@cleocode/core 2026.3.42 → 2026.3.43

package/dist/roadmap/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Roadmap generation core module.
+ * @task T4538
+ * @epic T4454
+ */
+import type { DataAccessor } from '../store/data-accessor.js';
+/** Get roadmap from pending epics and CHANGELOG history. */
+export declare function getRoadmap(opts: {
+    includeHistory?: boolean;
+    upcomingOnly?: boolean;
+    cwd?: string;
+}, accessor?: DataAccessor): Promise<Record<string, unknown>>;
+//# sourceMappingURL=index.d.ts.map

package/dist/roadmap/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/roadmap/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAG9D,4DAA4D;AAC5D,wBAAsB,UAAU,CAC9B,IAAI,EAAE;IACJ,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,EACD,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAsDlC"}

package/dist/routing/capability-matrix.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Capability Matrix (Core)
+ *
+ * Defines which operations can run natively in TypeScript vs requiring
+ * the CLEO CLI (bash). Used by dual-mode routing to determine execution path.
+ *
+ * Each operation is tagged as:
+ * - native: Runs in TypeScript, works cross-platform (no bash needed)
+ * - cli: Requires CLEO CLI subprocess (Unix-only)
+ * - hybrid: Can run either way (prefers CLI when available)
+ *
+ * Canonical location: src/core/routing/capability-matrix.ts
+ * Re-exported from: src/dispatch/lib/capability-matrix.ts (backward compat)
+ *
+ * @task T5706
+ */
+/**
+ * Execution mode for an operation
+ */
+export type ExecutionMode = 'native' | 'cli' | 'hybrid';
+/**
+ * Gateway type
+ */
+export type GatewayType = 'query' | 'mutate';
+/**
+ * Single operation capability entry
+ */
+/**
+ * Preferred communication channel for token efficiency.
+ * Added for provider-agnostic skill routing (@task T5240).
+ */
+export type PreferredChannel = 'mcp' | 'cli' | 'either';
+export interface OperationCapability {
+    domain: string;
+    operation: string;
+    gateway: GatewayType;
+    mode: ExecutionMode;
+    preferredChannel?: PreferredChannel;
+}
+/**
+ * Capability report returned by system.doctor
+ */
+export interface CapabilityReport {
+    totalOperations: number;
+    native: number;
+    cli: number;
+    hybrid: number;
+    domains: Record<string, {
+        native: string[];
+        cli: string[];
+        hybrid: string[];
+    }>;
+}
+/**
+ * Lookup the execution mode for a specific operation
+ */
+export declare function getOperationMode(domain: string, operation: string, gateway: GatewayType): ExecutionMode | undefined;
+/**
+ * Check if an operation can run natively (without CLI)
+ */
+export declare function canRunNatively(domain: string, operation: string, gateway: GatewayType): boolean;
+/**
+ * Check if an operation requires CLI
+ */
+export declare function requiresCLI(domain: string, operation: string, gateway: GatewayType): boolean;
+/**
+ * Get all native-capable operations for a domain
+ */
+export declare function getNativeOperations(domain: string): OperationCapability[];
+/**
+ * Generate a capability report for system.doctor
+ */
+export declare function generateCapabilityReport(): CapabilityReport;
+/**
+ * Get the full capability matrix (for testing/introspection)
+ */
+export declare function getCapabilityMatrix(): ReadonlyArray<OperationCapability>;
+//# sourceMappingURL=capability-matrix.d.ts.map

package/dist/routing/capability-matrix.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"capability-matrix.d.ts","sourceRoot":"","sources":["../../src/routing/capability-matrix.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH;;GAEG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAC;AAExD;;GAEG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,QAAQ,CAAC;AAE7C;;GAEG;AACH;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,KAAK,GAAG,QAAQ,CAAC;AAExD,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,IAAI,EAAE,aAAa,CAAC;IACpB,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;CACrC;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CACb,MAAM,EACN;QACE,MAAM,EAAE,MAAM,EAAE,CAAC;QACjB,GAAG,EAAE,MAAM,EAAE,CAAC;QACd,MAAM,EAAE,MAAM,EAAE,CAAC;KAClB,CACF,CAAC;CACH;AAmQD;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,WAAW,GACnB,aAAa,GAAG,SAAS,CAK3B;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAG/F;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,GAAG,OAAO,CAG5F;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,mBAAmB,EAAE,CAIzE;AAED;;GAEG;AACH,wBAAgB,wBAAwB,IAAI,gBAAgB,CAkB3D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,aAAa,CAAC,mBAAmB,CAAC,CAExE"}

