@cleocode/caamp 2026.9.17 → 2026.9.19

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-import { InstructionDeliveryFinding, CaampInjectionAction, InstructionDelivery } from '@cleocode/contracts/caamp-markers';
+import { InstructionDeliveryFinding, CaampInjectionAction, GlobalInstructionStalenessReport, GlobalInstructionSyncResult, InstructionDelivery } from '@cleocode/contracts/caamp-markers';
 import { PackageArtifactBudgets, PackageArtifactRequirement, PackageArtifactFile, PackageFilesEntry, PackageArtifactInventory, PackageArtifactPolicy, PackageArtifactValidation } from '@cleocode/contracts/package-artifact';
 import { WorktreeHandle } from '@cleocode/cant';
 import { PlatformPaths, SystemInfo } from '@cleocode/paths';
@@ -4644,6 +4644,114 @@ declare function resolveNativeEvent(nativeName: string): Array<{
  */
 declare function getHookMappingsVersion(): string;
 
+/**
+ * Global provider instruction delivery — the ONE regenerator and its cheap
+ * staleness check.
+ *
+ * Every global provider instruction file (`~/.claude/CLAUDE.md`,
+ * `~/.codex/AGENTS.md`, `~/.gemini/GEMINI.md`, `~/.pi/agent/AGENTS.md`, …)
+ * carries a CAAMP block that EMBEDS the global hub `~/.agents/AGENTS.md` and
+ * everything it references, stamped with one `CAAMP:SOURCE` line per source.
+ *
+ * Before T12377 there were two regenerators. `cleo install-global` resolved the
+ * hub into an embedded delivery; `caamp instructions update --global` wrote a
+ * generic "CAAMP Managed Configuration" stub, and only to the default target
+ * provider (Pi when installed), so it destroyed Pi's embedded protocol and never
+ * touched the stale Claude/Codex/Gemini files. Both now call
+ * {@link syncGlobalInstructions}.
+ *
+ * Code placed in `packages/caamp/` per Package-Boundary Check — verified against
+ * AGENTS.md: `@cleocode/core` already reaches CAAMP through
+ * `await import('@cleocode/caamp')`, and CAAMP cannot import core's bootstrap.
+ *
+ * @task T12377
+ * @task T12378
+ */
+
+/**
+ * Options for {@link syncGlobalInstructions} and {@link checkGlobalInstructionStaleness}.
+ *
+ * @public
+ */
+interface GlobalInstructionOptions {
+    /** Providers to target. @defaultValue every installed provider */
+    providers?: Provider[];
+    /** Managed reference resolved into the delivery. @defaultValue `@~/.agents/AGENTS.md` */
+    hubReference?: string;
+    /** Directory relative references resolve against. @defaultValue the user's home */
+    baseDir?: string;
+}
+/**
+ * Options for {@link syncGlobalInstructions}.
+ *
+ * @public
+ */
+interface SyncGlobalInstructionsOptions extends GlobalInstructionOptions {
+    /** Plan the targets without writing. @defaultValue false */
+    dryRun?: boolean;
+}
+/**
+ * Regenerate every global provider instruction file from its sources.
+ *
+ * @remarks
+ * The single global regenerator (T12377), shared by `cleo install-global`, the
+ * npm postinstall, `caamp instructions update --global`, and the automatic
+ * refresh at `cleo session start` / `cleo briefing`.
+ *
+ * 1. Resolves {@link GLOBAL_INSTRUCTION_HUB_REFERENCE} into a self-contained,
+ *    source-stamped delivery. Any defect other than a benign duplicate stops
+ *    the run before a byte is written — a partial delivery must never replace
+ *    a usable one.
+ * 2. Strips legacy `CLEO:START` blocks.
+ * 3. Injects the delivery into each distinct global file. `inject()` is
+ *    idempotent (`intact` when unchanged) and preserves all text outside the
+ *    managed block.
+ *
+ * Providers without an absolute global path are skipped and reported (T12379).
+ * One failing file does not stop the others; it is reported as `failed`.
+ *
+ * @param options - Targets, hub reference and dry-run switch.
+ * @returns What was written, or why nothing was.
+ *
+ * @example
+ * ```typescript
+ * const result = await syncGlobalInstructions();
+ * if (result.status === 'unresolved') console.error(result.findings);
+ * ```
+ *
+ * @public
+ */
+declare function syncGlobalInstructions(options?: SyncGlobalInstructionsOptions): Promise<GlobalInstructionSyncResult>;
+/**
+ * Cheap staleness scan over every global provider instruction file.
+ *
+ * @remarks
+ * Reads each distinct provider file once and hashes each distinct stamped
+ * source once — no reference expansion, no writes. A file is:
+ *
+ * - `stale` when a `CAAMP:SOURCE` stamp's sha256 no longer matches its source
+ *   (or the source is gone);
+ * - `unembedded` when its managed block carries no stamp at all (a
+ *   reference-only block or the generic stub written before T12377).
+ *
+ * It also reports a hand-appended copy of managed content OUTSIDE the managed
+ * block as a duplicate: at least two substantial lines outside the block that
+ * also occur in a stamped source. Duplicates are reported only — user text is
+ * never deleted automatically.
+ *
+ * @param options - Targets to scan.
+ * @returns Per-file verdicts plus the files a sync would repair.
+ *
+ * @example
+ * ```typescript
+ * const report = await checkGlobalInstructionStaleness();
+ * if (report.needsSync.length > 0) await syncGlobalInstructions();
+ * ```
+ *
+ * @public
+ */
+declare function checkGlobalInstructionStaleness(options?: GlobalInstructionOptions): Promise<GlobalInstructionStalenessReport>;
+
 /**
  * CAAMP marker engine — parsing, damage repair, and canonical block rendering.
  *
@@ -4675,6 +4783,49 @@ declare function getHookMappingsVersion(): string;
  *
  * @task T12051
  */
+/**
+ * Thrown when a write would replace an EMBEDDED delivery (a block carrying
+ * `CAAMP:SOURCE` stamps) with reference-only or stub content.
+ *
+ * @remarks
+ * Providers do not reliably expand `@` references, so an embedded block is
+ * the only form proven to deliver the protocol. Replacing it with a generic
+ * "CAAMP Managed Configuration" stub is how `~/.pi/agent/AGENTS.md` lost the
+ * whole protocol in the 2026-09-25 incident (T12377). Callers regenerate an
+ * embedded file through `syncGlobalInstructions` (global) or a resolved
+ * delivery (project) instead.
+ *
+ * @example
+ * ```typescript
+ * try { await inject(path, '@AGENTS.md'); }
+ * catch (err) { if (err instanceof EmbeddedDeliveryDowngradeError) report(err.code); }
+ * ```
+ *
+ * @public
+ */
+declare class EmbeddedDeliveryDowngradeError extends Error {
+    /** Stable error code for envelopes and tests. */
+    readonly code = "E_CAAMP_EMBEDDED_DOWNGRADE";
+    /**
+     * @param detail - Which file or block the refused write targeted.
+     */
+    constructor(detail: string);
+}
+/**
+ * Whether a managed block body is an embedded delivery, i.e. carries at least
+ * one `CAAMP:SOURCE` stamp line.
+ *
+ * @param body - Block body (or any text) to inspect.
+ * @returns `true` when a source stamp line is present.
+ *
+ * @example
+ * ```typescript
+ * isEmbeddedDelivery('@AGENTS.md'); // false
+ * ```
+ *
+ * @public
+ */
+declare function isEmbeddedDelivery(body: string): boolean;
 /**
  * A single parsed CAAMP block extracted from a file.
  *
@@ -4828,6 +4979,8 @@ interface ReconcileResult {
  * @param insert - Placement when the file has no block yet
  * @returns The reconciled content plus what was found on the way
  * @throws When existing or desired markers have ambiguous ownership.
+ * @throws {@link EmbeddedDeliveryDowngradeError} when an existing block is an
+ *   embedded delivery and `desiredContent` is not (T12377).
  *
  * @example
  * ```typescript
@@ -5020,6 +5173,31 @@ declare function dedupeFiles(filePaths: string[]): Promise<DedupeResult[]>;
  * @public
  */
 declare function instructionFileCascade(projectDir: string, providers: Provider[]): string[];
+/**
+ * Resolve a provider's GLOBAL instruction file, or `null` when the provider has
+ * no global scope.
+ *
+ * @remarks
+ * A provider whose resolved `pathGlobal` is empty or relative (the registry
+ * leaves it `""` for providers with no user-level instruction file, e.g.
+ * `devin`) has no global instruction file. Joining an empty `pathGlobal` used
+ * to yield the bare relative `AGENTS.md`, which a global write then created in
+ * whatever directory the command happened to run from (T12379). Every
+ * global-scope write and check goes through this function, so such providers
+ * are excluded from global scope instead.
+ *
+ * @param provider - Provider registry entry.
+ * @returns Absolute path of the global instruction file, or `null`.
+ *
+ * @example
+ * ```typescript
+ * resolveGlobalInstructionPath(getProvider('claude-code')!); // "/home/u/.claude/CLAUDE.md"
+ * resolveGlobalInstructionPath(getProvider('devin')!);       // null
+ * ```
+ *
+ * @public
+ */
+declare function resolveGlobalInstructionPath(provider: Provider): string | null;
 /**
  * Summary of a repair sweep across instruction files.
  *
@@ -7024,6 +7202,22 @@ declare function getSpawnCapableProviders(): Provider[];
  * @public
  */
 declare function getProvidersBySpawnCapability(flag: keyof Omit<ProviderSpawnCapability, 'spawnMechanism' | 'spawnCommand'>): Provider[];
+/**
+ * Reset cached registry data, forcing a reload on next access.
+ *
+ * @remarks
+ * Clears the in-memory provider map, alias map, and raw registry cache.
+ * Primarily used in test suites to ensure a clean state between test cases.
+ *
+ * @example
+ * ```typescript
+ * resetRegistry();
+ * // Next call to getAllProviders() will re-read registry.json
+ * ```
+ *
+ * @public
+ */
+declare function resetRegistry(): void;
 /**
  * Get the default `@` instruction references for a provider from the registry.
