAQ,IAAI,CAAC,SAAS,KAAK,IAAI;AAAA,MAC7C,WAAW,QAAQ,SAAS,KAAK,QAAQ,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC;AAAA,IACxE;AAAA,EACF,CAAC;AACD,aAAW,WAAW,OAAO,qBAAqB,CAAC,GAAG;AACpD,UAAM,UAAU,YAAY,OAAO;AACnC,QAAI,SAAS;AACX,UAAI,kBAAkB,SAAS,OAAO;AACtC;AAAA,IACF;AACA,eAAW,QAAQ,UAAU,OAAO;AAClC,UAAI,MAAM,YAAY,KAAK,MAAM,OAAO;AACtC,YAAI,aAAa,KAAK,MAAM,2CAA2C,OAAO,GAAG;AAAA,IACrF;AAAA,EACF;AACA,MAAI,iBAA8D;AAClE,aAAW,YAAY,OAAO,iBAAiB,CAAC,GAAG;AACjD,UAAM,WAAW,aAAa,QAAQ;AACtC,eAAW,WAAW,SAAU,KAAI,kBAAkB,SAAS,MAAM,OAAO;AAC5E,UAAM,SAAS,MAAM,IAAI,SAAS,IAAI;AACtC,QAAI,CAAC,OAAQ,KAAI,WAAW,SAAS,MAAM,4CAA4C;AAAA,aAC9E,OAAO,SAAS,SAAS;AAChC,UAAI,YAAY,SAAS,MAAM,0DAA0D;AAC3F,QAAI,SAAS,WAAW,QAAW;AACjC,UAAI,mBAAmB,SAAU,kBAAiB;AAClD,UAAI,SAAS,UAAU,QAAQ,WAAW,SAAS,QAAQ;AACzD,yBAAiB;AACjB;AAAA,UACE;AAAA,UACA,SAAS;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AAC3D,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ;AAC1C,UAAI,kBAAkB,OAAO,4CAA4C;AAAA,EAC7E;AACA,MAAI,UAAU,cAAc,OAAO,QAAQ;AACzC,QAAI,UAAU,eAAe,kDAAkD;AACjF,MAAI,kBAAkB,QAAQ,gBAAgB,OAAO,QAAQ;AAC3D,QAAI,UAAU,iBAAiB,oDAAoD;AACrF,MAAI,UAAU,MAAM,SAAS,OAAO,QAAQ;AAC1C,QAAI,UAAU,aAAa,0DAA0D;AACvF,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,WAAW,EAAE,GAAG,WAAW,OAAO,UAAU,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,EAAE,EAAE;AAAA,IAC/E;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAeO,SAAS,4BAA4B,OAAiD;AAC3F,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,MAAM,OAAO,CAAC,SAAS,KAAK,KAAK,WAAW,OAAO,CAAC;AACjE,QAAM,eAAe,KAAK;AAAA,IACxB,CAAC,SAAS,KAAK,KAAK,SAAS,OAAO,KAAK,KAAK,KAAK,SAAS,WAAW;AAAA,EACzE;AACA,MAAI,aAAa;AACf,YAAQ;AAAA,MACN,GAAG,aAAa,MAAM;AAAA,IACxB;AACF,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,SACC,KAAK,KAAK,SAAS,KAAK,KACxB,CAAC,wBAAwB,IAAI,KAAK,IAAI,KACtC,CAAC,uBAAuB,KAAK,KAAK,IAAI;AAAA,EAC1C;AACA,MAAI,MAAM;AACR,YAAQ;AAAA,MACN,GAAG,MAAM,MAAM,yDAAyD,CAAC,GAAG,uBAAuB,EAAE,KAAK,IAAI,CAAC,2BAA2B,MAAM,CAAC,GAAG,IAAI;AAAA,IAC1J;AACF,SAAO;AACT;;;ACxTA,SAAS,YAAY,WAAW,oBAAoB;AACpD,SAAS,MAAM,eAAe;AAC9B,SAAS,yBAAyB;AAMlC,IAAM,qBAAqB;AA6DpB,SAAS,kBAAkB,WAA4B;AAC5D,SAAO,UAAU,WAAW,kBAAkB;AAChD;AA0BA,eAAsB,oBACpB,WACA,WACA,QAA8B,UAC9B,YAC+B;AAC/B,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,QAAQ,KAAK,OAAO,SAAS;AACnC,QAAM,eAAe,kBAAkB,SAAS;AAGhD,MAAI,CAAC,OAAO;AACV,UAAMA,iBAAgB,KAAK,kBAAkB,GAAG,SAAS;AACzD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,iBAAiB,WAAWA,cAAa;AAAA,MACzC,eAAe;AAAA,MACf,cAAc,CAAC;AAAA,MACf;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAC5B,QAAM,kBAAkB,WAAW,aAAa;AAGhD,QAAM,eAAqD,CAAC;AAE5D,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,0BAA0B,UAAU,OAAO,UAAU;AACxE,eAAW,aAAa,YAAY;AAClC,UAAI,CAAC,UAAW;AAEhB,YAAM,WAAW,KAAK,WAAW,SAAS;AAC1C,YAAM,SAAS,WAAW,QAAQ;AAClC,UAAI,YAAY;AAChB,UAAI,oBAAoB;AAExB,UAAI,QAAQ;AACV,YAAI;AACF,gBAAM,OAAO,UAAU,QAAQ;AAC/B,sBAAY,KAAK,eAAe;AAChC,cAAI,WAAW;AACb,kBAAM,SAAS,QAAQ,aAAa,QAAQ,CAAC;AAC7C,gCAAoB,WAAW,QAAQ,aAAa;AAAA,UACtD;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,mBAAa,KAAK;AAAA,QAChB,YAAY,SAAS;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,CAAC,iBAAiB;AACpB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,gCAAgC,aAAa;AAAA,IACtD;AAAA,EACF;AAEA,QAAM,cAAc,aAAa,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACxD,QAAM,gBAAgB,aAAa,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,iBAAiB;AAEjF,MAAI,cAAc,SAAS,GAAG;AAC5B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,cAAc,MAAM;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,YAAY,MAAM;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAwBA,eAAsB,uBACpB,WACA,QAA8B,UAC9B,YAC4C;AAC5C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,oBAAI,IAAkC;AAEtD,aAAW,aAAa,OAAO,KAAK,KAAK,MAAM,GAAG;AAChD,UAAM,SAAS,MAAM,oBAAoB,WAAW,WAAW,OAAO,UAAU;AAChF,YAAQ,IAAI,WAAW,MAAM;AAAA,EAC/B;AAEA,SAAO;AACT;AAyBO,SAAS,oBACd,WACA,gBACA,eACS;AAET,MAAI,CAAC,cAAe,QAAO;AAG3B,MAAI,kBAAkB,SAAS,GAAG;AAEhC,QAAI,cAAc,eAAe,UAAW,QAAO;AAEnD,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAyBA,eAAsB,6BACpB,WACA,YACA,OACA,iBACqE;AACrE,QAAM,EAAE,oBAAAC,oBAAmB,IAAI,MAAM,OAAO,wBAA6B;AACzE,QAAM,UAAU,MAAMA,oBAAmB,WAAW,YAAY,OAAO,eAAe;AACtF,QAAM,SAAqE,CAAC;AAE5E,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,WAAW;AAC/B,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,QAAQ;AACnC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,YAAY;AACvC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["canonicalPath","checkAllInjections"]}