package/dist/routing/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Routing core module — barrel export.
+ *
+ * Re-exports capability matrix and routing utilities from the core layer.
+ *
+ * @task T5706
+ */
+export type { CapabilityReport, ExecutionMode, GatewayType, OperationCapability, PreferredChannel, } from './capability-matrix.js';
+export { canRunNatively, generateCapabilityReport, getCapabilityMatrix, getNativeOperations, getOperationMode, requiresCLI, } from './capability-matrix.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/routing/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/routing/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,YAAY,EACV,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,cAAc,EACd,wBAAwB,EACxB,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,WAAW,GACZ,MAAM,wBAAwB,CAAC"}

package/dist/scaffold.d.ts

@@ -0,0 +1,215 @@
+/**
+ * Directory & file scaffolding utilities.
+ *
+ * Shared ensure/check functions extracted from init.ts for reuse
+ * by init.ts, upgrade.ts, and doctor health checks.
+ *
+ * Rules:
+ *   - All ensure functions are idempotent (safe to call multiple times)
+ *   - All check functions are read-only (no side effects)
+ *   - Uses imports from ./paths.js for path resolution
+ */
+/** Result of an ensure* scaffolding operation. */
+export interface ScaffoldResult {
+    action: 'created' | 'repaired' | 'skipped';
+    path: string;
+    details?: string;
+}
+/** Status of a check* diagnostic. */
+export type CheckStatus = 'passed' | 'failed' | 'warning' | 'info';
+/** Result of a check* diagnostic (compatible with doctor/checks.ts CheckResult). */
+export interface CheckResult {
+    id: string;
+    category: string;
+    status: CheckStatus;
+    message: string;
+    details: Record<string, unknown>;
+    fix: string | null;
+}
+/** Required subdirectories under .cleo/. */
+export declare const REQUIRED_CLEO_SUBDIRS: readonly ["backups/operational", "backups/safety", "agent-outputs", "logs", "rcasd", "adrs"];
+/** Embedded fallback for .cleo/.gitignore content (deny-by-default). */
+export declare const CLEO_GITIGNORE_FALLBACK = "# .cleo/.gitignore \u2014 Deny-by-default for CLEO project data\n# Ignore everything, then explicitly allow only tracked files.\n\n# Step 1: Ignore everything\n*\n\n# Allow list\n!.gitignore\n!config.json\n!project-context.json\n!project-info.json\n!setup-otel.sh\n!DATA-SAFETY-IMPLEMENTATION-SUMMARY.md\n!adrs/\n!adrs/**\n!rcasd/\n!rcasd/**\n!agent-outputs/\n!agent-outputs/**\n\n# Explicit deny safety net\n*.db\n*.db-shm\n*.db-wal\n*.db-journal\nlog.json\nbypass-log.json\nqa-log.json\n.deps-cache/\n.context-alert-state.json\n.context-state*.json\ncontext-states/\n.git-checkpoint-state\n.migration-state.json\nmigrations.json\nsync/\nmetrics/\n.backups/\nbackups/\n";
+/**
+ * Check if a file exists and is readable.
+ */
+export declare function fileExists(path: string): Promise<boolean>;
+/**
+ * Strip legacy <!-- CLEO:START -->...<!-- CLEO:END --> blocks from a file.
+ * Called before CAAMP injection to prevent competing blocks.
+ */
+export declare function stripCLEOBlocks(filePath: string): Promise<void>;
+/**
+ * Remove .cleo/ or .cleo entries from the project root .gitignore.
+ */
+export declare function removeCleoFromRootGitignore(projectRoot: string): Promise<{
+    removed: boolean;
+}>;
+export { generateProjectHash } from './nexus/hash.js';
+/**
+ * Resolve the package root directory (where schemas/ and templates/ live).
+ * scaffold.ts lives in packages/core/src/, so 1 level up reaches the package root.
+ */
+export declare function getPackageRoot(): string;
+/**
+ * Load the gitignore template from the package's templates/ directory.
+ * Falls back to embedded content if file not found.
+ */
+export declare function getGitignoreContent(): string;
+/**
+ * Read CLEO version from package.json.
+ */
+export declare function getCleoVersion(): string;
+export declare function createDefaultConfig(): Record<string, unknown>;
+/**
+ * Create .cleo/ directory and all required subdirectories.
+ * Idempotent: skips directories that already exist.
+ */
+export declare function ensureCleoStructure(projectRoot: string): Promise<ScaffoldResult>;
+/**
+ * Create or repair .cleo/.gitignore from template.
+ * Idempotent: skips if file already exists with correct content.
+ */
+export declare function ensureGitignore(projectRoot: string): Promise<ScaffoldResult>;
+/**
+ * Create default config.json if missing.
+ * Idempotent: skips if file already exists.
+ */
+export declare function ensureConfig(projectRoot: string, opts?: {
+    force?: boolean;
+}): Promise<ScaffoldResult>;
+/**
+ * Create or refresh project-info.json.
+ * Idempotent: skips if file already exists (unless force).
+ */
+export declare function ensureProjectInfo(projectRoot: string, opts?: {
