@deftai/directive-core 0.91.0 → 0.93.0

package/dist/init-deposit/hygiene.js

@@ -2,7 +2,13 @@
  * Scoped staging + installer-managed allowlist for TS-native init/update (#1453).
  *
  * Mirrors cmd/deft-install/hygiene.go + deposit.go installerManagedMatchers.
- * Refs #1576, #1453, #1430.
+ *
+ * CRITICAL (#1430 / #3030): the allowlist MUST honor the SPEC consumer-path
+ * denylist (`CONSUMER_GUARD_MUST_FIRE`). Consumer-authored PROJECT-DEFINITION
+ * and scope briefs are never installer-managed; if they reappear in
+ * `installerManagedMatchers()`, unit tests and deposit-time assert fail closed.
+ *
+ * Refs #1576, #1453, #1430, #3029, #3030.
  */
 import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync, rmSync } from "node:fs";
@@ -10,21 +16,63 @@ import { readdir, rm, stat } from "node:fs/promises";
 import { dirname, join, relative } from "node:path";
 import { gitPorcelain } from "../story-ready/git.js";
 import { CANONICAL_INSTALL_ROOT } from "./constants.js";
+import { CONSUMER_SKILL_DISCOVERY_INVENTORY } from "./skill-discovery-deposit.js";
+import { hostSkillRelativePath, listSkillDiscoveryHosts } from "./skill-discovery-hosts.js";
+import { slashCommandManagedExactPaths } from "./slash-deposit.js";
 export const CODEQL_CONFIG_REL = ".github/codeql/codeql-config.yml";
 export const CORE_GUARD_WORKFLOW_REL = ".github/workflows/deft-core-guard.yml";
 // The lifecycle dir names are identical across the legacy `vbrief/` tree and the
 // post-#2034 / #2110 `xbrief/` tree, so both allowlist families reuse this list.
 const VBRIEF_LIFECYCLE_DIRS = ["proposed", "pending", "active", "completed", "cancelled"];
+/**
+ * Consumer paths that MUST trip no-mixed-core-and-app when mixed with
+ * `.deft/core/**` (#1430 SPEC). These probe paths must never match
+ * `installerManagedMatchers()` / the deposited guard ERE.
+ *
+ * Legitimate installer scaffolding (xbrief/.deft-version, lifecycle .gitkeep,
+ * schemas/, migration/, xbrief.md) is NOT in this denylist — see #2277.
+ * Init may still *create* PROJECT-DEFINITION (#3013); create ≠ allowlist.
+ *
+ * Refs #3030, #3029, #1430.
+ */
+export const CONSUMER_GUARD_MUST_FIRE = [
+    "xbrief/PROJECT-DEFINITION.xbrief.json",
+    "vbrief/PROJECT-DEFINITION.vbrief.json",
+    // Representative consumer scope briefs (not scaffolding markers).
+    "xbrief/active/example-scope.xbrief.json",
+    "vbrief/active/example-scope.vbrief.json",
+    "xbrief/proposed/example-scope.xbrief.json",
+    "vbrief/pending/example-scope.vbrief.json",
+];
+/** Exact managed multi-host skill pointer paths only (#75 Greptile P1). */
+function multiHostSkillDiscoveryManagedMatchers() {
+    // Exact SKILL.md paths only so consumer-authored siblings under the same
+    // host skills tree stay app-owned (not staged / not guard-exempt).
+    const matchers = [];
+    for (const host of listSkillDiscoveryHosts()) {
+        for (const skill of CONSUMER_SKILL_DISCOVERY_INVENTORY) {
+            matchers.push({ exact: hostSkillRelativePath(host, skill.dir) });
+        }
+    }
+    return matchers;
+}
 /** Single source of truth for installer-managed paths (#1440 / #1576). */
 export function installerManagedMatchers() {
     return [
         { exact: "AGENTS.md" },
         { prefix: ".agents/" },
+        // Multi-host skill discovery thin pointers (#75 residual) — not slash commands (#55).
+        // Exact inventory paths only; never claim the whole host skills tree.
+        ...multiHostSkillDiscoveryManagedMatchers(),
         { prefix: ".githooks/" },
         { exact: ".claude/settings.json" },
         { exact: ".grok/hooks/deft.json" },
         { exact: ".cursor/hooks.json" },
         { exact: ".codex/hooks.json" },
+        // Multi-host slash product files only (#3054 / L8 prefer commit).
+        // Exact paths — not directory prefixes — so consumer custom commands under
+        // the same host dirs stay app-owned for staging + no-mixed-core-and-app.
+        ...slashCommandManagedExactPaths().map((exact) => ({ exact })),
         { exact: ".gitattributes" },
         { exact: ".gitignore" },
         // Installer-deposited Prettier gate exclusion (#2534); must be allowlisted or
@@ -45,9 +93,10 @@ export function installerManagedMatchers() {
         // `deft update` framework-deposit PR trips no-mixed-core-and-app (#2277).
         { exact: "xbrief/.deft-version" },
         { exact: "xbrief/xbrief.md" },
-        // Minimal render-ready seed from init (#3013); operator may later edit identity.
-        { exact: "xbrief/PROJECT-DEFINITION.xbrief.json" },
-        { exact: "vbrief/PROJECT-DEFINITION.vbrief.json" },
+        // CRITICAL (#1430 / #3029 / #3030): do NOT allowlist consumer-authored
+        // PROJECT-DEFINITION (xbrief/ or vbrief/) or consumer scope briefs.
+        // Init may still seed PD (#3013); the seed is app-owned for guard classification