+{"version":3,"sources":["../src/core/artifacts/validation.ts","../src/core/skills/integrity.ts"],"sourcesContent":["/**\n * Pure semantic validation of npm-produced package inventories.\n *\n * Code placed in `packages/caamp/` per Package-Boundary Check — verified\n * against AGENTS.md. No filesystem, process, model, or runtime-store access.\n */\n\nimport { posix } from 'node:path';\nimport type {\n  PackageArtifactBudgets,\n  PackageArtifactFile,\n  PackageArtifactInventory,\n  PackageArtifactIssue,\n  PackageArtifactPolicy,\n  PackageArtifactRequirement,\n  PackageArtifactValidation,\n  PackageFilesEntry,\n} from '@cleocode/contracts/package-artifact';\n\n/** Existing CLI upper budgets: 20 MiB packed, 36 MiB unpacked, and 800 files. */\nexport const CLEO_ARTIFACT_BUDGETS: Readonly<PackageArtifactBudgets> = Object.freeze({\n  packedBytes: 20 * 1024 * 1024,\n  unpackedBytes: 36 * 1024 * 1024,\n  fileCount: 800,\n});\n\n/**\n * The JavaScript files `build.mjs` declares for the published CLI: the CLI\n * bundle, the provider hook runtime that `bin/cleo.js` imports directly for\n * `cleo hook heavy-command` (T12983), skipping the CLI bootstrap, and the\n * detached dist-tags check the CLI spawns for its update notice (T13137), and\n * the shared project-hook adapter hot path (T13344). Any\n * other `.js` under `dist/` is development output.\n */\nconst CLEO_SHIPPED_JS_ENTRIES: ReadonlySet<string> = new Set([\n  'dist/cli/index.js',\n  'dist/cli/hook-entry.js',\n  'dist/cli/update-check-entry.js',\n  'dist/cli/project-hook-entry.js',\n]);\n\n/**\n * A code-split chunk of the CLI bundle (T13126): `dist/cli/<name>-<HASH>.js`,\n * where `<HASH>` is esbuild's 8-character content hash.\n *\n * `build.mjs` bundles the CLI with `splitting` so each `import()` loads its own\n * chunk instead of the whole CLI and all of CORE at startup. Its\n * `CLEO_CHUNK_NAMES` (`cli/[name]-[hash]`) writes every chunk directly beside\n * `cli/index.js`; change both together. A chunk in any other directory is not\n * build output and stays rejected. `<name>` is the source file's basename in\n * any case (T13159): a source file named `TaskCard.ts` must not fail the\n * artifact check.\n */\nexport const CLEO_CLI_CHUNK_PATTERN: RegExp = /^dist\\/cli\\/[A-Za-z0-9_.-]+-[A-Z0-9]{8}\\.js$/;\n\n/** Required CLI and adapter-node resources, independent of historical byte/file-count floors. */\nexport const CLEO_ARTIFACT_REQUIREMENTS: readonly PackageArtifactRequirement[] = Object.freeze([\n  { id: 'cli-entry', path: 'dist/cli/index.js', match: 'exact' },\n  { id: 'cli-hook-entry', path: 'dist/cli/hook-entry.js', match: 'exact' },\n  { id: 'cli-update-check-entry', path: 'dist/cli/update-check-entry.js', match: 'exact' },\n  { id: 'cli-project-hook-entry', path: 'dist/cli/project-hook-entry.js', match: 'exact' },\n  { id: 'studio-server-entry', path: 'studio-dist/index.js', match: 'exact' },\n  { id: 'studio-handler', path: 'studio-dist/handler.js', match: 'exact' },\n  { id: 'studio-server', path: 'studio-dist/server/index.js', match: 'exact' },\n  { id: 'studio-manifest', path: 'studio-dist/server/manifest.js', match: 'exact' },\n  {\n    id: 'studio-client-start',\n    path: 'studio-dist/client/_app/immutable/entry/start.*.js',\n    match: 'glob',\n  },\n  {\n    id: 'studio-client-app',\n    path: 'studio-dist/client/_app/immutable/entry/app.*.js',\n    match: 'glob',\n  },\n]);\n\nconst SHA256 = /^[a-f0-9]{64}$/;\nconst GLOB = /[*?{}[\\]]|[+@!]\\(/;\n\nfunction pathProblem(path: string): string | null {\n  if (!path || path.trim() !== path) return 'Path is empty or has surrounding whitespace.';\n  if (path.includes('\\\\') || /[\\x00-\\x1f\\x7f]/.test(path))\n    return 'Path is not a portable POSIX package path.';\n  if (posix.isAbsolute(path) || /^[A-Za-z]:/.test(path))\n    return 'Path must be relative to the package.';\n  if (path.split('/').some((part) => !part || part === '.' || part === '..')) {\n    return 'Path must not contain empty, current-directory, or parent-directory segments.';\n  }\n  return null;\n}\n\n/**\n * Classify a manifest files entry without evaluating exclusions as disk paths.\n *\n * @param entry - Original npm manifest entry.\n * @returns Classification only; actual selected content must come from the packer.\n * @example\n * ```ts\n * classifyPackageFilesEntry('!dist/index.js.map').kind; // 'exclusion'\n * ```\n */\nexport function classifyPackageFilesEntry(entry: string): PackageFilesEntry {\n  const exclusion = entry.startsWith('!');\n  const pattern = (exclusion ? entry.slice(1) : entry).replace(/^\\.\\//, '').replace(/\\/$/, '');\n  const reason = pattern.startsWith('!')\n    ? 'Repeated exclusion markers are not assessed.'\n    : pathProblem(pattern);\n  return {\n    entry,\n    pattern,\n    kind: reason ? 'invalid' : exclusion ? 'exclusion' : GLOB.test(pattern) ? 'glob' : 'literal',\n    reason,\n  };\n}\n\nfunction fileProblems(file: PackageArtifactFile): string[] {\n  const problems: string[] = [];\n  const pathError = pathProblem(file.path);\n  if (pathError) problems.push(pathError);\n  if (!Number.isSafeInteger(file.size) || file.size < 0)\n    problems.push('File size must be a nonnegative safe integer.');\n  if (file.sha256 !== undefined && !SHA256.test(file.sha256))\n    problems.push('File SHA-256 must be 64 lowercase hexadecimal characters.');\n  return problems;\n}\n\n/**\n * Validate nonempty semantic resources, inventory identity, expected hashes and upper budgets.\n *\n * @param inventory - Packer-produced evidence or an explicitly identified fixture.\n * @param policy - Independently specified resources, expected files and cost ceilings.\n * @returns A copied evidence receipt; valid means only the supplied checks passed.\n * @example\n * ```ts\n * const result = validatePackageArtifact(inventory, {\n *   requirements: CLEO_ARTIFACT_REQUIREMENTS,\n *   budgets: CLEO_ARTIFACT_BUDGETS,\n * });\n * // result.runtime remains 'not-assessed', even when result.valid is true.