+    force?: boolean;
+}): Promise<ScaffoldResult>;
+/**
+ * Ensure .mcp.json contains a cleo-dev server entry pointing to the local build.
+ * Only runs when isCleoContributorProject() is true (ADR-029).
+ *
+ * Writes the server entry:
+ *   cleo-dev → node <projectRoot>/dist/mcp/index.js
+ *
+ * This ensures Claude Code loads the LOCAL dev build MCP server for this project,
+ * not the published @cleocode/cleo@latest. Idempotent: preserves other entries.
+ */
+export declare function ensureContributorMcp(projectRoot: string): Promise<ScaffoldResult>;
+/**
+ * Detect and write project-context.json.
+ * Idempotent: skips if file exists and is less than staleDays old (default: 30).
+ */
+export declare function ensureProjectContext(projectRoot: string, opts?: {
+    force?: boolean;
+    staleDays?: number;
+}): Promise<ScaffoldResult>;
+/**
+ * Initialize isolated .cleo/.git checkpoint repository.
+ * Idempotent: skips if .cleo/.git already exists.
+ */
+export declare function ensureCleoGitRepo(projectRoot: string): Promise<ScaffoldResult>;
+/**
+ * Create SQLite database if missing.
+ * Idempotent: skips if tasks.db already exists.
+ */
+export declare function ensureSqliteDb(projectRoot: string): Promise<ScaffoldResult>;
+/**
+ * Verify all required .cleo/ subdirectories exist.
+ */
+export declare function checkCleoStructure(projectRoot: string): CheckResult;
+/**
+ * Verify .cleo/.gitignore exists and matches template.
+ */
+export declare function checkGitignore(projectRoot: string): CheckResult;
+/**
+ * Verify config.json exists and is valid JSON.
+ */
+export declare function checkConfig(projectRoot: string): CheckResult;
+/**
+ * Verify project-info.json exists with required fields.
+ */
+export declare function checkProjectInfo(projectRoot: string): CheckResult;
+/**
+ * Verify project-context.json exists and is not stale (default: 30 days).
+ */
+export declare function checkProjectContext(projectRoot: string, staleDays?: number): CheckResult;
+/**
+ * Verify .cleo/.git checkpoint repository exists.
+ */
+export declare function checkCleoGitRepo(projectRoot: string): CheckResult;
+/**
+ * Verify .cleo/tasks.db exists and is non-empty.
+ */
+export declare function checkSqliteDb(projectRoot: string): CheckResult;
+/**
+ * Create brain.db if missing.
+ * Idempotent: skips if brain.db already exists.
+ */
+export declare function ensureBrainDb(projectRoot: string): Promise<ScaffoldResult>;
+/**
+ * Verify .cleo/brain.db exists and is non-empty.
+ */
+export declare function checkBrainDb(projectRoot: string): CheckResult;
+/**
+ * Verify .cleo/memory-bridge.md exists.
+ * Warning level if missing (not failure) — it is auto-generated.
+ */
+export declare function checkMemoryBridge(projectRoot: string): CheckResult;
+/**
+ * Required subdirectories under the global ~/.cleo/ home.
+ * These are infrastructure directories managed by CLEO itself,
+ * not project-specific data.
+ */
+export declare const REQUIRED_GLOBAL_SUBDIRS: readonly ["schemas", "templates"];
+/**
+ * Ensure the global ~/.cleo/ home directory and its required
+ * subdirectories exist. Idempotent: skips directories that already exist.
+ *
+ * This is the SSoT for global home scaffolding, replacing raw mkdirSync
+ * calls that were previously scattered across global-bootstrap.ts.
+ */
+export declare function ensureGlobalHome(): Promise<ScaffoldResult>;
+/**
+ * Ensure the global CLEO injection template is installed.
+ * Delegates to injection.ts for the template content, but owns the
+ * filesystem write to maintain SSoT for scaffolding.
+ *
+ * Idempotent: skips if the template already exists with correct content.
+ */
+export declare function ensureGlobalTemplates(): Promise<ScaffoldResult>;
+/**
+ * Perform a complete global scaffold operation: ensure home, schemas,
+ * and templates are all present and current. This is the single entry
+ * point for global infrastructure scaffolding.
+ *
+ * Used by:
+ *   - MCP startup (via startupHealthCheck in health.ts)
+ *   - init (for first-time global setup)
+ *   - upgrade (for global repair)
+ */
+export declare function ensureGlobalScaffold(): Promise<{
+    home: ScaffoldResult;
+    schemas: {
+        installed: number;
+        updated: number;
+        total: number;
+    };
+    templates: ScaffoldResult;
+}>;
+/**
+ * Check that the global ~/.cleo/ home and its required subdirectories exist.
+ * Read-only: no side effects.
+ */
+export declare function checkGlobalHome(): CheckResult;
+/**
+ * Check that the global injection template is present and current.
+ * Read-only: no side effects.
+ */
+export declare function checkGlobalTemplates(): CheckResult;
+/**
+ * Check that the project log directory exists.
+ * Read-only: no side effects.
+ */
+export declare function checkLogDir(projectRoot: string): CheckResult;
+//# sourceMappingURL=scaffold.d.ts.map