  *
@@ -8959,4 +9153,4 @@ declare function parseSource(input: string): ParsedSource;
  */
 declare function isMarketplaceScoped(input: string): boolean;
 
-export { type AuditFinding, type AuditResult, type AuditRule, type AuditSeverity, type BatchInstallOptions, type BatchInstallResult, type BlockInsertPosition, CANONICAL_HOOK_EVENTS, CLEO_ARTIFACT_BUDGETS, CLEO_ARTIFACT_REQUIREMENTS, type CaampBlock, type CaampLockFile, type CanonicalEventDefinition, type CanonicalHookEvent, type CantProfileCounts, type CantProfileEntry, type CantValidationDiagnostic, type ConfigFormat, type CrossProviderMatrix, type CtDispatchMatrix, type CtManifest, type CtManifestSkill, type CtProfileDefinition, type CtSkillEntry, type CtValidationIssue, type CtValidationResult, DEFAULT_EXCLUSIVITY_MODE, type DedupeResult, type DetectionCacheOptions, type DetectionResult, EXCLUSIVITY_MODE_ENV_VAR, type EnsureProviderInstructionFileOptions, type EnsureProviderInstructionFileResult, type ExclusivityMode, type FileLockOptions, type GlobalOptions, HOOK_CATEGORIES, type Harness, type HarnessScope, type HookCategory, type HookEvent, type HookHandlerType, type HookMapping, type HookSupportResult, type HookSystemType, type InjectionCheckResult, type InjectionStatus, type InjectionTemplate, type InstallMcpServerOptions, type InstallMcpServerResult, type InstallSkillOptions, type InstructionUpdateSummary, type KnownProviderAgentFolderId, type LockEntry, MarketplaceClient, type MarketplaceResult, type MarketplaceSearchResult, type MarketplaceSkill, type McpConfigFormat, type McpDetectionEntry, type McpScope, type McpServerConfig, type McpServerEntriesByProvider, type McpServerEntry, type McpTransportType, type NormalizeResult, type NormalizedHookEvent, type NormalizedRecommendationCriteria, type ParsedSource, PiHarness, PiRequiredError, type Provider, type ProviderCapabilities, type ProviderHarnessCapability, type ProviderHookProfile, type ProviderHookSummary, type ProviderHooksCapability, type ProviderMcpCapability, type ProviderPriority, type ProviderSkillsCapability, type ProviderSpawnCapability, type ProviderStatus, RECOMMENDATION_ERROR_CODES, type RankedSkillRecommendation, type RecommendSkillsResult, type RecommendationCriteriaInput, type RecommendationErrorCode, type RecommendationOptions, type RecommendationReason, type RecommendationReasonCode, type RecommendationScoreBreakdown, type RecommendationValidationIssue, type RecommendationValidationResult, type RecommendationWeights, type ReconcileResult, type RegistryHarnessKind, type RegistryHookCatalog, type RegistryHookFormat, type RemoveMcpServerOptions, type RemoveMcpServerResult, type RepairResult, type ResolveDefaultTargetProvidersOptions, type SkillBatchOperation, type SkillEntry, type SkillInstallResult, type SkillIntegrityResult, type SkillIntegrityStatus, type SkillLibrary, type SkillLibraryDispatchMatrix, type SkillLibraryEntry, type SkillLibraryManifest, type SkillLibraryManifestSkill, type SkillLibraryProfile, type SkillLibraryValidationIssue, type SkillLibraryValidationResult, type SkillMetadata, type SkillRowData, type SkillRowSourceType, type SkillsPrecedence, type SourceType, type SpawnAdapter, type SpawnMechanism, type SpawnOptions, type SpawnResult, type SubagentHandle, type SubagentResult, type SubagentTask, type TransportType, type ValidateCantProfileResult, type ValidationIssue, type ValidationResult, type WriteAgentFileOptions, type WriteAgentFileResult, _resetPlatformPathsCache, assertCleoShippedBuildShape, assertNotTornRead, blockPattern, buildBlock, buildHookMatrix, buildInjectionContent, buildLibraryFromFiles, buildSkillsMap, catalog, checkAllInjections, checkAllSkillIntegrity, checkAllSkillUpdates, checkInjection, checkSkillIntegrity, checkSkillUpdate, classifyPackageFilesEntry, clearRegisteredLibrary, dedupeFile, dedupeFiles, deepMerge, detectAllProviders, detectMcpInstallations, detectProjectProviders, detectProvider, discoverSkill, discoverSkills, ensureAllProviderInstructionFiles, ensureDir, ensureProviderInstructionFile, formatSkillRecommendations, generateInjectionContent, generateSkillsSection, getAgentsConfigPath, getAgentsHome, getAgentsInstructFile, getAgentsLinksDir, getAgentsMcpDir, getAgentsMcpServersPath, getAgentsSpecDir, getAgentsWikiDir, getAllCanonicalEvents, getAllHarnesses, getAllProviders, getCanonicalEvent, getCanonicalEventsByCategory, getCommonEvents, getCommonHookEvents, getEffectiveSkillsPaths, getExclusivityMode, getHarnessFor, getHookConfigPath, getHookMappingsVersion, getHookSupport, getHookSystemType, getInstalledProviders, getInstructionFiles, getLockFilePath, getMappedProviderIds, getNestedValue, getPlatformLocations, getPlatformPaths, getPrimaryHarness, getPrimaryProvider, getProjectAgentsDir, getProvider, getProviderAgentFolder, getProviderCapabilities, getProviderCount, getProviderHookProfile, getProviderInstructionReferences, getProviderOnlyEvents, getProviderSummary, getProvidersByHookEvent, getProvidersByInstructFile, getProvidersByPriority, getProvidersBySkillsPrecedence, getProvidersBySpawnCapability, getProvidersByStatus, getProvidersForEvent, getRegistryVersion, getSpawnCapableProviders, getSupportedEvents, getSystemInfo, getTrackedSkills, getUnsupportedEvents, groupByInstructFile, inferSkillSourceType, inject, injectAll, installBatchWithRollback, installMcpServer, installSkill, instructionFileCascade, isCaampOwnedSkill, isExclusivityMode, isMarketplaceScoped, isQuiet, isVerbose, listAllMcpServers, listCanonicalSkills, listMcpServers, loadLibraryFromModule, mergeBlockBodies, normalizeMarkers, normalizeRecommendationCriteria, parseBlocks, parseCaampBlocks, parseInjectionContent, parseSkillFile, parseSource, providerSupports, providerSupportsById, rankSkills, readConfig, recommendSkills, reconcile, recordSkillInstall, registerSkillLibrary, registerSkillLibraryFromPath, removeConfig, removeInjection, removeMcpServer, removeMcpServerFromAll, removeSkill, removeSkillFromLock, repairContent, repairInstructionFiles, resetDetectionCache, resetExclusivityModeOverride, resolveAlias, resolveDefaultTargetProviders, resolveInstructionDelivery, resolveMcpConfigPath, resolveNativeEvent, resolveProviderSkillsDirs, resolveRegistryTemplatePath, scanDirectory, scanFile, scoreSkillRecommendation, searchSkills, selectProvidersByMinimumPriority, setExclusivityMode, setQuiet, setVerbose, shouldOverrideSkill, supportsHook, toCanonical, toNative, toNativeBatch, toSarif, tokenizeCriteriaValue, translateToAll, updateInstructionsSingleOperation, validateInstructionIntegrity, validatePackageArtifact, validateRecommendationCriteria, validateSkill, withFileLock, writeAgentFileToAllProviders, writeConfig };
+export { type AuditFinding, type AuditResult, type AuditRule, type AuditSeverity, type BatchInstallOptions, type BatchInstallResult, type BlockInsertPosition, CANONICAL_HOOK_EVENTS, CLEO_ARTIFACT_BUDGETS, CLEO_ARTIFACT_REQUIREMENTS, type CaampBlock, type CaampLockFile, type CanonicalEventDefinition, type CanonicalHookEvent, type CantProfileCounts, type CantProfileEntry, type CantValidationDiagnostic, type ConfigFormat, type CrossProviderMatrix, type CtDispatchMatrix, type CtManifest, type CtManifestSkill, type CtProfileDefinition, type CtSkillEntry, type CtValidationIssue, type CtValidationResult, DEFAULT_EXCLUSIVITY_MODE, type DedupeResult, type DetectionCacheOptions, type DetectionResult, EXCLUSIVITY_MODE_ENV_VAR, EmbeddedDeliveryDowngradeError, type EnsureProviderInstructionFileOptions, type EnsureProviderInstructionFileResult, type ExclusivityMode, type FileLockOptions, type GlobalInstructionOptions, type GlobalOptions, HOOK_CATEGORIES, type Harness, type HarnessScope, type HookCategory, type HookEvent, type HookHandlerType, type HookMapping, type HookSupportResult, type HookSystemType, type InjectionCheckResult, type InjectionStatus, type InjectionTemplate, type InstallMcpServerOptions, type InstallMcpServerResult, type InstallSkillOptions, type InstructionUpdateSummary, type KnownProviderAgentFolderId, type LockEntry, MarketplaceClient, type MarketplaceResult, type MarketplaceSearchResult, type MarketplaceSkill, type McpConfigFormat, type McpDetectionEntry, type McpScope, type McpServerConfig, type McpServerEntriesByProvider, type McpServerEntry, type McpTransportType, type NormalizeResult, type NormalizedHookEvent, type NormalizedRecommendationCriteria, type ParsedSource, PiHarness, PiRequiredError, type Provider, type ProviderCapabilities, type ProviderHarnessCapability, type ProviderHookProfile, type ProviderHookSummary, type ProviderHooksCapability, type ProviderMcpCapability, type ProviderPriority, type ProviderSkillsCapability, type ProviderSpawnCapability, type ProviderStatus, RECOMMENDATION_ERROR_CODES, type RankedSkillRecommendation, type RecommendSkillsResult, type RecommendationCriteriaInput, type RecommendationErrorCode, type RecommendationOptions, type RecommendationReason, type RecommendationReasonCode, type RecommendationScoreBreakdown, type RecommendationValidationIssue, type RecommendationValidationResult, type RecommendationWeights, type ReconcileResult, type RegistryHarnessKind, type RegistryHookCatalog, type RegistryHookFormat, type RemoveMcpServerOptions, type RemoveMcpServerResult, type RepairResult, type ResolveDefaultTargetProvidersOptions, type SkillBatchOperation, type SkillEntry, type SkillInstallResult, type SkillIntegrityResult, type SkillIntegrityStatus, type SkillLibrary, type SkillLibraryDispatchMatrix, type SkillLibraryEntry, type SkillLibraryManifest, type SkillLibraryManifestSkill, type SkillLibraryProfile, type SkillLibraryValidationIssue, type SkillLibraryValidationResult, type SkillMetadata, type SkillRowData, type SkillRowSourceType, type SkillsPrecedence, type SourceType, type SpawnAdapter, type SpawnMechanism, type SpawnOptions, type SpawnResult, type SubagentHandle, type SubagentResult, type SubagentTask, type SyncGlobalInstructionsOptions, type TransportType, type ValidateCantProfileResult, type ValidationIssue, type ValidationResult, type WriteAgentFileOptions, type