\n * ```\n */\nexport function validatePackageArtifact(\n  inventory: PackageArtifactInventory,\n  policy: PackageArtifactPolicy,\n): PackageArtifactValidation {\n  const issues: PackageArtifactIssue[] = [];\n  const add = (code: PackageArtifactIssue['code'], subject: string, message: string): void => {\n    issues.push({ code, subject, message });\n  };\n  if (!inventory.packageName.trim() || !inventory.version.trim()) {\n    add('invalid-inventory', 'identity', 'Package name and version must be recorded.');\n  }\n  if (!['npm-pack', 'npm-pack-dry-run', 'fixture'].includes(inventory.source)) {\n    add('invalid-inventory', 'source', 'Inventory provenance is not recognized.');\n  }\n  if (!Number.isSafeInteger(inventory.packedBytes) || inventory.packedBytes < 0) {\n    add('invalid-inventory', 'packedBytes', 'Packed bytes must be a nonnegative safe integer.');\n  }\n  if (inventory.tarballSha256 !== undefined && !SHA256.test(inventory.tarballSha256)) {\n    add(\n      'invalid-inventory',\n      'tarballSha256',\n      'Tarball SHA-256 must be 64 lowercase hexadecimal characters.',\n    );\n  }\n  if (inventory.source === 'npm-pack-dry-run' && inventory.tarballSha256 !== undefined) {\n    add(\n      'invalid-inventory',\n      'tarballSha256',\n      'A dry run cannot establish a retained tarball hash.',\n    );\n  }\n  const files = new Map<string, PackageArtifactFile>();\n  let unpackedBytes: number | null = 0;\n  for (const file of inventory.files) {\n    for (const problem of fileProblems(file)) add('invalid-inventory', file.path, problem);\n    if (files.has(file.path)) add('invalid-inventory', file.path, 'Duplicate inventory path.');\n    files.set(file.path, file);\n    if (unpackedBytes !== null) {\n      const total: number = unpackedBytes + file.size;\n      unpackedBytes = Number.isSafeInteger(total) && file.size >= 0 ? total : null;\n    }\n  }\n  if (unpackedBytes === null)\n    add('invalid-inventory', 'unpackedBytes', 'File bytes cannot be safely totaled.');\n  const entries = (policy.filesEntries ?? []).map(classifyPackageFilesEntry);\n  for (const entry of entries) {\n    if (entry.reason) add('invalid-policy', entry.entry, entry.reason);\n  }\n  if (!policy.requirements.length)\n    add('invalid-policy', 'requirements', 'At least one semantic content requirement is required.');\n  const ids = new Set<string>();\n  const requirements = policy.requirements.map((requirement) => {\n    const invalid = pathProblem(requirement.path);\n    const duplicate = ids.has(requirement.id);\n    ids.add(requirement.id);\n    if (\n      !requirement.id.trim() ||\n      duplicate ||\n      invalid ||\n      !['exact', 'glob'].includes(requirement.match)\n    ) {\n      add(\n        'invalid-policy',\n        requirement.id,\n        invalid ?? 'Requirement identity or match mode is invalid or duplicated.',\n      );\n      return { id: requirement.id, matchedPaths: [], satisfied: false };\n    }\n    const matches = inventory.files.filter((file) =>\n      requirement.match === 'exact'\n        ? file.path === requirement.path\n        : posix.matchesGlob(file.path, requirement.path),\n    );\n    if (!matches.length)\n      add(\n        'missing',\n        requirement.id,\n        `Required resource ${requirement.path} is absent from the selected inventory.`,\n      );\n    for (const file of matches) {\n      if (file.size === 0) add('empty', file.path, `Required resource ${requirement.id} is empty.`);\n    }\n    return {\n      id: requirement.id,\n      matchedPaths: matches.map((file) => file.path),\n      satisfied: matches.length > 0 && matches.every((file) => file.size > 0),\n    };\n  });\n  for (const pattern of policy.forbiddenPatterns ?? []) {\n    const invalid = pathProblem(pattern);\n    if (invalid) {\n      add('invalid-policy', pattern, invalid);\n      continue;\n    }\n    for (const file of inventory.files) {\n      if (posix.matchesGlob(file.path, pattern))\n        add('forbidden', file.path, `Selected file matches forbidden pattern ${pattern}.`);\n    }\n  }\n  let hashComparison: PackageArtifactValidation['hashComparison'] = 'not-requested';\n  for (const expected of policy.expectedFiles ?? []) {\n    const problems = fileProblems(expected);\n    for (const problem of problems) add('invalid-policy', expected.path, problem);\n    const actual = files.get(expected.path);\n    if (!actual) add('missing', expected.path, 'An independently expected file is missing.');\n    else if (actual.size !== expected.size)\n      add('mismatch', expected.path, 'File bytes differ from independently expected inventory.');\n    if (expected.sha256 !== undefined) {\n      if (hashComparison !== 'failed') hashComparison = 'matched';\n      if (problems.length || actual?.sha256 !== expected.sha256) {\n        hashComparison = 'failed';\n        add(\n          'mismatch',\n          expected.path,\n          'Actual hash is missing or differs from the independently expected SHA-256.',\n        );\n      }\n    }\n  }\n  for (const [field, limit] of Object.entries(policy.budgets)) {\n    if (!Number.isSafeInteger(limit) || limit < 0)\n      add('invalid-policy', field, 'Budget must be a nonnegative safe integer.');\n  }\n  if (inventory.packedBytes > policy.budgets.packedBytes)\n    add('budget', 'packedBytes', 'Packed bytes exceed the configured upper budget.');\n  if (unpackedBytes !