package/dist/scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../src/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAiBH,kDAAkD;AAClD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,SAAS,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qCAAqC;AACrC,MAAM,MAAM,WAAW,GAAG,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;AAEnE,oFAAoF;AACpF,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAID,4CAA4C;AAC5C,eAAO,MAAM,qBAAqB,8FAOxB,CAAC;AAEX,wEAAwE;AACxE,eAAO,MAAM,uBAAuB,mqBAuCnC,CAAC;AAIF;;GAEG;AACH,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAO/D;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKrE;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAgB/B;AAGD,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAGvC;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,MAAM,CAW5C;AAED;;GAEG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAQvC;AAyBD,wBAAgB,mBAAmB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAyB7D;AAID;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA4BtF;AAED;;;GAGG;AACH,wBAAsB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAiBlF;AAED;;;GAGG;AACH,wBAAsB,YAAY,CAChC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,cAAc,CAAC,CAuCzB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,cAAc,CAAC,CA6DzB;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAwDvF;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC7C,OAAO,CAAC,cAAc,CAAC,CA4DzB;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmBpF;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAmBjF;AAID;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAwCnE;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CA8B/D;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAmC5D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAiDjE;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,GAAE,MAAW,GAAG,WAAW,CA8D5F;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAuBjE;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAmC9D;AAED;;;GAGG;AACH,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CA0ChF;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAmC7D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAuBlE;AAID;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,mCAAoC,CAAC;AAEzE;;;;;;GAMG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,cAAc,CAAC,CAiBhE;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,IAAI,OAAO,CAAC,cAAc,CAAC,CAmCrE;AAED;;;;;;;;;GASG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC;IACpD,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC/D,SAAS,EAAE,cAAc,CAAC;CAC3B,CAAC,CASD;AAID;;;GAGG;AACH,wBAAgB,eAAe,IAAI,WAAW,CAmC7C;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,IAAI,WAAW,CAuBlD;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAsB5D"}