WriteAgentFileResult, _resetPlatformPathsCache, assertCleoShippedBuildShape, assertNotTornRead, blockPattern, buildBlock, buildHookMatrix, buildInjectionContent, buildLibraryFromFiles, buildSkillsMap, catalog, checkAllInjections, checkAllSkillIntegrity, checkAllSkillUpdates, checkGlobalInstructionStaleness, checkInjection, checkSkillIntegrity, checkSkillUpdate, classifyPackageFilesEntry, clearRegisteredLibrary, dedupeFile, dedupeFiles, deepMerge, detectAllProviders, detectMcpInstallations, detectProjectProviders, detectProvider, discoverSkill, discoverSkills, ensureAllProviderInstructionFiles, ensureDir, ensureProviderInstructionFile, formatSkillRecommendations, generateInjectionContent, generateSkillsSection, getAgentsConfigPath, getAgentsHome, getAgentsInstructFile, getAgentsLinksDir, getAgentsMcpDir, getAgentsMcpServersPath, getAgentsSpecDir, getAgentsWikiDir, getAllCanonicalEvents, getAllHarnesses, getAllProviders, getCanonicalEvent, getCanonicalEventsByCategory, getCommonEvents, getCommonHookEvents, getEffectiveSkillsPaths, getExclusivityMode, getHarnessFor, getHookConfigPath, getHookMappingsVersion, getHookSupport, getHookSystemType, getInstalledProviders, getInstructionFiles, getLockFilePath, getMappedProviderIds, getNestedValue, getPlatformLocations, getPlatformPaths, getPrimaryHarness, getPrimaryProvider, getProjectAgentsDir, getProvider, getProviderAgentFolder, getProviderCapabilities, getProviderCount, getProviderHookProfile, getProviderInstructionReferences, getProviderOnlyEvents, getProviderSummary, getProvidersByHookEvent, getProvidersByInstructFile, getProvidersByPriority, getProvidersBySkillsPrecedence, getProvidersBySpawnCapability, getProvidersByStatus, getProvidersForEvent, getRegistryVersion, getSpawnCapableProviders, getSupportedEvents, getSystemInfo, getTrackedSkills, getUnsupportedEvents, groupByInstructFile, inferSkillSourceType, inject, injectAll, installBatchWithRollback, installMcpServer, installSkill, instructionFileCascade, isCaampOwnedSkill, isEmbeddedDelivery, isExclusivityMode, isMarketplaceScoped, isQuiet, isVerbose, listAllMcpServers, listCanonicalSkills, listMcpServers, loadLibraryFromModule, mergeBlockBodies, normalizeMarkers, normalizeRecommendationCriteria, parseBlocks, parseCaampBlocks, parseInjectionContent, parseSkillFile, parseSource, providerSupports, providerSupportsById, rankSkills, readConfig, recommendSkills, reconcile, recordSkillInstall, registerSkillLibrary, registerSkillLibraryFromPath, removeConfig, removeInjection, removeMcpServer, removeMcpServerFromAll, removeSkill, removeSkillFromLock, repairContent, repairInstructionFiles, resetDetectionCache, resetExclusivityModeOverride, resetRegistry, resolveAlias, resolveDefaultTargetProviders, resolveGlobalInstructionPath, resolveInstructionDelivery, resolveMcpConfigPath, resolveNativeEvent, resolveProviderSkillsDirs, resolveRegistryTemplatePath, scanDirectory, scanFile, scoreSkillRecommendation, searchSkills, selectProvidersByMinimumPriority, setExclusivityMode, setQuiet, setVerbose, shouldOverrideSkill, supportsHook, syncGlobalInstructions, toCanonical, toNative, toNativeBatch, toSarif, tokenizeCriteriaValue, translateToAll, updateInstructionsSingleOperation, validateInstructionIntegrity, validatePackageArtifact, validateRecommendationCriteria, validateSkill, withFileLock, writeAgentFileToAllProviders, writeConfig };

package/dist/index.js

@@ -8,6 +8,7 @@ import {
   buildLibraryFromFiles,
   catalog_exports,
   checkAllSkillUpdates,
+  checkGlobalInstructionStaleness,
   checkSkillUpdate,
   clearRegisteredLibrary,
   deepMerge,
@@ -65,14 +66,16 @@ import {
   setExclusivityMode,
   setQuiet,
   setVerbose,
+  syncGlobalInstructions,
   toSarif,
   tokenizeCriteriaValue,
   updateInstructionsSingleOperation,
   validateRecommendationCriteria,
   validateSkill,
   writeConfig
-} from "./chunk-52ZWZXEN.js";
+} from "./chunk-IBHW6GEI.js";
 import {
+  EmbeddedDeliveryDowngradeError,
   assertNotTornRead,
   blockPattern,
   buildBlock,
@@ -108,6 +111,7 @@ import {
   inject,
   injectAll,
   instructionFileCascade,
+  isEmbeddedDelivery,
   mergeBlockBodies,
   normalizeMarkers,
   parseBlocks,
@@ -119,11 +123,13 @@ import {
   removeInjection,
   repairContent,
   repairInstructionFiles,
+  resetRegistry,
   resolveAlias,
+  resolveGlobalInstructionPath,
   resolveInstructionDelivery,
   withFileLock,
   writeAgentFileToAllProviders
-} from "./chunk-G3CEXEW2.js";
+} from "./chunk-CHPNPLOK.js";
 import {
   CANONICAL_HOOK_EVENTS,
   HOOK_CATEGORIES,
@@ -499,7 +505,7 @@ function shouldOverrideSkill(skillName, incomingSource, existingEntry) {
   return true;
 }
 async function validateInstructionIntegrity(providers, projectDir, scope, expectedContent) {
-  const { checkAllInjections: checkAllInjections2 } = await import("./injector-X5FN7WMR.js");
+  const { checkAllInjections: checkAllInjections2 } = await import("./injector-ZUPRC2HS.js");
   const results = await checkAllInjections2(providers, projectDir, scope, expectedContent);
   const issues = [];
   for (const result of results) {
@@ -531,6 +537,7 @@ export {
   CLEO_ARTIFACT_REQUIREMENTS,
   DEFAULT_EXCLUSIVITY_MODE,
   EXCLUSIVITY_MODE_ENV_VAR,
+  EmbeddedDeliveryDowngradeError,
   HOOK_CATEGORIES,
   MarketplaceClient,
   PiHarness,
@@ -549,6 +556,7 @@ export {
   checkAllInjections,
   checkAllSkillIntegrity,
   checkAllSkillUpdates,
+  checkGlobalInstructionStaleness,
   checkInjection,
   checkSkillIntegrity,
   checkSkillUpdate,
@@ -631,6 +639,7 @@ export {
   installSkill,
   instructionFileCascade,
   isCaampOwnedSkill,
+  isEmbeddedDelivery,
   isExclusivityMode,
   isMarketplaceScoped,
   isQuiet,
@@ -666,8 +675,10 @@ export {
   repairInstructionFiles,
   resetDetectionCache,
   resetExclusivityModeOverride,
+  resetRegistry,
   resolveAlias,
   resolveDefaultTargetProviders,
+  resolveGlobalInstructionPath,
   resolveInstructionDelivery,
   resolveMcpConfigPath,
   resolveNativeEvent,
@@ -683,6 +694,7 @@ export {
   setVerbose,
   shouldOverrideSkill,
   supportsHook,
+  syncGlobalInstructions,
   toCanonical,
   toNative,
   toNativeBatch,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core/artifacts/validation.ts","../src/core/skills/integrity.ts"],"sourcesContent":["/**\n * Pure semantic validation of npm-produced package inventories.\n *\n * Code placed in `packages/caamp/` per Package-Boundary Check — verified\n * against AGENTS.md. No filesystem, process, model, or runtime-store access.\n */\n\nimport { posix } from 'node:path';\nimport type {\n  PackageArtifactBudgets,\n  PackageArtifactFile,\n  PackageArtifactInventory,\n  PackageArtifactIssue,\n  PackageArtifactPolicy,\n  PackageArtifactRequirement,\n  PackageArtifactValidation,\n  PackageFilesEntry,\n} from '@cleocode/contracts/package-artifact';\n\n/** Existing CLI upper budgets: 20 MiB packed, 36 MiB unpacked, and 800 files. */\nexport const CLEO_ARTIFACT_BUDGETS: Readonly<PackageArtifactBudgets> = Object.freeze({\n  packedBytes: 20 * 1024 * 1024,\n  unpackedBytes: 36 * 1024 * 1024,\n  fileCount: 800,\n});\n\n/** Required CLI and adapter-node resources, independent of historical byte/file-count floors. */\nexport const CLEO_ARTIFACT_REQUIREMENTS: readonly PackageArtifactRequirement[] = Object.freeze([\n  { id: 'cli-entry', path: 'dist/cli/index.js', match: 'exact' },\n  { id: 'studio-server-entry', path: 'studio-dist/index.js', match: 'exact' },\n  { id: 'studio-handler', path: 'studio-dist/handler.js', match: 'exact' },\n  { id: 'studio-server', path: 'studio-dist/server/index.js', match: 'exact' },\n  { id: 'studio-manifest', path: 'studio-dist/server/manifest.js', match: 'exact' },\n  {\n    id: 'studio-client-start',\n    path: 'studio-dist/client/_app/immutable/entry/start.*.js',\n    match: 'glob',\n  },\n  {\n    id: 'studio-client-app',\n    path: 'studio-dist/client/_app/immutable/entry/app.*.js',\n    match: 'glob',\n  },\n]);\n\nconst SHA256 = /^[a-f0-9]{64}$/;\nconst GLOB = /[*?{}[\\]]|[+@!]\\(/;\n\nfunction pathProblem(path: string): string | null {\n  if (!path || path.trim() !== path) return 'Path is empty or has surrounding whitespace.';\n  if (path.includes('\\\\') || /[\\x00-\\x1f\\x7f]/.test(path))\n    return 'Path is not a portable POSIX package path.';\n  if (posix.isAbsolute(path) || /^[A-Za-z]:/.test(path))\n    return 'Path must be relative to the package.';\n  if (path.split('/').some((part) => !part || part === '.' || part === '..')) {\n    return 'Path must not contain empty, current-directory, or parent-directory segments.';\n  }\n  return null;\n}\n\n/**\n * Classify a manifest files entry without evaluating exclusions as disk paths.\n *\n * @param entry - Original npm manifest entry.\n * @returns Classification only; actual selected content must come from the packer.\n * @example\n * ```ts\n * classifyPackageFilesEntry('!dist/index.js.map').kind; // 'exclusion'\n * ```\n */\nexport function classifyPackageFilesEntry(entry: string): PackageFilesEntry {\n  const exclusion = entry.startsWith('!');\n  const pattern = (exclusion ? entry.slice(1) : entry).replace(/^\\.\\//, '').replace(/\\/$/, '');\n  const reason = pattern.startsWith('!')\n    ? 'Repeated exclusion markers are not assessed.'\n    : pathProblem(pattern);\n  return {\n    entry,\n    pattern,\n    kind: reason ? 'invalid' : exclusion ? 'exclusion' : GLOB.test(pattern) ? 'glob' : 'literal',\n    reason,\n  };\n}\n\nfunction fileProblems(file: PackageArtifactFile): string[] {\n  const problems: string[] = [];\n  const pathError = pathProblem(file.path);\n  if (pathError) problems.push(pathError);\n  if (!Number.isSafeInteger(file.size) || file.size < 0)\n    problems.push('File size must be a nonnegative safe integer.');\n  if (file.sha256 !== undefined && !SHA256.test(file.sha256))\n    problems.push('File SHA-256 must be 64 lowercase hexadecimal characters.');\n  return problems;\n}\n\n/**\n * Validate nonempty semantic resources, inventory identity, expected hashes and upper budgets.\n *\n * @param inventory - Packer-produced evidence or an explicitly identified fixture.\n * @param policy - Independently specified resources, expected files and cost ceilings.\n * @returns A copied evidence receipt; valid means only the supplied checks passed.\n * @example\n * ```ts\n * const result = validatePackageArtifact(inventory, {\n *   requirements: CLEO_ARTIFACT_REQUIREMENTS,\n *   budgets: CLEO_ARTIFACT_BUDGETS,\n * });\n * // result.runtime remains 'not-assessed', even when result.valid is true.\n * ```\n */\nexport function validatePackageArtifact(\n  inventory: PackageArtifactInventory,\n  policy: PackageArtifactPolicy,\n): PackageArtifactValidation {\n  const issues: PackageArtifactIssue[] = [];\n  const add = (code: PackageArtifactIssue['code'], subject: string, message: string): void => {\n    issues.push({ code, subject, message });\n  };\n  if (!inventory.packageName.trim() || !inventory.version.trim()) {\n    add('invalid-inventory', 'identity', 'Package name and version must be recorded.');\n  }\n  if (!['npm-pack', 'npm-pack-dry-run', 'fixture'].includes(inventory.source)) {\n    add('invalid-inventory', 'source', 'Inventory provenance is not recognized.');\n  }\n  if (!Number.isSafeInteger(inventory.packedBytes) || inventory.packedBytes < 0) {\n    add('invalid-inventory', 'packedBytes', 'Packed bytes must be a nonnegative safe integer.');\n  }\n  if (inventory.tarballSha256 !== undefined && !SHA256.test(inventory.tarballSha256)) {\n    add(\n      'invalid-inventory',\n      'tarballSha256',\n      'Tarball SHA-256 must be 64 lowercase hexadecimal characters.',\n    );\n  }\n  if (inventory.source === 'npm-pack-dry-run' && inventory.tarballSha256 !