== null && unpackedBytes > policy.budgets.unpackedBytes)\n    add('budget', 'unpackedBytes', 'Unpacked bytes exceed the configured upper budget.');\n  if (inventory.files.length > policy.budgets.fileCount)\n    add('budget', 'fileCount', 'Selected file count exceeds the configured upper budget.');\n  return {\n    valid: issues.length === 0,\n    inventory: { ...inventory, files: inventory.files.map((file) => ({ ...file })) },\n    unpackedBytes,\n    issues,\n    filesEntries: entries,\n    requirements,\n    hashComparison,\n    runtime: 'not-assessed',\n    limitations: [\n      'Manifest entries are classified only; the supplied packer inventory is the content authority.',\n      'Hashes are recorded and compared to supplied expected evidence; this validator does not read or authenticate tarball bytes.',\n      'Installability, module/dependency resolution, local-reference closure and native/dynamic runtime behavior are not assessed.',\n    ],\n  };\n}\n\n/**\n * Reject declaration and stray JavaScript output absent from the published CLI\n * bundle: only `build.mjs`'s declared entries (the CLI bundle and the hook\n * runtime) and their code-split chunks ({@link CLEO_CLI_CHUNK_PATTERN}) may ship\n * as `.js` under `dist/`.\n *\n * @param files - Actual selected package files, not a development directory listing.\n * @returns Concrete build-shape failures; this does not load the bundle.\n * @example\n * ```ts\n * assertCleoShippedBuildShape([{ path: 'dist/cli/index.js', size: 1 }]); // []\n * ```\n */\nexport function assertCleoShippedBuildShape(files: readonly PackageArtifactFile[]): string[] {\n  const reasons: string[] = [];\n  const dist = files.filter((file) => file.path.startsWith('dist/'));\n  const declarations = dist.filter(\n    (file) => file.path.endsWith('.d.ts') || file.path.endsWith('.d.ts.map'),\n  );\n  if (declarations.length)\n    reasons.push(\n      `${declarations.length} declaration file(s) under dist/ — the esbuild bundle emits none`,\n    );\n  const stray = dist.filter(\n    (file) =>\n      file.path.endsWith('.js') &&\n      !CLEO_SHIPPED_JS_ENTRIES.has(file.path) &&\n      !CLEO_CLI_CHUNK_PATTERN.test(file.path),\n  );\n  if (stray.length)\n    reasons.push(\n      `${stray.length} .js file(s) under dist/ outside the declared entries ${[...CLEO_SHIPPED_JS_ENTRIES].join(', ')} and their chunks, e.g. ${stray[0]?.path}`,\n    );\n  return reasons;\n}\n","/**\n * Skill integrity checking\n *\n * Validates that installed skills have intact symlinks, correct canonical paths,\n * and enforces ct-* prefix priority for CAAMP-shipped skills.\n */\n\nimport { existsSync, lstatSync, readlinkSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { resolveSkillsRoot } from '@cleocode/core/skills/skill-root.js';\nimport type { LockEntry, Provider } from '../../types.js';\nimport { readLockFile } from '../lock-utils.js';\nimport { resolveProviderSkillsDirs } from '../paths/standard.js';\n\n/** CAAMP-reserved skill prefix. Skills with this prefix are owned by CAAMP. */\nconst CAAMP_SKILL_PREFIX = 'ct-';\n\n/**\n * Status of a single skill's integrity check.\n *\n * @public\n */\nexport type SkillIntegrityStatus =\n  | 'intact'\n  | 'broken-symlink'\n  | 'missing-canonical'\n  | 'missing-link'\n  | 'not-tracked'\n  | 'tampered';\n\n/**\n * Result of checking a single skill's integrity.\n *\n * @public\n */\nexport interface SkillIntegrityResult {\n  /** Skill name. */\n  name: string;\n  /** Overall integrity status. */\n  status: SkillIntegrityStatus;\n  /** Whether the canonical directory exists. */\n  canonicalExists: boolean;\n  /** Expected canonical path from lock file. */\n  canonicalPath: string | null;\n  /** Provider link statuses — which agents have valid symlinks. */\n  linkStatuses: Array<{\n    providerId: string;\n    linkPath: string;\n    exists: boolean;\n    isSymlink: boolean;\n    pointsToCanonical: boolean;\n  }>;\n  /** Whether this is a CAAMP-reserved (ct-*) skill. */\n  isCaampOwned: boolean;\n  /** Human-readable issue description, if any. */\n  issue?: string;\n}\n\n/**\n * Check whether a skill name is reserved by CAAMP (ct-* prefix).\n *\n * @remarks\n * Skills with the `ct-` prefix are considered CAAMP-owned and receive\n * special treatment during installation conflict resolution.\n *\n * @param skillName - Skill name to check\n * @returns `true` if the skill name starts with `ct-`\n *\n * @example\n * ```typescript\n * isCaampOwnedSkill(\"ct-research-agent\"); // true\n * isCaampOwnedSkill(\"my-custom-skill\");   // false\n * ```\n *\n * @public\n */\nexport function isCaampOwnedSkill(skillName: string): boolean {\n  return skillName.startsWith(CAAMP_SKILL_PREFIX);\n}\n\n/**\n * Check the integrity of a single installed skill.\n *\n * @remarks\n * Validates that the canonical directory exists on disk, the lock file entry\n * matches the actual state, and symlinks from provider skill directories\n * point to the canonical path.