package/dist/schema-management.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Centralized schema path resolution and global schema management.
+ *
+ * This module is the SINGLE source of truth for resolving schema file
+ * paths at runtime. Both schema-integrity.ts and schema-validator.ts
+ * should delegate to this module instead of maintaining their own
+ * resolveSchemaPath() implementations.
+ *
+ * Resolution priority:
+ *   1. ~/.cleo/schemas/{name}  (global install via getCleoSchemasDir)
+ *   2. Package schemas/{name}  (bundled fallback via getPackageRoot)
+ */
+export interface SchemaInstallResult {
+    installed: number;
+    updated: number;
+    total: number;
+}
+export interface StalenessReport {
+    stale: string[];
+    current: string[];
+    missing: string[];
+}
+export interface InstalledSchema {
+    name: string;
+    path: string;
+    version: string | null;
+}
+export interface CheckResult {
+    ok: boolean;
+    installed: number;
+    bundled: number;
+    missing: string[];
+    stale: string[];
+}
+/**
+ * Resolve the absolute path to a schema file at runtime.
+ *
+ * Priority:
+ *   1. Global install: ~/.cleo/schemas/{schemaName}
+ *   2. Package bundled: <packageRoot>/schemas/{schemaName}
+ *
+ * @param schemaName - Filename of the schema (e.g. "config.schema.json")
+ * @returns Absolute path to the schema file, or null if not found
+ */
+export declare function resolveSchemaPath(schemaName: string): string | null;
+/**
+ * Read the schema version from a resolved schema file.
+ *
+ * Checks `schemaVersion` (top-level) and `_meta.schemaVersion` (canonical).
+ *
+ * @param schemaName - Filename of the schema (e.g. "config.schema.json")
+ * @returns The version string, or null if not found or unreadable
+ */
+export declare function getSchemaVersion(schemaName: string): string | null;
+/**
+ * Copy ALL bundled schemas from package schemas/ to ~/.cleo/schemas/.
+ *
+ * - Creates the global schemas directory if it doesn't exist.
+ * - Skips files that are already up-to-date (same version).
+ * - Overwrites stale files (version mismatch).
+ *
+ * @param opts - Optional settings (currently unused, reserved for future options)
+ * @returns Summary of installed, updated, and total schemas
+ */
+export declare function ensureGlobalSchemas(_opts?: Record<string, unknown>): SchemaInstallResult;
+/**
+ * Verify that global schemas are installed and not stale.
+ *
+ * @returns Check result with counts and lists of issues
+ */
+export declare function checkGlobalSchemas(): CheckResult;
+/**
+ * Compare global schema versions against bundled package versions.
+ *
+ * @returns Report of stale, current, and missing schemas
+ */
+export declare function checkSchemaStaleness(): StalenessReport;
+/**
+ * List all schemas installed in ~/.cleo/schemas/.
+ *
+ * @returns Array of installed schema details
+ */
+export declare function listInstalledSchemas(): InstalledSchema[];
+/**
+ * Backup and remove deprecated .cleo/schemas/ directory from a project.
+ *
+ * Schemas should live in ~/.cleo/schemas/ (global) not in project directories.
+ * This function creates a backup before removal for safety.
+ *
+ * @param projectRoot - Absolute path to the project root
+ * @returns Whether cleanup was performed
+ */
+export declare function cleanProjectSchemas(projectRoot: string): Promise<{
+    cleaned: boolean;
+}>;
+//# sourceMappingURL=schema-management.d.ts.map

package/dist/schema-management.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-management.d.ts","sourceRoot":"","sources":["../src/schema-management.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAmBH,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAenE;AAMD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAoBlE;AAuCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,mBAAmB,CA2CxF;AAMD;;;;GAIG;AACH,wBAAgB,kBAAkB,IAAI,WAAW,CAmChD;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,eAAe,CA6BtD;AAMD;;;;GAIG;AACH,wBAAgB,oBAAoB,IAAI,eAAe,EAAE,CAmBxD;AAMD;;;;;;;;GAQG;AACH,wBAAsB,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CA8B5F"}

package/dist/security/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Security core module — barrel export.
+ *
+ * Re-exports input sanitization and security utilities from the core layer.
+ *
+ * @task T5706
+ */
+export type { RateLimitConfig, RateLimitResult } from './input-sanitization.js';
+export { ALL_VALID_STATUSES, DEFAULT_RATE_LIMITS, ensureArray, RateLimiter, SecurityError, sanitizeContent, sanitizeParams, sanitizePath, sanitizeTaskId, VALID_DOMAINS, VALID_GATEWAYS, VALID_LIFECYCLE_STAGE_STATUSES, VALID_MANIFEST_STATUSES, VALID_PRIORITIES, validateEnum, } from './input-sanitization.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAChF,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,WAAW,EACX,WAAW,EACX,aAAa,EACb,eAAe,EACf,cAAc,EACd,YAAY,EACZ,cAAc,EACd,aAAa,EACb,cAAc,EACd,8BAA8B,EAC9B,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,GACb,MAAM,yBAAyB,CAAC"}