== undefined) {\n    add(\n      'invalid-inventory',\n      'tarballSha256',\n      'A dry run cannot establish a retained tarball hash.',\n    );\n  }\n  const files = new Map<string, PackageArtifactFile>();\n  let unpackedBytes: number | null = 0;\n  for (const file of inventory.files) {\n    for (const problem of fileProblems(file)) add('invalid-inventory', file.path, problem);\n    if (files.has(file.path)) add('invalid-inventory', file.path, 'Duplicate inventory path.');\n    files.set(file.path, file);\n    if (unpackedBytes !== null) {\n      const total: number = unpackedBytes + file.size;\n      unpackedBytes = Number.isSafeInteger(total) && file.size >= 0 ? total : null;\n    }\n  }\n  if (unpackedBytes === null)\n    add('invalid-inventory', 'unpackedBytes', 'File bytes cannot be safely totaled.');\n  const entries = (policy.filesEntries ?? []).map(classifyPackageFilesEntry);\n  for (const entry of entries) {\n    if (entry.reason) add('invalid-policy', entry.entry, entry.reason);\n  }\n  if (!policy.requirements.length)\n    add('invalid-policy', 'requirements', 'At least one semantic content requirement is required.');\n  const ids = new Set<string>();\n  const requirements = policy.requirements.map((requirement) => {\n    const invalid = pathProblem(requirement.path);\n    const duplicate = ids.has(requirement.id);\n    ids.add(requirement.id);\n    if (\n      !requirement.id.trim() ||\n      duplicate ||\n      invalid ||\n      !['exact', 'glob'].includes(requirement.match)\n    ) {\n      add(\n        'invalid-policy',\n        requirement.id,\n        invalid ?? 'Requirement identity or match mode is invalid or duplicated.',\n      );\n      return { id: requirement.id, matchedPaths: [], satisfied: false };\n    }\n    const matches = inventory.files.filter((file) =>\n      requirement.match === 'exact'\n        ? file.path === requirement.path\n        : posix.matchesGlob(file.path, requirement.path),\n    );\n    if (!matches.length)\n      add(\n        'missing',\n        requirement.id,\n        `Required resource ${requirement.path} is absent from the selected inventory.`,\n      );\n    for (const file of matches) {\n      if (file.size === 0) add('empty', file.path, `Required resource ${requirement.id} is empty.`);\n    }\n    return {\n      id: requirement.id,\n      matchedPaths: matches.map((file) => file.path),\n      satisfied: matches.length > 0 && matches.every((file) => file.size > 0),\n    };\n  });\n  for (const pattern of policy.forbiddenPatterns ?? []) {\n    const invalid = pathProblem(pattern);\n    if (invalid) {\n      add('invalid-policy', pattern, invalid);\n      continue;\n    }\n    for (const file of inventory.files) {\n      if (posix.matchesGlob(file.path, pattern))\n        add('forbidden', file.path, `Selected file matches forbidden pattern ${pattern}.`);\n    }\n  }\n  let hashComparison: PackageArtifactValidation['hashComparison'] = 'not-requested';\n  for (const expected of policy.expectedFiles ?? []) {\n    const problems = fileProblems(expected);\n    for (const problem of problems) add('invalid-policy', expected.path, problem);\n    const actual = files.get(expected.path);\n    if (!actual) add('missing', expected.path, 'An independently expected file is missing.');\n    else if (actual.size !== expected.size)\n      add('mismatch', expected.path, 'File bytes differ from independently expected inventory.');\n    if (expected.sha256 !== undefined) {\n      if (hashComparison !== 'failed') hashComparison = 'matched';\n      if (problems.length || actual?.sha256 !== expected.sha256) {\n        hashComparison = 'failed';\n        add(\n          'mismatch',\n          expected.path,\n          'Actual hash is missing or differs from the independently expected SHA-256.',\n        );\n      }\n    }\n  }\n  for (const [field, limit] of Object.entries(policy.budgets)) {\n    if (!Number.isSafeInteger(limit) || limit < 0)\n      add('invalid-policy', field, 'Budget must be a nonnegative safe integer.');\n  }\n  if (inventory.packedBytes > policy.budgets.packedBytes)\n    add('budget', 'packedBytes', 'Packed bytes exceed the configured upper budget.');\n  if (unpackedBytes !== null && unpackedBytes > policy.budgets.unpackedBytes)\n    add('budget', 'unpackedBytes', 'Unpacked bytes exceed the configured upper budget.');\n  if (inventory.files.length > policy.budgets.fileCount)\n    add('budget', 'fileCount', 'Selected file count exceeds the configured upper budget.');\n  return {\n    valid: issues.length === 0,\n    inventory: { ...inventory, files: inventory.files.map((file) => ({ ...file })) },\n    unpackedBytes,\n    issues,\n    filesEntries: entries,\n    requirements,\n    hashComparison,\n    runtime: 'not-assessed',\n    limitations: [\n      'Manifest entries are classified only; the supplied packer inventory is the content authority.',\n      'Hashes are recorded and compared to supplied expected evidence; this validator does not read or authenticate tarball bytes.',\n      'Installability, module/dependency resolution, local-reference closure and native/dynamic runtime behavior are not assessed.',\n    ],\n  };\n}\n\n/**\n * Reject declaration and stray JavaScript output absent from the published CLI bundle.\n *\n * @param files - Actual selected package files, not a development directory listing.\n * @returns Concrete build-shape failures; this does not load the bundle.\n * @example\n * ```ts\n * assertCleoShippedBuildShape([{ path: 'dist/cli/index.js', size: 1 }]); // []\n * ```\n */\nexport function assertCleoShippedBuildShape(files: readonly PackageArtifactFile[]): string[] {\n  const reasons: string[] = [];\n  const dist = files.filter((file) => file.path.startsWith('dist/'));\n  const declarations = dist.filter(\n    (file) => file.path.endsWith('.d.ts') || file.path.endsWith('.d.ts.map'),\n  );\n  if (declarations.length)\n    reasons.push(\n      `${declarations.length} declaration file(s) under dist/ — the esbuild bundle emits none`,\n    );\n  const stray = dist.filter(\n    (file) => file.path.endsWith('.js') && file.path !== 'dist/cli/index.js',\n  );\n  if (stray.length)\n    reasons.push(\n      `${stray.length} .js file(s) under dist/ outside the declared entry dist/cli/index.js, e.g. ${stray[0]?.path}`,\n    );\n  return reasons;\n}\n","/**\n * Skill integrity checking\n *\n * Validates that installed skills have intact symlinks, correct canonical paths,\n * and enforces ct-* prefix priority for CAAMP-shipped skills.\n */\n\nimport { existsSync, lstatSync, readlinkSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { resolveSkillsRoot } from '@cleocode/core/skills/skill-root.js';\nimport type { LockEntry, Provider } from '../../types.js';\nimport { readLockFile } from '../lock-utils.js';\nimport { resolveProviderSkillsDirs } from '../paths/standard.js';\n\n/** CAAMP-reserved skill prefix. Skills with this prefix are owned by CAAMP. */\nconst CAAMP_SKILL_PREFIX = 'ct-';\n\n/**\n * Status of a single skill's integrity check.\n *\n * @public\n */\nexport type SkillIntegrityStatus =\n  | 'intact'\n  | 'broken-symlink'\n  | 'missing-canonical'\n  | 'missing-link'\n  | 'not-tracked'\n  | 'tampered';\n\n/**\n * Result of checking a single skill's integrity.\n *\n * @public\n */\nexport interface SkillIntegrityResult {\n  /** Skill name. */\n  name: string;\n  /** Overall integrity status. */\n  status: SkillIntegrityStatus;\n  /** Whether the canonical directory exists. */\n  canonicalExists: boolean;\n  /** Expected canonical path from lock file. */\n  canonicalPath: string | null;\n  /** Provider link statuses — which agents have valid symlinks. */\n  linkStatuses: Array<{\n    providerId: string;\n    linkPath: string;\n    exists: boolean;\n    isSymlink: boolean;\n    pointsToCanonical: boolean;\n  }>;\n  /** Whether this is a CAAMP-reserved (ct-*) skill. */\n  isCaampOwned: boolean;\n  /** Human-readable issue description, if any. */\n  issue?: string;\n}\n\n/**\n * Check whether a skill name is reserved by CAAMP (ct-* prefix).\n *\n * @remarks\n * Skills with the `ct-` prefix are considered CAAMP-owned and receive\n * special treatment during installation conflict resolution.\n *\n * @param skillName - Skill name to check\n * @returns `true` if the skill name starts with `ct-`\n *\n * @example\n * ```typescript\n * isCaampOwnedSkill(\"ct-research-agent\"); // true\n * isCaampOwnedSkill(\"my-custom-skill\");   // false\n * ```\n *\n * @public\n */\nexport function isCaampOwnedSkill(skillName: string): boolean {\n  return skillName.startsWith(CAAMP_SKILL_PREFIX);\n}\n\n/**\n * Check the integrity of a single installed skill.\n *\n * @remarks\n * Validates that the canonical directory exists on disk, the lock file entry\n * matches the actual state, and symlinks from provider skill directories\n * point to the canonical path.\n *\n * @param skillName - Name of the skill to check\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Integrity check result\n *\n * @example\n * ```typescript\n * const result = await checkSkillIntegrity(\"ct-research-agent\", providers, \"global\");\n * if (result.status !== \"intact\") {\n *   console.log(`Issue: ${result.issue}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkSkillIntegrity(\n  skillName: string,\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<SkillIntegrityResult> {\n  const lock = await readLockFile();\n  const entry = lock.skills[skillName];\n  const isCaampOwned = isCaampOwnedSkill(skillName);\n\n  // Not tracked in lock file\n  if (!entry) {\n    const canonicalPath = join(resolveSkillsRoot(), skillName);\n    return {\n      name: skillName,\n      status: 'not-tracked',\n      canonicalExists: existsSync(canonicalPath),\n      canonicalPath: null,\n      linkStatuses: [],\n      isCaampOwned,\n      issue: 'Skill is not tracked in the CAAMP lock file',\n    };\n  }\n\n  const canonicalPath = entry.canonicalPath;\n  const canonicalExists = existsSync(canonicalPath);\n\n  // Check symlinks for each provider\n  const linkStatuses: SkillIntegrityResult['linkStatuses'] = [];\n\n  for (const provider of providers) {\n    const targetDirs = resolveProviderSkillsDirs(provider, scope, projectDir);\n    for (const skillsDir of targetDirs) {\n      if (!skillsDir) continue;\n\n      const linkPath = join(skillsDir, skillName);\n      const exists = existsSync(linkPath);\n      let isSymlink = false;\n      let pointsToCanonical = false;\n\n      if (exists) {\n        try {\n          const stat = lstatSync(linkPath);\n          isSymlink = stat.isSymbolicLink();\n          if (isSymlink) {\n            const target = resolve(readlinkSync(linkPath));\n            pointsToCanonical = target === resolve(canonicalPath);\n          }\n        } catch {\n          // Can't stat — treat as broken\n        }\n      }\n\n      linkStatuses.push({\n        providerId: provider.id,\n        linkPath,\n        exists,\n        isSymlink,\n        pointsToCanonical,\n      });\n    }\n  }\n\n  // Determine overall status\n  if (!canonicalExists) {\n    return {\n      name: skillName,\n      status: 'missing-canonical',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `Canonical directory missing: ${canonicalPath}`,\n    };\n  }\n\n  const brokenLinks = linkStatuses.filter((l) => !l.exists);\n  const tamperedLinks = linkStatuses.filter((l) => l.exists && !l.pointsToCanonical);\n\n  if (tamperedLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'tampered',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${tamperedLinks.length} link(s) do not point to canonical path`,\n    };\n  }\n\n  if (brokenLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'broken-symlink',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${brokenLinks.length} symlink(s) missing`,\n    };\n  }\n\n  return {\n    name: skillName,\n    status: 'intact',\n    canonicalExists,\n    canonicalPath,\n    linkStatuses,\n    isCaampOwned,\n  };\n}\n\n/**\n * Check integrity of all tracked skills.