\n *\n * @param skillName - Name of the skill to check\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Integrity check result\n *\n * @example\n * ```typescript\n * const result = await checkSkillIntegrity(\"ct-research-agent\", providers, \"global\");\n * if (result.status !== \"intact\") {\n *   console.log(`Issue: ${result.issue}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkSkillIntegrity(\n  skillName: string,\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<SkillIntegrityResult> {\n  const lock = await readLockFile();\n  const entry = lock.skills[skillName];\n  const isCaampOwned = isCaampOwnedSkill(skillName);\n\n  // Not tracked in lock file\n  if (!entry) {\n    const canonicalPath = join(resolveSkillsRoot(), skillName);\n    return {\n      name: skillName,\n      status: 'not-tracked',\n      canonicalExists: existsSync(canonicalPath),\n      canonicalPath: null,\n      linkStatuses: [],\n      isCaampOwned,\n      issue: 'Skill is not tracked in the CAAMP lock file',\n    };\n  }\n\n  const canonicalPath = entry.canonicalPath;\n  const canonicalExists = existsSync(canonicalPath);\n\n  // Check symlinks for each provider\n  const linkStatuses: SkillIntegrityResult['linkStatuses'] = [];\n\n  for (const provider of providers) {\n    const targetDirs = resolveProviderSkillsDirs(provider, scope, projectDir);\n    for (const skillsDir of targetDirs) {\n      if (!skillsDir) continue;\n\n      const linkPath = join(skillsDir, skillName);\n      const exists = existsSync(linkPath);\n      let isSymlink = false;\n      let pointsToCanonical = false;\n\n      if (exists) {\n        try {\n          const stat = lstatSync(linkPath);\n          isSymlink = stat.isSymbolicLink();\n          if (isSymlink) {\n            const target = resolve(readlinkSync(linkPath));\n            pointsToCanonical = target === resolve(canonicalPath);\n          }\n        } catch {\n          // Can't stat — treat as broken\n        }\n      }\n\n      linkStatuses.push({\n        providerId: provider.id,\n        linkPath,\n        exists,\n        isSymlink,\n        pointsToCanonical,\n      });\n    }\n  }\n\n  // Determine overall status\n  if (!canonicalExists) {\n    return {\n      name: skillName,\n      status: 'missing-canonical',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `Canonical directory missing: ${canonicalPath}`,\n    };\n  }\n\n  const brokenLinks = linkStatuses.filter((l) => !l.exists);\n  const tamperedLinks = linkStatuses.filter((l) => l.exists && !l.pointsToCanonical);\n\n  if (tamperedLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'tampered',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${tamperedLinks.length} link(s) do not point to canonical path`,\n    };\n  }\n\n  if (brokenLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'broken-symlink',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${brokenLinks.length} symlink(s) missing`,\n    };\n  }\n\n  return {\n    name: skillName,\n    status: 'intact',\n    canonicalExists,\n    canonicalPath,\n    linkStatuses,\n    isCaampOwned,\n  };\n}\n\n/**\n * Check integrity of all tracked skills.\n *\n * @remarks\n * Iterates over every skill in the lock file and runs\n * {@link checkSkillIntegrity} on each.\n *\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Map of skill name to integrity result\n *\n * @example\n * ```typescript\n * const results = await checkAllSkillIntegrity(providers);\n * for (const [name, result] of results) {\n *   console.log(`${name}: ${result.status}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkAllSkillIntegrity(\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<Map<string, SkillIntegrityResult>> {\n  const lock = await readLockFile();\n  const results = new Map<string, SkillIntegrityResult>();\n\n  for (const skillName of Object.keys(lock.skills)) {\n    const result = await checkSkillIntegrity(skillName, providers, scope, projectDir);\n    results.set(skillName, result);\n  }\n\n  return results;\n}\n\n/**\n * Resolve a skill name conflict where a user-installed skill collides\n * with a CAAMP-owned (ct-*) skill.\n *\n * @remarks\n * CAAMP-owned skills always win. Returns `true` if the incoming skill\n * should take precedence over the existing installation.\n *\n * @param skillName - Skill name to check\n * @param incomingSource - Source of the incoming skill installation\n * @param existingEntry - Existing lock entry, if any\n * @returns `true` if the incoming installation should proceed\n *\n * @example\n * ```typescript\n * const proceed = shouldOverrideSkill(\"ct-research-agent\", \"library\", existingEntry);\n * if (proceed) {\n *   // Safe to install/override\n * }\n * ```\n *\n * @public\n */\nexport function shouldOverrideSkill(\n  skillName: string,\n  incomingSource: string,\n  existingEntry: LockEntry | undefined,\n): boolean {\n  // No existing entry — always allow\n  if (!existingEntry) return true;\n\n  // For ct-* skills, CAAMP package source always wins\n  if (isCaampOwnedSkill(skillName)) {\n    // If incoming is from CAAMP package (library source), it always wins\n    if (existingEntry.sourceType === 'library') return true;\n    // If existing is from CAAMP but incoming is user, CAAMP wins (block user)\n    return true;\n  }\n\n  // Non-ct-* skills: user always wins\n  return true;\n}\n\n/**\n * Validate instruction file injection status across all providers.