package/dist/security/input-sanitization.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Security Hardening and Input Sanitization (Core)
+ *
+ * Canonical location for input sanitization and security validation.
+ * Self-contained with no dispatch or MCP dependencies.
+ *
+ * Canonical location: src/core/security/input-sanitization.ts
+ * Re-exported from: src/dispatch/lib/security.ts (backward compat)
+ *
+ * @task T3144
+ * @task T5706
+ * @epic T3125
+ */
+/**
+ * Security validation error thrown when input fails sanitization
+ */
+export declare class SecurityError extends Error {
+    code: string;
+    field?: string | undefined;
+    constructor(message: string, code?: string, field?: string | undefined);
+}
+/**
+ * Sanitize and validate a task ID
+ */
+export declare function sanitizeTaskId(value: unknown): string;
+/**
+ * Sanitize and validate a file path
+ */
+export declare function sanitizePath(path: string, projectRoot: string): string;
+/**
+ * Sanitize content string
+ */
+export declare function sanitizeContent(content: string, maxLength?: number): string;
+/**
+ * Validate that a value is in an allowed enum set
+ */
+export declare function validateEnum(value: string, allowed: string[], fieldName: string): string;
+/**
+ * Known enum values for CLEO domains
+ */
+export declare const VALID_DOMAINS: readonly ["tasks", "session", "orchestrate", "research", "lifecycle", "validate", "release", "system"];
+export declare const VALID_GATEWAYS: readonly ["query", "mutate"];
+export declare const VALID_MANIFEST_STATUSES: readonly ["completed", "partial", "blocked", "archived"];
+export declare const VALID_LIFECYCLE_STAGE_STATUSES: readonly ["not_started", "in_progress", "blocked", "completed", "skipped", "failed"];
+export declare const ALL_VALID_STATUSES: readonly ["pending", "active", "blocked", "done", "cancelled", "archived", "completed", "partial", "blocked", "archived"];
+export declare const VALID_PRIORITIES: readonly ["critical", "high", "medium", "low"];
+/**
+ * Rate limiter configuration
+ */
+export interface RateLimitConfig {
+    maxRequests: number;
+    windowMs: number;
+}
+/**
+ * Rate limit check result
+ */
+export interface RateLimitResult {
+    allowed: boolean;
+    remaining: number;
+    resetMs: number;
+    limit: number;
+}
+/**
+ * Default rate limit configurations per operation type
+ */
+export declare const DEFAULT_RATE_LIMITS: Record<string, RateLimitConfig>;
+/**
+ * In-memory sliding window rate limiter
+ */
+export declare class RateLimiter {
+    private windows;
+    private configs;
+    constructor(configs?: Record<string, RateLimitConfig>);
+    check(key: string): RateLimitResult;
+    record(key: string): void;
+    consume(key: string): RateLimitResult;
+    reset(key?: string): void;
+    getConfig(key: string): RateLimitConfig | undefined;
+    setConfig(key: string, config: RateLimitConfig): void;
+}
+/**
+ * Normalize a value to an array of strings.
+ * Handles MCP clients sending comma-separated strings where arrays are expected.
+ */
+export declare function ensureArray(value: unknown, separator?: string): string[] | undefined;
+/**
+ * Sanitize all params in a request before routing
+ */
+export declare function sanitizeParams(params: Record<string, unknown> | undefined, projectRoot?: string, context?: {
+    domain?: string;
+    operation?: string;
+}): Record<string, unknown> | undefined;
+//# sourceMappingURL=input-sanitization.d.ts.map