\n *\n * @remarks\n * Iterates over every skill in the lock file and runs\n * {@link checkSkillIntegrity} on each.\n *\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Map of skill name to integrity result\n *\n * @example\n * ```typescript\n * const results = await checkAllSkillIntegrity(providers);\n * for (const [name, result] of results) {\n *   console.log(`${name}: ${result.status}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkAllSkillIntegrity(\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<Map<string, SkillIntegrityResult>> {\n  const lock = await readLockFile();\n  const results = new Map<string, SkillIntegrityResult>();\n\n  for (const skillName of Object.keys(lock.skills)) {\n    const result = await checkSkillIntegrity(skillName, providers, scope, projectDir);\n    results.set(skillName, result);\n  }\n\n  return results;\n}\n\n/**\n * Resolve a skill name conflict where a user-installed skill collides\n * with a CAAMP-owned (ct-*) skill.\n *\n * @remarks\n * CAAMP-owned skills always win. Returns `true` if the incoming skill\n * should take precedence over the existing installation.\n *\n * @param skillName - Skill name to check\n * @param incomingSource - Source of the incoming skill installation\n * @param existingEntry - Existing lock entry, if any\n * @returns `true` if the incoming installation should proceed\n *\n * @example\n * ```typescript\n * const proceed = shouldOverrideSkill(\"ct-research-agent\", \"library\", existingEntry);\n * if (proceed) {\n *   // Safe to install/override\n * }\n * ```\n *\n * @public\n */\nexport function shouldOverrideSkill(\n  skillName: string,\n  incomingSource: string,\n  existingEntry: LockEntry | undefined,\n): boolean {\n  // No existing entry — always allow\n  if (!existingEntry) return true;\n\n  // For ct-* skills, CAAMP package source always wins\n  if (isCaampOwnedSkill(skillName)) {\n    // If incoming is from CAAMP package (library source), it always wins\n    if (existingEntry.sourceType === 'library') return true;\n    // If existing is from CAAMP but incoming is user, CAAMP wins (block user)\n    return true;\n  }\n\n  // Non-ct-* skills: user always wins\n  return true;\n}\n\n/**\n * Validate instruction file injection status across all providers.\n *\n * @remarks\n * Checks that CAAMP blocks exist and are current in all relevant\n * instruction files (CLAUDE.md, AGENTS.md, GEMINI.md).\n *\n * @param providers - Providers to check\n * @param projectDir - Project directory\n * @param scope - Whether to check global or project files\n * @param expectedContent - Expected CAAMP block content\n * @returns Array of file paths with issues\n *\n * @example\n * ```typescript\n * const issues = await validateInstructionIntegrity(providers, process.cwd(), \"project\");\n * for (const issue of issues) {\n *   console.log(`${issue.providerId}: ${issue.issue} (${issue.file})`);\n * }\n * ```\n *\n * @public\n */\nexport async function validateInstructionIntegrity(\n  providers: Provider[],\n  projectDir: string,\n  scope: 'project' | 'global',\n  expectedContent?: string,\n): Promise<Array<{ file: string; providerId: string; issue: string }>> {\n  const { checkAllInjections } = await import('../instructions/injector.js');\n  const results = await checkAllInjections(providers, projectDir, scope, expectedContent);\n  const issues: Array<{ file: string; providerId: string; issue: string }> = [];\n\n  for (const result of results) {\n    if (result.status === 'missing') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'Instruction file does not exist',\n      });\n    } else if (result.status === 'none') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'No CAAMP injection block found',\n      });\n    } else if (result.status === 'outdated') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'CAAMP injection block is outdated',\n      });\n    }\n  }\n\n  return issues;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,SAAS,aAAa;AAaf,IAAM,wBAA0D,OAAO,OAAO;AAAA,EACnF,aAAa,KAAK,OAAO;AAAA,EACzB,eAAe,KAAK,OAAO;AAAA,EAC3B,WAAW;AACb,CAAC;AAGM,IAAM,6BAAoE,OAAO,OAAO;AAAA,EAC7F,EAAE,IAAI,aAAa,MAAM,qBAAqB,OAAO,QAAQ;AAAA,EAC7D,EAAE,IAAI,uBAAuB,MAAM,wBAAwB,OAAO,QAAQ;AAAA,EAC1E,EAAE,IAAI,kBAAkB,MAAM,0BAA0B,OAAO,QAAQ;AAAA,EACvE,EAAE,IAAI,iBAAiB,MAAM,+BAA+B,OAAO,QAAQ;AAAA,EAC3E,EAAE,IAAI,mBAAmB,MAAM,kCAAkC,OAAO,QAAQ;AAAA,EAChF;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AACF,CAAC;AAED,IAAM,SAAS;AACf,IAAM,OAAO;AAEb,SAAS,YAAY,MAA6B;AAChD,MAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,KAAM,QAAO;AAC1C,MAAI,KAAK,SAAS,IAAI,KAAK,kBAAkB,KAAK,IAAI;AACpD,WAAO;AACT,MAAI,MAAM,WAAW,IAAI,KAAK,aAAa,KAAK,IAAI;AAClD,WAAO;AACT,MAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAYO,SAAS,0BAA0B,OAAkC;AAC1E,QAAM,YAAY,MAAM,WAAW,GAAG;AACtC,QAAM,WAAW,YAAY,MAAM,MAAM,CAAC,IAAI,OAAO,QAAQ,SAAS,EAAE,EAAE,QAAQ,OAAO,EAAE;AAC3F,QAAM,SAAS,QAAQ,WAAW,GAAG,IACjC,iDACA,YAAY,OAAO;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,SAAS,YAAY,YAAY,cAAc,KAAK,KAAK,OAAO,IAAI,SAAS;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAqC;AACzD,QAAM,WAAqB,CAAC;AAC5B,QAAM,YAAY,YAAY,KAAK,IAAI;AACvC,MAAI,UAAW,UAAS,KAAK,SAAS;AACtC,MAAI,CAAC,OAAO,cAAc,KAAK,IAAI,KAAK,KAAK,OAAO;AAClD,aAAS,KAAK,+CAA+C;AAC/D,MAAI,KAAK,WAAW,UAAa,CAAC,OAAO,KAAK,KAAK,MAAM;AACvD,aAAS,KAAK,2DAA2D;AAC3E,SAAO;AACT;AAiBO,SAAS,wBACd,WACA,QAC2B;AAC3B,QAAM,SAAiC,CAAC;AACxC,QAAM,MAAM,CAAC,MAAoC,SAAiB,YAA0B;AAC1F,WAAO,KAAK,EAAE,MAAM,SAAS,QAAQ,CAAC;AAAA,EACxC;AACA,MAAI,CAAC,UAAU,YAAY,KAAK,KAAK,CAAC,UAAU,QAAQ,KAAK,GAAG;AAC9D,QAAI,qBAAqB,YAAY,4CAA4C;AAAA,EACnF;AACA,MAAI,CAAC,CAAC,YAAY,oBAAoB,SAAS,EAAE,SAAS,UAAU,MAAM,GAAG;AAC3E,QAAI,qBAAqB,UAAU,yCAAyC;AAAA,EAC9E;AACA,MAAI,CAAC,OAAO,cAAc,UAAU,WAAW,KAAK,UAAU,cAAc,GAAG;AAC7E,QAAI,qBAAqB,eAAe,kDAAkD;AAAA,EAC5F;AACA,MAAI,UAAU,kBAAkB,UAAa,CAAC,OAAO,KAAK,UAAU,aAAa,GAAG;AAClF;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,WAAW,sBAAsB,UAAU,kBAAkB,QAAW;AACpF;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,oBAAI,IAAiC;AACnD,MAAI,gBAA+B;AACnC,aAAW,QAAQ,UAAU,OAAO;AAClC,eAAW,WAAW,aAAa,IAAI,EAAG,KAAI,qBAAqB,KAAK,MAAM,OAAO;AACrF,QAAI,MAAM,IAAI,KAAK,IAAI,EAAG,KAAI,qBAAqB,KAAK,MAAM,2BAA2B;AACzF,UAAM,IAAI,KAAK,MAAM,IAAI;AACzB,QAAI,kBAAkB,MAAM;AAC1B,YAAM,QAAgB,gBAAgB,KAAK;AAC3C,sBAAgB,OAAO,cAAc,KAAK,KAAK,KAAK,QAAQ,IAAI,QAAQ;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,kBAAkB;AACpB,QAAI,qBAAqB,iBAAiB,sCAAsC;AAClF,QAAM,WAAW,OAAO,gBAAgB,CAAC,GAAG,IAAI,yBAAyB;AACzE,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,OAAQ,KAAI,kBAAkB,MAAM,OAAO,MAAM,MAAM;AAAA,EACnE;AACA,MAAI,CAAC,OAAO,aAAa;AACvB,QAAI,kBAAkB,gBAAgB,wDAAwD;AAChG,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,eAAe,OAAO,aAAa,IAAI,CAAC,gBAAgB;AAC5D,UAAM,UAAU,YAAY,YAAY,IAAI;AAC5C,UAAM,YAAY,IAAI,IAAI,YAAY,EAAE;AACxC,QAAI,IAAI,YAAY,EAAE;AACtB,QACE,CAAC,YAAY,GAAG,KAAK,KACrB,aACA,WACA,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,YAAY,KAAK,GAC7C;AACA;AAAA,QACE;AAAA,QACA,YAAY;AAAA,QACZ,WAAW;AAAA,MACb;AACA,aAAO,EAAE,IAAI,YAAY,IAAI,cAAc,CAAC,GAAG,WAAW,MAAM;AAAA,IAClE;AACA,UAAM,UAAU,UAAU,MAAM;AAAA,MAAO,CAAC,SACtC,YAAY,UAAU,UAClB,KAAK,SAAS,YAAY,OAC1B,MAAM,YAAY,KAAK,MAAM,YAAY,IAAI;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ;AACX;AAAA,QACE;AAAA,QACA,YAAY;AAAA,QACZ,qBAAqB,YAAY,IAAI;AAAA,MACvC;AACF,eAAW,QAAQ,SAAS;AAC1B,UAAI,KAAK,SAAS,EAAG,KAAI,SAAS,KAAK,MAAM,qBAAqB,YAAY,EAAE,YAAY;AAAA,IAC9F;AACA,WAAO;AAAA,MACL,IAAI,YAAY;AAAA,MAChB,cAAc,QAAQ,IAAI,CAAC,SAAS,KAAK,IAAI;AAAA,MAC7C,WAAW,QAAQ,SAAS,KAAK,QAAQ,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC;AAAA,IACxE;AAAA,EACF,CAAC;AACD,aAAW,WAAW,OAAO,qBAAqB,CAAC,GAAG;AACpD,UAAM,UAAU,YAAY,OAAO;AACnC,QAAI,SAAS;AACX,UAAI,kBAAkB,SAAS,OAAO;AACtC;AAAA,IACF;AACA,eAAW,QAAQ,UAAU,OAAO;AAClC,UAAI,MAAM,YAAY,KAAK,MAAM,OAAO;AACtC,YAAI,aAAa,KAAK,MAAM,2CAA2C,OAAO,GAAG;AAAA,IACrF;AAAA,EACF;AACA,MAAI,iBAA8D;AAClE,aAAW,YAAY,OAAO,iBAAiB,CAAC,GAAG;AACjD,UAAM,WAAW,aAAa,QAAQ;AACtC,eAAW,WAAW,SAAU,KAAI,kBAAkB,SAAS,MAAM,OAAO;AAC5E,UAAM,SAAS,MAAM,IAAI,SAAS,IAAI;AACtC,QAAI,CAAC,OAAQ,KAAI,WAAW,SAAS,MAAM,4CAA4C;AAAA,aAC9E,OAAO,SAAS,SAAS;AAChC,UAAI,YAAY,SAAS,MAAM,0DAA0D;AAC3F,QAAI,SAAS,WAAW,QAAW;AACjC,UAAI,mBAAmB,SAAU,kBAAiB;AAClD,UAAI,SAAS,UAAU,QAAQ,WAAW,SAAS,QAAQ;AACzD,yBAAiB;AACjB;AAAA,UACE;AAAA,UACA,SAAS;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AAC3D,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ;AAC1C,UAAI,kBAAkB,OAAO,4CAA4C;AAAA,EAC7E;AACA,MAAI,UAAU,cAAc,OAAO,QAAQ;AACzC,QAAI,UAAU,eAAe,kDAAkD;AACjF,MAAI,kBAAkB,QAAQ,gBAAgB,OAAO,QAAQ;AAC3D,QAAI,UAAU,iBAAiB,oDAAoD;AACrF,MAAI,UAAU,MAAM,SAAS,OAAO,QAAQ;AAC1C,QAAI,UAAU,aAAa,0DAA0D;AACvF,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,WAAW,EAAE,GAAG,WAAW,OAAO,UAAU,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,EAAE,EAAE;AAAA,IAC/E;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,4BAA4B,OAAiD;AAC3F,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,MAAM,OAAO,CAAC,SAAS,KAAK,KAAK,WAAW,OAAO,CAAC;AACjE,QAAM,eAAe,KAAK;AAAA,IACxB,CAAC,SAAS,KAAK,KAAK,SAAS,OAAO,KAAK,KAAK,KAAK,SAAS,WAAW;AAAA,EACzE;AACA,MAAI,aAAa;AACf,YAAQ;AAAA,MACN,GAAG,aAAa,MAAM;AAAA,IACxB;AACF,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,SAAS,KAAK,KAAK,SAAS,KAAK,KAAK,KAAK,SAAS;AAAA,EACvD;AACA,MAAI,MAAM;AACR,YAAQ;AAAA,MACN,GAAG,MAAM,MAAM,+EAA+E,MAAM,CAAC,GAAG,IAAI;AAAA,IAC9G;AACF,SAAO;AACT;;;ACrRA,SAAS,YAAY,WAAW,oBAAoB;AACpD,SAAS,MAAM,eAAe;AAC9B,SAAS,yBAAyB;AAMlC,IAAM,qBAAqB;AA6DpB,SAAS,kBAAkB,WAA4B;AAC5D,SAAO,UAAU,WAAW,kBAAkB;AAChD;AA0BA,eAAsB,oBACpB,WACA,WACA,QAA8B,UAC9B,YAC+B;AAC/B,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,QAAQ,KAAK,OAAO,SAAS;AACnC,QAAM,eAAe,kBAAkB,SAAS;AAGhD,MAAI,CAAC,OAAO;AACV,UAAMA,iBAAgB,KAAK,kBAAkB,GAAG,SAAS;AACzD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,iBAAiB,WAAWA,cAAa;AAAA,MACzC,eAAe;AAAA,MACf,cAAc,CAAC;AAAA,MACf;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAC5B,QAAM,kBAAkB,WAAW,aAAa;AAGhD,QAAM,eAAqD,CAAC;AAE5D,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,0BAA0B,UAAU,OAAO,UAAU;AACxE,eAAW,aAAa,YAAY;AAClC,UAAI,CAAC,UAAW;AAEhB,YAAM,WAAW,KAAK,WAAW,SAAS;AAC1C,YAAM,SAAS,WAAW,QAAQ;AAClC,UAAI,YAAY;AAChB,UAAI,oBAAoB;AAExB,UAAI,QAAQ;AACV,YAAI;AACF,gBAAM,OAAO,UAAU,QAAQ;AAC/B,sBAAY,KAAK,eAAe;AAChC,cAAI,WAAW;AACb,kBAAM,SAAS,QAAQ,aAAa,QAAQ,CAAC;AAC7C,gCAAoB,WAAW,QAAQ,aAAa;AAAA,UACtD;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,mBAAa,KAAK;AAAA,QAChB,YAAY,SAAS;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,CAAC,iBAAiB;AACpB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,gCAAgC,aAAa;AAAA,IACtD;AAAA,EACF;AAEA,QAAM,cAAc,aAAa,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACxD,QAAM,gBAAgB,aAAa,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,iBAAiB;AAEjF,MAAI,cAAc,SAAS,GAAG;AAC5B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,cAAc,MAAM;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,YAAY,MAAM;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAwBA,eAAsB,uBACpB,WACA,QAA8B,UAC9B,YAC4C;AAC5C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,oBAAI,IAAkC;AAEtD,aAAW,aAAa,OAAO,KAAK,KAAK,MAAM,GAAG;AAChD,UAAM,SAAS,MAAM,oBAAoB,WAAW,WAAW,OAAO,UAAU;AAChF,YAAQ,IAAI,WAAW,MAAM;AAAA,EAC/B;AAEA,SAAO;AACT;AAyBO,SAAS,oBACd,WACA,gBACA,eACS;AAET,MAAI,CAAC,cAAe,QAAO;AAG3B,MAAI,kBAAkB,SAAS,GAAG;AAEhC,QAAI,cAAc,eAAe,UAAW,QAAO;AAEnD,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAyBA,eAAsB,6BACpB,WACA,YACA,OACA,iBACqE;AACrE,QAAM,EAAE,oBAAAC,oBAAmB,IAAI,MAAM,OAAO,wBAA6B;AACzE,QAAM,UAAU,MAAMA,oBAAmB,WAAW,YAAY,OAAO,eAAe;AACtF,QAAM,SAAqE,CAAC;AAE5E,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,WAAW;AAC/B,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,QAAQ;AACnC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,YAAY;AACvC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["canonicalPath","checkAllInjections"]}