\n *\n * @remarks\n * Checks that CAAMP blocks exist and are current in all relevant\n * instruction files (CLAUDE.md, AGENTS.md, GEMINI.md).\n *\n * @param providers - Providers to check\n * @param projectDir - Project directory\n * @param scope - Whether to check global or project files\n * @param expectedContent - Expected CAAMP block content\n * @returns Array of file paths with issues\n *\n * @example\n * ```typescript\n * const issues = await validateInstructionIntegrity(providers, process.cwd(), \"project\");\n * for (const issue of issues) {\n *   console.log(`${issue.providerId}: ${issue.issue} (${issue.file})`);\n * }\n * ```\n *\n * @public\n */\nexport async function validateInstructionIntegrity(\n  providers: Provider[],\n  projectDir: string,\n  scope: 'project' | 'global',\n  expectedContent?: string,\n): Promise<Array<{ file: string; providerId: string; issue: string }>> {\n  const { checkAllInjections } = await import('../instructions/injector.js');\n  const results = await checkAllInjections(providers, projectDir, scope, expectedContent);\n  const issues: Array<{ file: string; providerId: string; issue: string }> = [];\n\n  for (const result of results) {\n    if (result.status === 'missing') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'Instruction file does not exist',\n      });\n    } else if (result.status === 'none') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'No CAAMP injection block found',\n      });\n    } else if (result.status === 'outdated') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'CAAMP injection block is outdated',\n      });\n    }\n  }\n\n  return issues;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,SAAS,aAAa;AAaf,IAAM,wBAA0D,OAAO,OAAO;AAAA,EACnF,aAAa,KAAK,OAAO;AAAA,EACzB,eAAe,KAAK,OAAO;AAAA,EAC3B,WAAW;AACb,CAAC;AAUD,IAAM,0BAA+C,oBAAI,IAAI;AAAA,EAC3D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAcM,IAAM,yBAAiC;AAGvC,IAAM,6BAAoE,OAAO,OAAO;AAAA,EAC7F,EAAE,IAAI,aAAa,MAAM,qBAAqB,OAAO,QAAQ;AAAA,EAC7D,EAAE,IAAI,kBAAkB,MAAM,0BAA0B,OAAO,QAAQ;AAAA,EACvE,EAAE,IAAI,0BAA0B,MAAM,kCAAkC,OAAO,QAAQ;AAAA,EACvF,EAAE,IAAI,0BAA0B,MAAM,kCAAkC,OAAO,QAAQ;AAAA,EACvF,EAAE,IAAI,uBAAuB,MAAM,wBAAwB,OAAO,QAAQ;AAAA,EAC1E,EAAE,IAAI,kBAAkB,MAAM,0BAA0B,OAAO,QAAQ;AAAA,EACvE,EAAE,IAAI,iBAAiB,MAAM,+BAA+B,OAAO,QAAQ;AAAA,EAC3E,EAAE,IAAI,mBAAmB,MAAM,kCAAkC,OAAO,QAAQ;AAAA,EAChF;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AACF,CAAC;AAED,IAAM,SAAS;AACf,IAAM,OAAO;AAEb,SAAS,YAAY,MAA6B;AAChD,MAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,KAAM,QAAO;AAC1C,MAAI,KAAK,SAAS,IAAI,KAAK,kBAAkB,KAAK,IAAI;AACpD,WAAO;AACT,MAAI,MAAM,WAAW,IAAI,KAAK,aAAa,KAAK,IAAI;AAClD,WAAO;AACT,MAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAYO,SAAS,0BAA0B,OAAkC;AAC1E,QAAM,YAAY,MAAM,WAAW,GAAG;AACtC,QAAM,WAAW,YAAY,MAAM,MAAM,CAAC,IAAI,OAAO,QAAQ,SAAS,EAAE,EAAE,QAAQ,OAAO,EAAE;AAC3F,QAAM,SAAS,QAAQ,WAAW,GAAG,IACjC,iDACA,YAAY,OAAO;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,SAAS,YAAY,YAAY,cAAc,KAAK,KAAK,OAAO,IAAI,SAAS;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAqC;AACzD,QAAM,WAAqB,CAAC;AAC5B,QAAM,YAAY,YAAY,KAAK,IAAI;AACvC,MAAI,UAAW,UAAS,KAAK,SAAS;AACtC,MAAI,CAAC,OAAO,cAAc,KAAK,IAAI,KAAK,KAAK,OAAO;AAClD,aAAS,KAAK,+CAA+C;AAC/D,MAAI,KAAK,WAAW,UAAa,CAAC,OAAO,KAAK,KAAK,MAAM;AACvD,aAAS,KAAK,2DAA2D;AAC3E,SAAO;AACT;AAiBO,SAAS,wBACd,WACA,QAC2B;AAC3B,QAAM,SAAiC,CAAC;AACxC,QAAM,MAAM,CAAC,MAAoC,SAAiB,YAA0B;AAC1F,WAAO,KAAK,EAAE,MAAM,SAAS,QAAQ,CAAC;AAAA,EACxC;AACA,MAAI,CAAC,UAAU,YAAY,KAAK,KAAK,CAAC,UAAU,QAAQ,KAAK,GAAG;AAC9D,QAAI,qBAAqB,YAAY,4CAA4C;AAAA,EACnF;AACA,MAAI,CAAC,CAAC,YAAY,oBAAoB,SAAS,EAAE,SAAS,UAAU,MAAM,GAAG;AAC3E,QAAI,qBAAqB,UAAU,yCAAyC;AAAA,EAC9E;AACA,MAAI,CAAC,OAAO,cAAc,UAAU,WAAW,KAAK,UAAU,cAAc,GAAG;AAC7E,QAAI,qBAAqB,eAAe,kDAAkD;AAAA,EAC5F;AACA,MAAI,UAAU,kBAAkB,UAAa,CAAC,OAAO,KAAK,UAAU,aAAa,GAAG;AAClF;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,WAAW,sBAAsB,UAAU,kBAAkB,QAAW;AACpF;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,oBAAI,IAAiC;AACnD,MAAI,gBAA+B;AACnC,aAAW,QAAQ,UAAU,OAAO;AAClC,eAAW,WAAW,aAAa,IAAI,EAAG,KAAI,qBAAqB,KAAK,MAAM,OAAO;AACrF,QAAI,MAAM,IAAI,KAAK,IAAI,EAAG,KAAI,qBAAqB,KAAK,MAAM,2BAA2B;AACzF,UAAM,IAAI,KAAK,MAAM,IAAI;AACzB,QAAI,kBAAkB,MAAM;AAC1B,YAAM,QAAgB,gBAAgB,KAAK;AAC3C,sBAAgB,OAAO,cAAc,KAAK,KAAK,KAAK,QAAQ,IAAI,QAAQ;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,kBAAkB;AACpB,QAAI,qBAAqB,iBAAiB,sCAAsC;AAClF,QAAM,WAAW,OAAO,gBAAgB,CAAC,GAAG,IAAI,yBAAyB;AACzE,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,OAAQ,KAAI,kBAAkB,MAAM,OAAO,MAAM,MAAM;AAAA,EACnE;AACA,MAAI,CAAC,OAAO,aAAa;AACvB,QAAI,kBAAkB,gBAAgB,wDAAwD;AAChG,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,eAAe,OAAO,aAAa,IAAI,CAAC,gBAAgB;AAC5D,UAAM,UAAU,YAAY,YAAY,IAAI;AAC5C,UAAM,YAAY,IAAI,IAAI,YAAY,EAAE;AACxC,QAAI,IAAI,YAAY,EAAE;AACtB,QACE,CAAC,YAAY,GAAG,KAAK,KACrB,aACA,WACA,