package/dist/security/input-sanitization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-sanitization.d.ts","sourceRoot":"","sources":["../../src/security/input-sanitization.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAYH;;GAEG;AACH,qBAAa,aAAc,SAAQ,KAAK;IAG7B,IAAI,EAAE,MAAM;IACZ,KAAK,CAAC,EAAE,MAAM;gBAFrB,OAAO,EAAE,MAAM,EACR,IAAI,GAAE,MAA+B,EACrC,KAAK,CAAC,EAAE,MAAM,YAAA;CAKxB;AAiBD;;GAEG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAoBrD;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CA2CtE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,SAAS,GAAE,MAAmC,GAC7C,MAAM,CAcR;AAED;;GAEG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAgBxF;AAED;;GAEG;AACH,eAAO,MAAM,aAAa,wGAShB,CAAC;AAEX,eAAO,MAAM,cAAc,8BAA+B,CAAC;AAE3D,eAAO,MAAM,uBAAuB,0DAAoB,CAAC;AAEzD,eAAO,MAAM,8BAA8B,sFAA2B,CAAC;AAEvE,eAAO,MAAM,kBAAkB,2HAAoD,CAAC;AAEpF,eAAO,MAAM,gBAAgB,gDAAkB,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,eAAO,MAAM,mBAAmB,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAI/D,CAAC;AAEF;;GAEG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,OAAO,CAAoC;IACnD,OAAO,CAAC,OAAO,CAA2C;gBAE9C,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC;IAOrD,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IA8BnC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAMzB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe;IASrC,KAAK,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI;IAQzB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS;IAInD,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI;CAGtD;AAsBD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,SAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CASjF;AAED;;GAEG;AACH,wBAAgB,cAAc,CAC5B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,EAC3C,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAChD,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAkGrC"}

package/dist/sequence/index.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Task ID sequence management core module.
+ * @task T4538
+ * @epic T4454
+ */
+import { type DataAccessor } from '../store/data-accessor.js';
+/** Show current sequence state. */
+export declare function showSequence(cwd?: string): Promise<Record<string, unknown>>;
+/** Check sequence integrity. */
+export declare function checkSequence(cwd?: string, accessor?: DataAccessor): Promise<Record<string, unknown>>;
+/** Repair result with proper typing. */
+export interface RepairResult {
+    repaired: boolean;
+    message: string;
+    counter: number;
+    oldCounter?: number;
+    newCounter?: number;
+}
+/** Repair sequence if behind. */
+export declare function repairSequence(cwd?: string, accessor?: DataAccessor): Promise<RepairResult>;
+/**
+ * Atomically allocate the next task ID via SQLite.
+ *
+ * Uses BEGIN IMMEDIATE to guarantee no two concurrent callers
+ * receive the same ID, even across processes (WAL mode).
+ *
+ * Falls back to repair+retry if the sequence counter is behind
+ * the actual max task ID (e.g., stale counter from installations
+ * that never incremented it).
+ *
+ * @task T5184
+ */
+export declare function allocateNextTaskId(cwd?: string, retryCount?: number): Promise<string>;
+//# sourceMappingURL=index.d.ts.map

package/dist/sequence/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sequence/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAqJlF,mCAAmC;AACnC,wBAAsB,YAAY,CAAC,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAWjF;AAuBD,gCAAgC;AAChC,wBAAsB,aAAa,CACjC,GAAG,CAAC,EAAE,MAAM,EACZ,QAAQ,CAAC,EAAE,YAAY,GACtB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAwBlC;AAED,wCAAwC;AACxC,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,OAAO,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,iCAAiC;AACjC,wBAAsB,cAAc,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAgDjG;AAKD;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,SAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAyEtF"}

package/dist/sessions/assumptions.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Assumption recording for session audit trail.
+ *
+ * @task T4782
+ * @epic T4654
+ */
+import type { AssumptionRecord } from './types.js';
+export interface RecordAssumptionParams {
+    sessionId?: string;
+    taskId?: string;
+    assumption: string;
+    confidence: 'high' | 'medium' | 'low';
+}
+/**
+ * Record an assumption made during a session.
+ * Appends to .cleo/audit/assumptions.jsonl (creates dir if needed).
+ * Throws if required params are missing or invalid.
+ */
+export declare function recordAssumption(projectRoot: string, params: RecordAssumptionParams): Promise<Omit<AssumptionRecord, 'validatedAt'> & {
+    timestamp: string;
+}>;
+//# sourceMappingURL=assumptions.d.ts.map

package/dist/sessions/assumptions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assumptions.d.ts","sourceRoot":"","sources":["../../src/sessions/assumptions.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAQH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACvC;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACpC,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,IAAI,CAAC,gBAAgB,EAAE,aAAa,CAAC,GAAG;IAAE,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC,CA0CxE"}