+{"version":3,"sources":["../src/core/artifacts/validation.ts","../src/core/skills/integrity.ts"],"sourcesContent":["/**\n * Pure semantic validation of npm-produced package inventories.\n *\n * Code placed in `packages/caamp/` per Package-Boundary Check — verified\n * against AGENTS.md. No filesystem, process, model, or runtime-store access.\n */\n\nimport { posix } from 'node:path';\nimport type {\n  PackageArtifactBudgets,\n  PackageArtifactFile,\n  PackageArtifactInventory,\n  PackageArtifactIssue,\n  PackageArtifactPolicy,\n  PackageArtifactRequirement,\n  PackageArtifactValidation,\n  PackageFilesEntry,\n} from '@cleocode/contracts/package-artifact';\n\n/** Existing CLI upper budgets: 20 MiB packed, 36 MiB unpacked, and 800 files. */\nexport const CLEO_ARTIFACT_BUDGETS: Readonly<PackageArtifactBudgets> = Object.freeze({\n  packedBytes: 20 * 1024 * 1024,\n  unpackedBytes: 36 * 1024 * 1024,\n  fileCount: 800,\n});\n\n/** Required CLI and adapter-node resources, independent of historical byte/file-count floors. */\nexport const CLEO_ARTIFACT_REQUIREMENTS: readonly PackageArtifactRequirement[] = Object.freeze([\n  { id: 'cli-entry', path: 'dist/cli/index.js', match: 'exact' },\n  { id: 'studio-server-entry', path: 'studio-dist/index.js', match: 'exact' },\n  { id: 'studio-handler', path: 'studio-dist/handler.js', match: 'exact' },\n  { id: 'studio-server', path: 'studio-dist/server/index.js', match: 'exact' },\n  { id: 'studio-manifest', path: 'studio-dist/server/manifest.js', match: 'exact' },\n  {\n    id: 'studio-client-start',\n    path: 'studio-dist/client/_app/immutable/entry/start.*.js',\n    match: 'glob',\n  },\n  {\n    id: 'studio-client-app',\n    path: 'studio-dist/client/_app/immutable/entry/app.*.js',\n    match: 'glob',\n  },\n]);\n\nconst SHA256 = /^[a-f0-9]{64}$/;\nconst GLOB = /[*?{}[\\]]|[+@!]\\(/;\n\nfunction pathProblem(path: string): string | null {\n  if (!path || path.trim() !== path) return 'Path is empty or has surrounding whitespace.';\n  if (path.includes('\\\\') || /[\\x00-\\x1f\\x7f]/.test(path))\n    return 'Path is not a portable POSIX package path.';\n  if (posix.isAbsolute(path) || /^[A-Za-z]:/.test(path))\n    return 'Path must be relative to the package.';\n  if (path.split('/').some((part) => !part || part === '.' || part === '..')) {\n    return 'Path must not contain empty, current-directory, or parent-directory segments.';\n  }\n  return null;\n}\n\n/**\n * Classify a manifest files entry without evaluating exclusions as disk paths.\n *\n * @param entry - Original npm manifest entry.\n * @returns Classification only; actual selected content must come from the packer.\n * @example\n * ```ts\n * classifyPackageFilesEntry('!dist/index.js.map').kind; // 'exclusion'\n * ```\n */\nexport function classifyPackageFilesEntry(entry: string): PackageFilesEntry {\n  const exclusion = entry.startsWith('!');\n  const pattern = (exclusion ? entry.slice(1) : entry).replace(/^\\.\\//, '').replace(/\\/$/, '');\n  const reason = pattern.startsWith('!')\n    ? 'Repeated exclusion markers are not assessed.'\n    : pathProblem(pattern);\n  return {\n    entry,\n    pattern,\n    kind: reason ? 'invalid' : exclusion ? 'exclusion' : GLOB.test(pattern) ? 'glob' : 'literal',\n    reason,\n  };\n}\n\nfunction fileProblems(file: PackageArtifactFile): string[] {\n  const problems: string[] = [];\n  const pathError = pathProblem(file.path);\n  if (pathError) problems.push(pathError);\n  if (!Number.isSafeInteger(file.size) || file.size < 0)\n    problems.push('File size must be a nonnegative safe integer.');\n  if (file.sha256 !== undefined && !SHA256.test(file.sha256))\n    problems.push('File SHA-256 must be 64 lowercase hexadecimal characters.');\n  return problems;\n}\n\n/**\n * Validate nonempty semantic resources, inventory identity, expected hashes and upper budgets.\n *\n * @param inventory - Packer-produced evidence or an explicitly identified fixture.\n * @param policy - Independently specified resources, expected files and cost ceilings.\n * @returns A copied evidence receipt; valid means only the supplied checks passed.\n * @example\n * ```ts\n * const result = validatePackageArtifact(inventory, {\n *   requirements: CLEO_ARTIFACT_REQUIREMENTS,\n *   budgets: CLEO_ARTIFACT_BUDGETS,\n * });\n * // result.runtime remains 'not-assessed', even when result.valid is true.\n * ```\n */\nexport function validatePackageArtifact(\n  inventory: PackageArtifactInventory,\n  policy: PackageArtifactPolicy,\n): PackageArtifactValidation {\n  const issues: PackageArtifactIssue[] = [];\n  const add = (code: PackageArtifactIssue['code'], subject: string, message: string): void => {\n    issues.push({ code, subject, message });\n  };\n  if (!inventory.packageName.trim() || !inventory.version.trim()) {\n    add('invalid-inventory', 'identity', 'Package name and version must be recorded.');\n  }\n  if (!['npm-pack', 'npm-pack-dry-run', 'fixture'].includes(inventory.source)) {\n    add('invalid-inventory', 'source', 'Inventory provenance is not recognized.');\n  }\n  if (!Number.isSafeInteger(inventory.packedBytes) || inventory.packedBytes < 0) {\n    add('invalid-inventory', 'packedBytes', 'Packed bytes must be a nonnegative safe integer.');\n  }\n  if (inventory.tarballSha256 !== undefined && !SHA256.test(inventory.tarballSha256)) {\n    add(\n      'invalid-inventory',\n      'tarballSha256',\n      'Tarball SHA-256 must be 64 lowercase hexadecimal characters.',\n    );\n  }\n  if (inventory.source === 'npm-pack-dry-run' && inventory.tarballSha256 !== undefined) {\n    add(\n      'invalid-inventory',\n      'tarballSha256',\n      'A dry run cannot establish a retained tarball hash.',\n    );\n  }\n  const files = new Map<string, PackageArtifactFile>();\n  let unpackedBytes: number | null = 0;\n  for (const file of inventory.files) {\n    for (const problem of fileProblems(file)) add('invalid-inventory', file.path, problem);\n    if (files.has(file.path)) add('invalid-inventory', file.path, 'Duplicate inventory path.');\n    files.set(file.path, file);\n    if (unpackedBytes !== null) {\n      const total: number = unpackedBytes + file.size;\n      unpackedBytes = Number.isSafeInteger(total) && file.size >= 0 ? total : null;\n    }\n  }\n  if (unpackedBytes === null)\n    add('invalid-inventory', 'unpackedBytes', 'File bytes cannot be safely totaled.');\n  const entries = (policy.filesEntries ?? []).map(classifyPackageFilesEntry);\n  for (const entry of entries) {\n    if (entry.reason) add('invalid-policy', entry.entry, entry.reason);\n  }\n  if (!policy.requirements.length)\n    add('invalid-policy', 'requirements', 'At least one semantic content requirement is required.');\n  const ids = new Set<string>();\n  const requirements = policy.requirements.map((requirement) => {\n    const invalid = pathProblem(requirement.path);\n    const duplicate = ids.has(requirement.id);\n    ids.add(requirement.id);\n    if (\n      !requirement.id.trim() ||\n      duplicate ||\n      invalid ||\n      !['exact', 'glob'].includes(requirement.match)\n    ) {\n      add(\n        'invalid-policy',\n        requirement.id,\n        invalid ?? 'Requirement identity or match mode is invalid or duplicated.',\n      );\n      return { id: requirement.id, matchedPaths: [], satisfied: false };\n    }\n    const matches = inventory.files.filter((file) =>\n      requirement.match === 'exact'\n        ? file.path === requirement.path\n        : posix.matchesGlob(file.path, requirement.path),\n    );\n    if (!matches.length)\n      add(\n        'missing',\n        requirement.id,\n        `Required resource ${requirement.path} is absent from the selected inventory.`,\n      );\n    for (const file of matches) {\n      if (file.size === 0) add('empty', file.path, `Required resource ${requirement.id} is empty.`);\n    }\n    return {\n      id: requirement.id,\n      matchedPaths: matches.map((file) => file.path),\n      satisfied: matches.length > 0 && matches.every((file) => file.size > 0),\n    };\n  });\n  for (const pattern of policy.forbiddenPatterns ?? []) {\n    const invalid = pathProblem(pattern);\n    if (invalid) {\n      add('invalid-policy', pattern, invalid);\n      continue;\n    }\n    for (const file of inventory.files) {\n      if (posix.matchesGlob(file.path, pattern))\n        add('forbidden', file.path, `Selected file matches forbidden pattern ${pattern}.`);\n    }\n  }\n  let hashComparison: PackageArtifactValidation['hashComparison'] = 'not-requested';\n  for (const expected of policy.expectedFiles ?? []) {\n    const problems = fileProblems(expected);\n    for (const problem of problems) add('invalid-policy', expected.path, problem);\n    const actual = files.get(expected.path);\n    if (!actual) add('missing', expected.path, 'An independently expected file is missing.');\n    else if (actual.size !== expected.size)\n      add('mismatch', expected.path, 'File bytes differ from independently expected inventory.');\n    if (expected.sha256 !== undefined) {\n      if (hashComparison !== 'failed') hashComparison = 'matched';\n      if (problems.length || actual?.sha256 !== expected.sha256) {\n        hashComparison = 'failed';\n        add(\n          'mismatch',\n          expected.path,\n          'Actual hash is missing or differs from the independently expected SHA-256.',\n        );\n      }\n    }\n  }\n  for (const [field, limit] of Object.entries(policy.budgets)) {\n    if (!Number.isSafeInteger(limit) || limit < 0)\n      add('invalid-policy', field, 'Budget must be a nonnegative safe integer.');\n  }\n  if (inventory.packedBytes > policy.budgets.packedBytes)\n    add('budget', 'packedBytes', 'Packed bytes exceed the configured upper budget.');\n  if (unpackedBytes !