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,YAAY,KAAK,GAC7C;AACA;AAAA,QACE;AAAA,QACA,YAAY;AAAA,QACZ,WAAW;AAAA,MACb;AACA,aAAO,EAAE,IAAI,YAAY,IAAI,cAAc,CAAC,GAAG,WAAW,MAAM;AAAA,IAClE;AACA,UAAM,UAAU,UAAU,MAAM;AAAA,MAAO,CAAC,SACtC,YAAY,UAAU,UAClB,KAAK,SAAS,YAAY,OAC1B,MAAM,YAAY,KAAK,MAAM,YAAY,IAAI;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ;AACX;AAAA,QACE;AAAA,QACA,YAAY;AAAA,QACZ,qBAAqB,YAAY,IAAI;AAAA,MACvC;AACF,eAAW,QAAQ,SAAS;AAC1B,UAAI,KAAK,SAAS,EAAG,KAAI,SAAS,KAAK,MAAM,qBAAqB,YAAY,EAAE,YAAY;AAAA,IAC9F;AACA,WAAO;AAAA,MACL,IAAI,YAAY;AAAA,MAChB,cAAc,QAAQ,IAAI,CAAC,SAAS,KAAK,IAAI;AAAA,MAC7C,WAAW,QAAQ,SAAS,KAAK,QAAQ,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC;AAAA,IACxE;AAAA,EACF,CAAC;AACD,aAAW,WAAW,OAAO,qBAAqB,CAAC,GAAG;AACpD,UAAM,UAAU,YAAY,OAAO;AACnC,QAAI,SAAS;AACX,UAAI,kBAAkB,SAAS,OAAO;AACtC;AAAA,IACF;AACA,eAAW,QAAQ,UAAU,OAAO;AAClC,UAAI,MAAM,YAAY,KAAK,MAAM,OAAO;AACtC,YAAI,aAAa,KAAK,MAAM,2CAA2C,OAAO,GAAG;AAAA,IACrF;AAAA,EACF;AACA,MAAI,iBAA8D;AAClE,aAAW,YAAY,OAAO,iBAAiB,CAAC,GAAG;AACjD,UAAM,WAAW,aAAa,QAAQ;AACtC,eAAW,WAAW,SAAU,KAAI,kBAAkB,SAAS,MAAM,OAAO;AAC5E,UAAM,SAAS,MAAM,IAAI,SAAS,IAAI;AACtC,QAAI,CAAC,OAAQ,KAAI,WAAW,SAAS,MAAM,4CAA4C;AAAA,aAC9E,OAAO,SAAS,SAAS;AAChC,UAAI,YAAY,SAAS,MAAM,0DAA0D;AAC3F,QAAI,SAAS,WAAW,QAAW;AACjC,UAAI,mBAAmB,SAAU,kBAAiB;AAClD,UAAI,SAAS,UAAU,QAAQ,WAAW,SAAS,QAAQ;AACzD,yBAAiB;AACjB;AAAA,UACE;AAAA,UACA,SAAS;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AAC3D,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ;AAC1C,UAAI,kBAAkB,OAAO,4CAA4C;AAAA,EAC7E;AACA,MAAI,UAAU,cAAc,OAAO,QAAQ;AACzC,QAAI,UAAU,eAAe,kDAAkD;AACjF,MAAI,kBAAkB,QAAQ,gBAAgB,OAAO,QAAQ;AAC3D,QAAI,UAAU,iBAAiB,oDAAoD;AACrF,MAAI,UAAU,MAAM,SAAS,OAAO,QAAQ;AAC1C,QAAI,UAAU,aAAa,0DAA0D;AACvF,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,WAAW,EAAE,GAAG,WAAW,OAAO,UAAU,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,EAAE,EAAE;AAAA,IAC/E;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAeO,SAAS,4BAA4B,OAAiD;AAC3F,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,MAAM,OAAO,CAAC,SAAS,KAAK,KAAK,WAAW,OAAO,CAAC;AACjE,QAAM,eAAe,KAAK;AAAA,IACxB,CAAC,SAAS,KAAK,KAAK,SAAS,OAAO,KAAK,KAAK,KAAK,SAAS,WAAW;AAAA,EACzE;AACA,MAAI,aAAa;AACf,YAAQ;AAAA,MACN,GAAG,aAAa,MAAM;AAAA,IACxB;AACF,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,SACC,KAAK,KAAK,SAAS,KAAK,KACxB,CAAC,wBAAwB,IAAI,KAAK,IAAI,KACtC,CAAC,uBAAuB,KAAK,KAAK,IAAI;AAAA,EAC1C;AACA,MAAI,MAAM;AACR,YAAQ;AAAA,MACN,GAAG,MAAM,MAAM,yDAAyD,CAAC,GAAG,uBAAuB,EAAE,KAAK,IAAI,CAAC,2BAA2B,MAAM,CAAC,GAAG,IAAI;AAAA,IAC1J;AACF,SAAO;AACT;;;AC3TA,SAAS,YAAY,WAAW,oBAAoB;AACpD,SAAS,MAAM,eAAe;AAC9B,SAAS,yBAAyB;AAMlC,IAAM,qBAAqB;AA6DpB,SAAS,kBAAkB,WAA4B;AAC5D,SAAO,UAAU,WAAW,kBAAkB;AAChD;AA0BA,eAAsB,oBACpB,WACA,WACA,QAA8B,UAC9B,YAC+B;AAC/B,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,QAAQ,KAAK,OAAO,SAAS;AACnC,QAAM,eAAe,kBAAkB,SAAS;AAGhD,MAAI,CAAC,OAAO;AACV,UAAMA,iBAAgB,KAAK,kBAAkB,GAAG,SAAS;AACzD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,iBAAiB,WAAWA,cAAa;AAAA,MACzC,eAAe;AAAA,MACf,cAAc,CAAC;AAAA,MACf;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAC5B,QAAM,kBAAkB,WAAW,aAAa;AAGhD,QAAM,eAAqD,CAAC;AAE5D,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,0BAA0B,UAAU,OAAO,UAAU;AACxE,eAAW,aAAa,YAAY;AAClC,UAAI,CAAC,UAAW;AAEhB,YAAM,WAAW,KAAK,WAAW,SAAS;AAC1C,YAAM,SAAS,WAAW,QAAQ;AAClC,UAAI,YAAY;AAChB,UAAI,oBAAoB;AAExB,UAAI,QAAQ;AACV,YAAI;AACF,gBAAM,OAAO,UAAU,QAAQ;AAC/B,sBAAY,KAAK,eAAe;AAChC,cAAI,WAAW;AACb,kBAAM,SAAS,QAAQ,aAAa,QAAQ,CAAC;AAC7C,gCAAoB,WAAW,QAAQ,aAAa;AAAA,UACtD;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,mBAAa,KAAK;AAAA,QAChB,YAAY,SAAS;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,CAAC,iBAAiB;AACpB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,gCAAgC,aAAa;AAAA,IACtD;AAAA,EACF;AAEA,QAAM,cAAc,aAAa,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACxD,QAAM,gBAAgB,aAAa,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,iBAAiB;AAEjF,MAAI,cAAc,SAAS,GAAG;AAC5B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,cAAc,MAAM;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,YAAY,MAAM;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAwBA,eAAsB,uBACpB,WACA,QAA8B,UAC9B,YAC4C;AAC5C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,oBAAI,IAAkC;AAEtD,aAAW,aAAa,OAAO,KAAK,KAAK,MAAM,GAAG;AAChD,UAAM,SAAS,MAAM,oBAAoB,WAAW,WAAW,OAAO,UAAU;AAChF,YAAQ,IAAI,WAAW,MAAM;AAAA,EAC/B;AAEA,SAAO;AACT;AAyBO,SAAS,oBACd,WACA,gBACA,eACS;AAET,MAAI,CAAC,cAAe,QAAO;AAG3B,MAAI,kBAAkB,SAAS,GAAG;AAEhC,QAAI,cAAc,eAAe,UAAW,QAAO;AAEnD,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAyBA,eAAsB,6BACpB,WACA,YACA,OACA,iBACqE;AACrE,QAAM,EAAE,oBAAAC,oBAAmB,IAAI,MAAM,OAAO,wBAA6B;AACzE,QAAM,UAAU,MAAMA,oBAAmB,WAAW,YAAY,OAAO,eAAe;AACtF,QAAM,SAAqE,CAAC;AAE5E,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,WAAW;AAC/B,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,QAAQ;AACnC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,YAAY;AACvC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["canonicalPath","checkAllInjections"]}

package/dist/{injector-FDRZD2DB.js → injector-3SMMI2FO.js}

@@ -16,8 +16,10 @@ import {
   repairInstructionFiles,
   resolveGlobalInstructionPath,
   writeAgentFileToAllProviders