== null && unpackedBytes > policy.budgets.unpackedBytes)\n    add('budget', 'unpackedBytes', 'Unpacked bytes exceed the configured upper budget.');\n  if (inventory.files.length > policy.budgets.fileCount)\n    add('budget', 'fileCount', 'Selected file count exceeds the configured upper budget.');\n  return {\n    valid: issues.length === 0,\n    inventory: { ...inventory, files: inventory.files.map((file) => ({ ...file })) },\n    unpackedBytes,\n    issues,\n    filesEntries: entries,\n    requirements,\n    hashComparison,\n    runtime: 'not-assessed',\n    limitations: [\n      'Manifest entries are classified only; the supplied packer inventory is the content authority.',\n      'Hashes are recorded and compared to supplied expected evidence; this validator does not read or authenticate tarball bytes.',\n      'Installability, module/dependency resolution, local-reference closure and native/dynamic runtime behavior are not assessed.',\n    ],\n  };\n}\n\n/**\n * Reject declaration and stray JavaScript output absent from the published CLI bundle.\n *\n * @param files - Actual selected package files, not a development directory listing.\n * @returns Concrete build-shape failures; this does not load the bundle.\n * @example\n * ```ts\n * assertCleoShippedBuildShape([{ path: 'dist/cli/index.js', size: 1 }]); // []\n * ```\n */\nexport function assertCleoShippedBuildShape(files: readonly PackageArtifactFile[]): string[] {\n  const reasons: string[] = [];\n  const dist = files.filter((file) => file.path.startsWith('dist/'));\n  const declarations = dist.filter(\n    (file) => file.path.endsWith('.d.ts') || file.path.endsWith('.d.ts.map'),\n  );\n  if (declarations.length)\n    reasons.push(\n      `${declarations.length} declaration file(s) under dist/ — the esbuild bundle emits none`,\n    );\n  const stray = dist.filter(\n    (file) => file.path.endsWith('.js') && file.path !== 'dist/cli/index.js',\n  );\n  if (stray.length)\n    reasons.push(\n      `${stray.length} .js file(s) under dist/ outside the declared entry dist/cli/index.js, e.g. ${stray[0]?.path}`,\n    );\n  return reasons;\n}\n","/**\n * Skill integrity checking\n *\n * Validates that installed skills have intact symlinks, correct canonical paths,\n * and enforces ct-* prefix priority for CAAMP-shipped skills.\n */\n\nimport { existsSync, lstatSync, readlinkSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { resolveSkillsRoot } from '@cleocode/core/skills/skill-root.js';\nimport type { LockEntry, Provider } from '../../types.js';\nimport { readLockFile } from '../lock-utils.js';\nimport { resolveProviderSkillsDirs } from '../paths/standard.js';\n\n/** CAAMP-reserved skill prefix. Skills with this prefix are owned by CAAMP. */\nconst CAAMP_SKILL_PREFIX = 'ct-';\n\n/**\n * Status of a single skill's integrity check.\n *\n * @public\n */\nexport type SkillIntegrityStatus =\n  | 'intact'\n  | 'broken-symlink'\n  | 'missing-canonical'\n  | 'missing-link'\n  | 'not-tracked'\n  | 'tampered';\n\n/**\n * Result of checking a single skill's integrity.\n *\n * @public\n */\nexport interface SkillIntegrityResult {\n  /** Skill name. */\n  name: string;\n  /** Overall integrity status. */\n  status: SkillIntegrityStatus;\n  /** Whether the canonical directory exists. */\n  canonicalExists: boolean;\n  /** Expected canonical path from lock file. */\n  canonicalPath: string | null;\n  /** Provider link statuses — which agents have valid symlinks. */\n  linkStatuses: Array<{\n    providerId: string;\n    linkPath: string;\n    exists: boolean;\n    isSymlink: boolean;\n    pointsToCanonical: boolean;\n  }>;\n  /** Whether this is a CAAMP-reserved (ct-*) skill. */\n  isCaampOwned: boolean;\n  /** Human-readable issue description, if any. */\n  issue?: string;\n}\n\n/**\n * Check whether a skill name is reserved by CAAMP (ct-* prefix).\n *\n * @remarks\n * Skills with the `ct-` prefix are considered CAAMP-owned and receive\n * special treatment during installation conflict resolution.\n *\n * @param skillName - Skill name to check\n * @returns `true` if the skill name starts with `ct-`\n *\n * @example\n * ```typescript\n * isCaampOwnedSkill(\"ct-research-agent\"); // true\n * isCaampOwnedSkill(\"my-custom-skill\");   // false\n * ```\n *\n * @public\n */\nexport function isCaampOwnedSkill(skillName: string): boolean {\n  return skillName.startsWith(CAAMP_SKILL_PREFIX);\n}\n\n/**\n * Check the integrity of a single installed skill.\n *\n * @remarks\n * Validates that the canonical directory exists on disk, the lock file entry\n * matches the actual state, and symlinks from provider skill directories\n * point to the canonical path.\n *\n * @param skillName - Name of the skill to check\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Integrity check result\n *\n * @example\n * ```typescript\n * const result = await checkSkillIntegrity(\"ct-research-agent\", providers, \"global\");\n * if (result.status !== \"intact\") {\n *   console.log(`Issue: ${result.issue}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkSkillIntegrity(\n  skillName: string,\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<SkillIntegrityResult> {\n  const lock = await readLockFile();\n  const entry = lock.skills[skillName];\n  const isCaampOwned = isCaampOwnedSkill(skillName);\n\n  // Not tracked in lock file\n  if (!entry) {\n    const canonicalPath = join(resolveSkillsRoot(), skillName);\n    return {\n      name: skillName,\n      status: 'not-tracked',\n      canonicalExists: existsSync(canonicalPath),\n      canonicalPath: null,\n      linkStatuses: [],\n      isCaampOwned,\n      issue: 'Skill is not tracked in the CAAMP lock file',\n    };\n  }\n\n  const canonicalPath = entry.canonicalPath;\n  const canonicalExists = existsSync(canonicalPath);\n\n  // Check symlinks for each provider\n  const linkStatuses: SkillIntegrityResult['linkStatuses'] = [];\n\n  for (const provider of providers) {\n    const targetDirs = resolveProviderSkillsDirs(provider, scope, projectDir);\n    for (const skillsDir of targetDirs) {\n      if (!skillsDir) continue;\n\n      const linkPath = join(skillsDir, skillName);\n      const exists = existsSync(linkPath);\n      let isSymlink = false;\n      let pointsToCanonical = false;\n\n      if (exists) {\n        try {\n          const stat = lstatSync(linkPath);\n          isSymlink = stat.isSymbolicLink();\n          if (isSymlink) {\n            const target = resolve(readlinkSync(linkPath));\n            pointsToCanonical = target === resolve(canonicalPath);\n          }\n        } catch {\n          // Can't stat — treat as broken\n        }\n      }\n\n      linkStatuses.push({\n        providerId: provider.id,\n        linkPath,\n        exists,\n        isSymlink,\n        pointsToCanonical,\n      });\n    }\n  }\n\n  // Determine overall status\n  if (!canonicalExists) {\n    return {\n      name: skillName,\n      status: 'missing-canonical',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `Canonical directory missing: ${canonicalPath}`,\n    };\n  }\n\n  const brokenLinks = linkStatuses.filter((l) => !l.exists);\n  const tamperedLinks = linkStatuses.filter((l) => l.exists && !l.pointsToCanonical);\n\n  if (tamperedLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'tampered',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${tamperedLinks.length} link(s) do not point to canonical path`,\n    };\n  }\n\n  if (brokenLinks.length > 0) {\n    return {\n      name: skillName,\n      status: 'broken-symlink',\n      canonicalExists,\n      canonicalPath,\n      linkStatuses,\n      isCaampOwned,\n      issue: `${brokenLinks.length} symlink(s) missing`,\n    };\n  }\n\n  return {\n    name: skillName,\n    status: 'intact',\n    canonicalExists,\n    canonicalPath,\n    linkStatuses,\n    isCaampOwned,\n  };\n}\n\n/**\n * Check integrity of all tracked skills.\n *\n * @remarks\n * Iterates over every skill in the lock file and runs\n * {@link checkSkillIntegrity} on each.\n *\n * @param providers - Providers to check symlinks for\n * @param scope - Whether to check global or project links\n * @param projectDir - Project directory (for project scope)\n * @returns Map of skill name to integrity result\n *\n * @example\n * ```typescript\n * const results = await checkAllSkillIntegrity(providers);\n * for (const [name, result] of results) {\n *   console.log(`${name}: ${result.status}`);\n * }\n * ```\n *\n * @public\n */\nexport async function checkAllSkillIntegrity(\n  providers: Provider[],\n  scope: 'global' | 'project' = 'global',\n  projectDir?: string,\n): Promise<Map<string, SkillIntegrityResult>> {\n  const lock = await readLockFile();\n  const results = new Map<string, SkillIntegrityResult>();\n\n  for (const skillName of Object.keys(lock.skills)) {\n    const result = await checkSkillIntegrity(skillName, providers, scope, projectDir);\n    results.set(skillName, result);\n  }\n\n  return results;\n}\n\n/**\n * Resolve a skill name conflict where a user-installed skill collides\n * with a CAAMP-owned (ct-*) skill.\n *\n * @remarks\n * CAAMP-owned skills always win. Returns `true` if the incoming skill\n * should take precedence over the existing installation.\n *\n * @param skillName - Skill name to check\n * @param incomingSource - Source of the incoming skill installation\n * @param existingEntry - Existing lock entry, if any\n * @returns `true` if the incoming installation should proceed\n *\n * @example\n * ```typescript\n * const proceed = shouldOverrideSkill(\"ct-research-agent\", \"library\", existingEntry);\n * if (proceed) {\n *   // Safe to install/override\n * }\n * ```\n *\n * @public\n */\nexport function shouldOverrideSkill(\n  skillName: string,\n  incomingSource: string,\n  existingEntry: LockEntry | undefined,\n): boolean {\n  // No existing entry — always allow\n  if (!existingEntry) return true;\n\n  // For ct-* skills, CAAMP package source always wins\n  if (isCaampOwnedSkill(skillName)) {\n    // If incoming is from CAAMP package (library source), it always wins\n    if (existingEntry.sourceType === 'library') return true;\n    // If existing is from CAAMP but incoming is user, CAAMP wins (block user)\n    return true;\n  }\n\n  // Non-ct-* skills: user always wins\n  return true;\n}\n\n/**\n * Validate instruction file injection status across all providers.\n *\n * @remarks\n * Checks that CAAMP blocks exist and are current in all relevant\n * instruction files (CLAUDE.md, AGENTS.md, GEMINI.md).\n *\n * @param providers - Providers to check\n * @param projectDir - Project directory\n * @param scope - Whether to check global or project files\n * @param expectedContent - Expected CAAMP block content\n * @returns Array of file paths with issues\n *\n * @example\n * ```typescript\n * const issues = await validateInstructionIntegrity(providers, process.cwd(), \"project\");\n * for (const issue of issues) {\n *   console.log(`${issue.providerId}: ${issue.issue} (${issue.file})`);\n * }\n * ```\n *\n * @public\n */\nexport async function validateInstructionIntegrity(\n  providers: Provider[],\n  projectDir: string,\n  scope: 'project' | 'global',\n  expectedContent?: string,\n): Promise<Array<{ file: string; providerId: string; issue: string }>> {\n  const { checkAllInjections } = await import('../instructions/injector.js');\n  const results = await checkAllInjections(providers, projectDir, scope, expectedContent);\n  const issues: Array<{ file: string; providerId: string; issue: string }> = [];\n\n  for (const result of results) {\n    if (result.status === 'missing') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'Instruction file does not exist',\n      });\n    } else if (result.status === 'none') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'No CAAMP injection block found',\n      });\n    } else if (result.status === 'outdated') {\n      issues.push({\n        file: result.file,\n        providerId: result.provider,\n        issue: 'CAAMP injection block is outdated',\n      });\n    }\n  }\n\n  return issues;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,SAAS,aAAa;AAaf,IAAM,wBAA0D,OAAO,OAAO;AAAA,EACnF,aAAa,KAAK,OAAO;AAAA,EACzB,eAAe,KAAK,OAAO;AAAA,EAC3B,WAAW;AACb,CAAC;AAGM,IAAM,6BAAoE,OAAO,OAAO;AAAA,EAC7F,EAAE,IAAI,aAAa,MAAM,qBAAqB,OAAO,QAAQ;AAAA,EAC7D,EAAE,IAAI,uBAAuB,MAAM,wBAAwB,OAAO,QAAQ;AAAA,EAC1E,EAAE,IAAI,kBAAkB,MAAM,0BAA0B,OAAO,QAAQ;AAAA,EACvE,EAAE,IAAI,iBAAiB,MAAM,+BAA+B,OAAO,QAAQ;AAAA,EAC3E,EAAE,IAAI,mBAAmB,MAAM,kCAAkC,OAAO,QAAQ;AAAA,EAChF;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,OAAO;AAAA,EACT;AACF,CAAC;AAED,IAAM,SAAS;AACf,IAAM,OAAO;AAEb,SAAS,YAAY,MAA6B;AAChD,MAAI,CAAC,QAAQ,KAAK,KAAK,MAAM,KAAM,QAAO;AAC1C,MAAI,KAAK,SAAS,IAAI,KAAK,kBAAkB,KAAK,IAAI;AACpD,WAAO;AACT,MAAI,MAAM,WAAW,IAAI,KAAK,aAAa,KAAK,IAAI;AAClD,WAAO;AACT,MAAI,KAAK,MAAM,GAAG,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,GAAG;AAC1E,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAYO,SAAS,0BAA0B,OAAkC;AAC1E,QAAM,YAAY,MAAM,WAAW,GAAG;AACtC,QAAM,WAAW,YAAY,MAAM,MAAM,CAAC,IAAI,OAAO,QAAQ,SAAS,EAAE,EAAE,QAAQ,OAAO,EAAE;AAC3F,QAAM,SAAS,QAAQ,WAAW,GAAG,IACjC,iDACA,YAAY,OAAO;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,SAAS,YAAY,YAAY,cAAc,KAAK,KAAK,OAAO,IAAI,SAAS;AAAA,IACnF;AAAA,EACF;AACF;AAEA,SAAS,aAAa,MAAqC;AACzD,QAAM,WAAqB,CAAC;AAC5B,QAAM,YAAY,YAAY,KAAK,IAAI;AACvC,MAAI,UAAW,UAAS,KAAK,SAAS;AACtC,MAAI,CAAC,OAAO,cAAc,KAAK,IAAI,KAAK,KAAK,OAAO;AAClD,aAAS,KAAK,+CAA+C;AAC/D,MAAI,KAAK,WAAW,UAAa,CAAC,OAAO,KAAK,KAAK,MAAM;AACvD,aAAS,KAAK,2DAA2D;AAC3E,SAAO;AACT;AAiBO,SAAS,wBACd,WACA,QAC2B;AAC3B,QAAM,SAAiC,CAAC;AACxC,QAAM,MAAM,CAAC,MAAoC,SAAiB,YAA0B;AAC1F,WAAO,KAAK,EAAE,MAAM,SAAS,QAAQ,CAAC;AAAA,EACxC;AACA,MAAI,CAAC,UAAU,YAAY,KAAK,KAAK,CAAC,UAAU,QAAQ,KAAK,GAAG;AAC9D,QAAI,qBAAqB,YAAY,4CAA4C;AAAA,EACnF;AACA,MAAI,CAAC,CAAC,YAAY,oBAAoB,SAAS,EAAE,SAAS,UAAU,MAAM,GAAG;AAC3E,QAAI,qBAAqB,UAAU,yCAAyC;AAAA,EAC9E;AACA,MAAI,CAAC,OAAO,cAAc,UAAU,WAAW,KAAK,UAAU,cAAc,GAAG;AAC7E,QAAI,qBAAqB,eAAe,kDAAkD;AAAA,EAC5F;AACA,MAAI,UAAU,kBAAkB,UAAa,CAAC,OAAO,KAAK,UAAU,aAAa,GAAG;AAClF;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,UAAU,WAAW,sBAAsB,UAAU,kBAAkB,QAAW;AACpF;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,QAAQ,oBAAI,IAAiC;AACnD,MAAI,gBAA+B;AACnC,aAAW,QAAQ,UAAU,OAAO;AAClC,eAAW,WAAW,aAAa,IAAI,EAAG,KAAI,qBAAqB,KAAK,MAAM,OAAO;AACrF,QAAI,MAAM,IAAI,KAAK,IAAI,EAAG,KAAI,qBAAqB,KAAK,MAAM,2BAA2B;AACzF,UAAM,IAAI,KAAK,MAAM,IAAI;AACzB,QAAI,kBAAkB,MAAM;AAC1B,YAAM,QAAgB,gBAAgB,KAAK;AAC3C,sBAAgB,OAAO,cAAc,KAAK,KAAK,KAAK,QAAQ,IAAI,QAAQ;AAAA,IAC1E;AAAA,EACF;AACA,MAAI,kBAAkB;AACpB,QAAI,qBAAqB,iBAAiB,sCAAsC;AAClF,QAAM,WAAW,OAAO,gBAAgB,CAAC,GAAG,IAAI,yBAAyB;AACzE,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,OAAQ,KAAI,kBAAkB,MAAM,OAAO,MAAM,MAAM;AAAA,EACnE;AACA,MAAI,CAAC,OAAO,aAAa;AACvB,QAAI,kBAAkB,gBAAgB,wDAAwD;AAChG,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,eAAe,OAAO,aAAa,IAAI,CAAC,gBAAgB;AAC5D,UAAM,UAAU,YAAY,YAAY,IAAI;AAC5C,UAAM,YAAY,IAAI,IAAI,YAAY,EAAE;AACxC,QAAI,IAAI,YAAY,EAAE;AACtB,QACE,CAAC,YAAY,GAAG,KAAK,KACrB,aACA,WACA,CAAC,CAAC,SAAS,MAAM,EAAE,SAAS,YAAY,KAAK,GAC7C;AACA;AAAA,QACE;AAAA,QACA,YAAY;AAAA,QACZ,WAAW;AAAA,MACb;AACA,aAAO,EAAE,IAAI,YAAY,IAAI,cAAc,CAAC,GAAG,WAAW,MAAM;AAAA,IAClE;AACA,UAAM,UAAU,UAAU,MAAM;AAAA,MAAO,CAAC,SACtC,YAAY,UAAU,UAClB,KAAK,SAAS,YAAY,OAC1B,MAAM,YAAY,KAAK,MAAM,YAAY,IAAI;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ;AACX;AAAA,QACE;AAAA,QACA,YAAY;AAAA,QACZ,qBAAqB,YAAY,IAAI;AAAA,MACvC;AACF,eAAW,QAAQ,SAAS;AAC1B,UAAI,KAAK,SAAS,EAAG,KAAI,SAAS,KAAK,MAAM,qBAAqB,YAAY,EAAE,YAAY;AAAA,IAC9F;AACA,WAAO;AAAA,MACL,IAAI,YAAY;AAAA,MAChB,cAAc,QAAQ,IAAI,CAAC,SAAS,KAAK,IAAI;AAAA,MAC7C,WAAW,QAAQ,SAAS,KAAK,QAAQ,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC;AAAA,IACxE;AAAA,EACF,CAAC;AACD,aAAW,WAAW,OAAO,qBAAqB,CAAC,GAAG;AACpD,UAAM,UAAU,YAAY,OAAO;AACnC,QAAI,SAAS;AACX,UAAI,kBAAkB,SAAS,OAAO;AACtC;AAAA,IACF;AACA,eAAW,QAAQ,UAAU,OAAO;AAClC,UAAI,MAAM,YAAY,KAAK,MAAM,OAAO;AACtC,YAAI,aAAa,KAAK,MAAM,2CAA2C,OAAO,GAAG;AAAA,IACrF;AAAA,EACF;AACA,MAAI,iBAA8D;AAClE,aAAW,YAAY,OAAO,iBAAiB,CAAC,GAAG;AACjD,UAAM,WAAW,aAAa,QAAQ;AACtC,eAAW,WAAW,SAAU,KAAI,kBAAkB,SAAS,MAAM,OAAO;AAC5E,UAAM,SAAS,MAAM,IAAI,SAAS,IAAI;AACtC,QAAI,CAAC,OAAQ,KAAI,WAAW,SAAS,MAAM,4CAA4C;AAAA,aAC9E,OAAO,SAAS,SAAS;AAChC,UAAI,YAAY,SAAS,MAAM,0DAA0D;AAC3F,QAAI,SAAS,WAAW,QAAW;AACjC,UAAI,mBAAmB,SAAU,kBAAiB;AAClD,UAAI,SAAS,UAAU,QAAQ,WAAW,SAAS,QAAQ;AACzD,yBAAiB;AACjB;AAAA,UACE;AAAA,UACA,SAAS;AAAA,UACT;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,aAAW,CAAC,OAAO,KAAK,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AAC3D,QAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ;AAC1C,UAAI,kBAAkB,OAAO,4CAA4C;AAAA,EAC7E;AACA,MAAI,UAAU,cAAc,OAAO,QAAQ;AACzC,QAAI,UAAU,eAAe,kDAAkD;AACjF,MAAI,kBAAkB,QAAQ,gBAAgB,OAAO,QAAQ;AAC3D,QAAI,UAAU,iBAAiB,oDAAoD;AACrF,MAAI,UAAU,MAAM,SAAS,OAAO,QAAQ;AAC1C,QAAI,UAAU,aAAa,0DAA0D;AACvF,SAAO;AAAA,IACL,OAAO,OAAO,WAAW;AAAA,IACzB,WAAW,EAAE,GAAG,WAAW,OAAO,UAAU,MAAM,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,EAAE,EAAE;AAAA,IAC/E;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,aAAa;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAYO,SAAS,4BAA4B,OAAiD;AAC3F,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,MAAM,OAAO,CAAC,SAAS,KAAK,KAAK,WAAW,OAAO,CAAC;AACjE,QAAM,eAAe,KAAK;AAAA,IACxB,CAAC,SAAS,KAAK,KAAK,SAAS,OAAO,KAAK,KAAK,KAAK,SAAS,WAAW;AAAA,EACzE;AACA,MAAI,aAAa;AACf,YAAQ;AAAA,MACN,GAAG,aAAa,MAAM;AAAA,IACxB;AACF,QAAM,QAAQ,KAAK;AAAA,IACjB,CAAC,SAAS,KAAK,KAAK,SAAS,KAAK,KAAK,KAAK,SAAS;AAAA,EACvD;AACA,MAAI,MAAM;AACR,YAAQ;AAAA,MACN,GAAG,MAAM,MAAM,+EAA+E,MAAM,CAAC,GAAG,IAAI;AAAA,IAC9G;AACF,SAAO;AACT;;;ACrRA,SAAS,YAAY,WAAW,oBAAoB;AACpD,SAAS,MAAM,eAAe;AAC9B,SAAS,yBAAyB;AAMlC,IAAM,qBAAqB;AA6DpB,SAAS,kBAAkB,WAA4B;AAC5D,SAAO,UAAU,WAAW,kBAAkB;AAChD;AA0BA,eAAsB,oBACpB,WACA,WACA,QAA8B,UAC9B,YAC+B;AAC/B,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,QAAQ,KAAK,OAAO,SAAS;AACnC,QAAM,eAAe,kBAAkB,SAAS;AAGhD,MAAI,CAAC,OAAO;AACV,UAAMA,iBAAgB,KAAK,kBAAkB,GAAG,SAAS;AACzD,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,iBAAiB,WAAWA,cAAa;AAAA,MACzC,eAAe;AAAA,MACf,cAAc,CAAC;AAAA,MACf;AAAA,MACA,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,gBAAgB,MAAM;AAC5B,QAAM,kBAAkB,WAAW,aAAa;AAGhD,QAAM,eAAqD,CAAC;AAE5D,aAAW,YAAY,WAAW;AAChC,UAAM,aAAa,0BAA0B,UAAU,OAAO,UAAU;AACxE,eAAW,aAAa,YAAY;AAClC,UAAI,CAAC,UAAW;AAEhB,YAAM,WAAW,KAAK,WAAW,SAAS;AAC1C,YAAM,SAAS,WAAW,QAAQ;AAClC,UAAI,YAAY;AAChB,UAAI,oBAAoB;AAExB,UAAI,QAAQ;AACV,YAAI;AACF,gBAAM,OAAO,UAAU,QAAQ;AAC/B,sBAAY,KAAK,eAAe;AAChC,cAAI,WAAW;AACb,kBAAM,SAAS,QAAQ,aAAa,QAAQ,CAAC;AAC7C,gCAAoB,WAAW,QAAQ,aAAa;AAAA,UACtD;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAEA,mBAAa,KAAK;AAAA,QAChB,YAAY,SAAS;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAGA,MAAI,CAAC,iBAAiB;AACpB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,gCAAgC,aAAa;AAAA,IACtD;AAAA,EACF;AAEA,QAAM,cAAc,aAAa,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM;AACxD,QAAM,gBAAgB,aAAa,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,iBAAiB;AAEjF,MAAI,cAAc,SAAS,GAAG;AAC5B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,cAAc,MAAM;AAAA,IAChC;AAAA,EACF;AAEA,MAAI,YAAY,SAAS,GAAG;AAC1B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,OAAO,GAAG,YAAY,MAAM;AAAA,IAC9B;AAAA,EACF;AAEA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAwBA,eAAsB,uBACpB,WACA,QAA8B,UAC9B,YAC4C;AAC5C,QAAM,OAAO,MAAM,aAAa;AAChC,QAAM,UAAU,oBAAI,IAAkC;AAEtD,aAAW,aAAa,OAAO,KAAK,KAAK,MAAM,GAAG;AAChD,UAAM,SAAS,MAAM,oBAAoB,WAAW,WAAW,OAAO,UAAU;AAChF,YAAQ,IAAI,WAAW,MAAM;AAAA,EAC/B;AAEA,SAAO;AACT;AAyBO,SAAS,oBACd,WACA,gBACA,eACS;AAET,MAAI,CAAC,cAAe,QAAO;AAG3B,MAAI,kBAAkB,SAAS,GAAG;AAEhC,QAAI,cAAc,eAAe,UAAW,QAAO;AAEnD,WAAO;AAAA,EACT;AAGA,SAAO;AACT;AAyBA,eAAsB,6BACpB,WACA,YACA,OACA,iBACqE;AACrE,QAAM,EAAE,oBAAAC,oBAAmB,IAAI,MAAM,OAAO,wBAA6B;AACzE,QAAM,UAAU,MAAMA,oBAAmB,WAAW,YAAY,OAAO,eAAe;AACtF,QAAM,SAAqE,CAAC;AAE5E,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,WAAW;AAC/B,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,QAAQ;AACnC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH,WAAW,OAAO,WAAW,YAAY;AACvC,aAAO,KAAK;AAAA,QACV,MAAM,OAAO;AAAA,QACb,YAAY,OAAO;AAAA,QACnB,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;","names":["canonicalPath","checkAllInjections"]}

package/dist/{injector-X5FN7WMR.js → injector-ZUPRC2HS.js}

@@ -12,8 +12,9 @@ import {
   parseCaampBlocks,
   removeInjection,
   repairInstructionFiles,
+  resolveGlobalInstructionPath,
   writeAgentFileToAllProviders
-} from "./chunk-G3CEXEW2.js";
+} from "./chunk-CHPNPLOK.js";
 import "./chunk-HDZYZTR2.js";
 export {
   checkAllInjections,
@@ -29,6 +30,7 @@ export {
   parseCaampBlocks,
   removeInjection,
   repairInstructionFiles,
+  resolveGlobalInstructionPath,
   writeAgentFileToAllProviders
 };
-//# sourceMappingURL=injector-X5FN7WMR.js.map
+//# sourceMappingURL=injector-ZUPRC2HS.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cleocode/caamp",
-  "version": "2026.9.17",
+  "version": "2026.9.19",
   "description": "Central AI Agent Managed Packages - unified provider registry and package manager for AI coding agents",
   "type": "module",
   "bin": {
@@ -50,14 +50,14 @@
     "jsonc-parser": "^3.3.1",
     "picocolors": "^1.1.1",
     "simple-git": "3.33.0",
-    "@cleocode/contracts": "2026.9.17",
-    "@cleocode/core": "2026.9.17",
-    "@cleocode/cant": "2026.9.17",
-    "@cleocode/paths": "2026.9.17",
-    "@cleocode/lafs": "2026.9.17"
+    "@cleocode/contracts": "2026.9.19",
+    "@cleocode/cant": "2026.9.19",
+    "@cleocode/core": "2026.9.19",
+    "@cleocode/paths": "2026.9.19",
+    "@cleocode/lafs": "2026.9.19"
   },
   "peerDependencies": {
-    "@cleocode/core": "2026.9.17"
+    "@cleocode/core": "2026.9.19"
   },
   "peerDependenciesMeta": {
     "@cleocode/core": {