-} from "./chunk-2FQWBKEG.js";
-import "./chunk-HDZYZTR2.js";
+} from "./chunk-2RZGY4XT.js";
+import "./chunk-D6CWC4BX.js";
+import "./chunk-5INWYMO4.js";
+import "./chunk-PZ5AY32C.js";
 export {
   HomeInstructionFileError,
   checkAllInjections,
@@ -37,4 +39,4 @@ export {
   resolveGlobalInstructionPath,
   writeAgentFileToAllProviders
 };
-//# sourceMappingURL=injector-FDRZD2DB.js.map
+//# sourceMappingURL=injector-3SMMI2FO.js.map

package/dist/injector-3SMMI2FO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/caamp",
-  "version": "2026.10.8",
+  "version": "2026.10.9",
   "description": "Central AI Agent Managed Packages - unified provider registry and package manager for AI coding agents",
   "type": "module",
   "bin": {
@@ -12,6 +12,14 @@
     ".": {
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js"
+    },
+    "./hooks": {
+      "types": "./dist/hooks.d.ts",
+      "import": "./dist/hooks.js"
+    },
+    "./atomic": {
+      "types": "./dist/atomic.d.ts",
+      "import": "./dist/atomic.js"
     }
   },
   "files": [
@@ -50,14 +58,14 @@
     "jsonc-parser": "^3.3.1",
     "picocolors": "^1.1.1",
     "simple-git": "3.33.0",
-    "@cleocode/cant": "2026.10.8",
-    "@cleocode/contracts": "2026.10.8",
-    "@cleocode/core": "2026.10.8",
-    "@cleocode/paths": "2026.10.8",
-    "@cleocode/lafs": "2026.10.8"
+    "@cleocode/contracts": "2026.10.9",
+    "@cleocode/cant": "2026.10.9",
+    "@cleocode/core": "2026.10.9",
+    "@cleocode/lafs": "2026.10.9",
+    "@cleocode/paths": "2026.10.9"
   },
   "peerDependencies": {
-    "@cleocode/core": "2026.10.8"
+    "@cleocode/core": "2026.10.9"
   },
   "peerDependenciesMeta": {
     "@cleocode/core": {

package/providers/hook-mappings.json

@@ -1,7 +1,7 @@
 {
   "$schema": "./hook-mappings.schema.json",
   "version": "2.0.0",
-  "lastUpdated": "2026-04-06",
+  "lastUpdated": "2026-10-10",
   "description": "CAAMP canonical hook event mappings to provider-native event names. The top-level `canonicalEvents` block is the CAAMP taxonomy that all providers translate to/from. The sibling `piEventCatalog` block is Pi's native lifecycle catalog, consulted when a provider's `capabilities.hooks.nativeEventCatalog` is `\"pi\"`.",
   "canonicalEvents": {
     "SessionStart": {
@@ -222,6 +222,7 @@
       "hookFormat": "json",
       "handlerTypes": ["command", "http", "prompt", "agent"],
       "experimental": false,
+      "projectDelivery": {"configPath": ".claude/settings.local.json", "timeoutUnit": "seconds", "documentedVersions": ["2.1.296"], "verifiedVersions": [], "documentation": "https://code.claude.com/docs/en/hooks", "reviewedAt": "2026-10-10", "trust": "native-unverified"},
       "mappings": {
         "SessionStart": { "nativeName": "SessionStart", "supported": true },
         "SessionEnd": { "nativeName": "SessionEnd", "supported": true },
@@ -322,12 +323,13 @@
       "hookFormat": "json",
       "handlerTypes": ["command"],
       "experimental": true,
+      "projectDelivery": {"configPath": ".codex/hooks.json", "timeoutUnit": "seconds", "documentedVersions": ["0.162.1"], "verifiedVersions": [], "documentation": "https://developers.openai.com/codex/hooks", "reviewedAt": "2026-10-10", "trust": "native-unverified"},
       "mappings": {
         "SessionStart": { "nativeName": "SessionStart", "supported": true },
         "SessionEnd": { "nativeName": null, "supported": false },
         "PromptSubmit": { "nativeName": "UserPromptSubmit", "supported": true },
         "ResponseComplete": { "nativeName": "Stop", "supported": true },
-        "PreToolUse": { "nativeName": null, "supported": false },
+        "PreToolUse": { "nativeName": "PreToolUse", "supported": true, "notes": "Documented by OpenAI; live version certification is separate from installation." },
         "PostToolUse": { "nativeName": null, "supported": false },
         "PostToolUseFailure": { "nativeName": null, "supported": false },
         "PermissionRequest": { "nativeName": null, "supported": false },
@@ -348,6 +350,7 @@
       "hookFormat": "javascript",
       "handlerTypes": ["plugin"],
       "experimental": false,
+      "projectDelivery": {"configPath": ".opencode/plugins/cleo-project-hooks.js", "timeoutUnit": "milliseconds", "documentedVersions": ["2.0.26"], "verifiedVersions": [], "documentation": "https://opencode.ai/docs/plugins/", "reviewedAt": "2026-10-10", "trust": "native-unverified"},
       "mappings": {
         "SessionStart": { "nativeName": "event:session.created", "supported": true, "notes": "Via bus event subscriber" },
         "SessionEnd": { "nativeName": "event:session.deleted", "supported": true, "notes": "Via bus event subscriber" },
@@ -382,6 +385,7 @@
       "hookFormat": null,
       "handlerTypes": [],
       "experimental": false,
+      "projectDelivery": {"configPath": null, "documentedVersions": [], "verifiedVersions": [], "documentation": "https://kimi-cli.com/en/customization/hooks.html", "reviewedAt": "2026-10-10", "trust": "native-unverified"},
       "mappings": {
         "SessionStart": { "nativeName": null, "supported": false },
         "SessionEnd": { "nativeName": null, "supported": false },