+        // so core+PD mixed PRs fail no-mixed-core-and-app. See CONSUMER_GUARD_MUST_FIRE.
         { prefix: "xbrief/schemas/" },
         { prefix: "xbrief/migration/" },
         ...VBRIEF_LIFECYCLE_DIRS.map((sub) => ({ exact: `xbrief/${sub}/.gitkeep` })),
@@ -61,12 +110,6 @@ function matcherToEre(matcher) {
         return `^${escapeEre(matcher.exact)}$`;
     return `^${escapeEre(matcher.prefix ?? "")}`;
 }
-/** POSIX ERE alternation embedded in the deposited deft-core-guard workflow. */
-export function installerManagedGuardEre() {
-    return installerManagedMatchers()
-        .map((matcher) => matcherToEre(matcher))
-        .join("|");
-}
 function matchesInstallerManaged(path, matchers) {
     for (const matcher of matchers) {
         if (matcher.exact && path === matcher.exact)
@@ -76,9 +119,90 @@ function matchesInstallerManaged(path, matchers) {
     }
     return false;
 }
+/** Consumer scope-brief filenames under lifecycle dirs (not scaffolding). */
+const CONSUMER_SCOPE_BRIEF_EXACT = /^(xbrief|vbrief)\/(proposed|pending|active|completed|cancelled)\/.+\.(x|v)brief\.json$/;
+/** PROJECT-DEFINITION exact paths (xbrief or legacy vbrief). */
+const CONSUMER_PROJECT_DEFINITION_EXACT = /^(xbrief|vbrief)\/PROJECT-DEFINITION\.(x|v)brief\.json$/;
+/**
+ * Prefixes that would exempt entire consumer lifecycle trees or the whole
+ * xbrief/vbrief tree — never installer-managed (#1430).
+ */
+const FORBIDDEN_CONSUMER_PREFIXES = new Set([
+    "xbrief/",
+    "vbrief/",
+    ...VBRIEF_LIFECYCLE_DIRS.flatMap((sub) => [`xbrief/${sub}/`, `vbrief/${sub}/`]),
+]);
+/**
+ * Fail closed when the installer-managed allowlist would exempt consumer
+ * PROJECT-DEFINITION or scope briefs (#3030 / #1430). Pure over `matchers` so
+ * tests can inject a bad matcher without mutating production state.
+ *
+ * Checks both:
+ * 1. Explicit probe paths in {@link CONSUMER_GUARD_MUST_FIRE}
+ * 2. Structural patterns (any exact consumer scope brief / PD; forbidden prefixes)
+ *    so an unlisted `xbrief/active/another-scope.xbrief.json` matcher still fails.
+ */
+export function assertInstallerAllowlistHonors1430(matchers = installerManagedMatchers()) {
+    for (const path of CONSUMER_GUARD_MUST_FIRE) {
+        if (matchesInstallerManaged(path, matchers)) {
+            throw new Error(`#1430 violation: ${path} must not be installer-managed (SPEC consumer denylist; see CONSUMER_GUARD_MUST_FIRE / #3030)`);
+        }
+    }
+    for (const matcher of matchers) {
+        if (matcher.exact) {
+            if (CONSUMER_PROJECT_DEFINITION_EXACT.test(matcher.exact) ||
+                CONSUMER_SCOPE_BRIEF_EXACT.test(matcher.exact)) {
+                throw new Error(`#1430 violation: exact matcher ${matcher.exact} must not be installer-managed (consumer brief denylist / #3030)`);
+            }
+        }
+        if (matcher.prefix) {
+            const normalized = matcher.prefix.endsWith("/") ? matcher.prefix : `${matcher.prefix}/`;
+            if (FORBIDDEN_CONSUMER_PREFIXES.has(normalized)) {
+                throw new Error(`#1430 violation: prefix matcher ${matcher.prefix} must not cover consumer brief trees (#3030)`);
+            }
+        }
+    }
+}
+/** POSIX ERE alternation embedded in the deposited deft-core-guard workflow. */
+export function installerManagedGuardEre() {
+    const matchers = installerManagedMatchers();
+    // Refuse to emit a guard workflow that would exempt consumer denylist paths.
+    assertInstallerAllowlistHonors1430(matchers);
+    return matchers.map((matcher) => matcherToEre(matcher)).join("|");
+}
 export function isInstallerManagedPath(path) {
     return matchesInstallerManaged(path, installerManagedMatchers());
 }
+/**
+ * TS twin of Go `classifyChangedPaths` / deposited shell guard (#1430).
+ * Core = `.deft/core/**`; installer-managed = allowlist; app = everything else.
+ * Guard fails iff both core and app are non-empty.
+ */
+export function classifyMixedCoreAndApp(changedPaths, matchers = installerManagedMatchers()) {
+    const core = [];
+    const installerManaged = [];
+    const app = [];
+    for (const raw of changedPaths) {
+        const path = raw.replace(/\\/g, "/");
+        if (!path)
+            continue;
+        if (path === ".deft/core" || path.startsWith(".deft/core/")) {
+            core.push(path);
+        }
+        else if (matchesInstallerManaged(path, matchers)) {
+            installerManaged.push(path);
+        }
+        else {
+            app.push(path);
+        }
+    }
+    return {
+        core,
+        installerManaged,
+        app,
+        wouldFail: core.length > 0 && app.length > 0,
+    };
+}
 export function frameworkStagePaths(projectDir, deftDir, options = {}) {
     const paths = [];
     const seen = new Set();

package/dist/init-deposit/index.d.ts

@@ -6,5 +6,8 @@ export * from "./legacy-detect.js";
 export * from "./migrate.js";
 export * from "./refresh.js";
 export * from "./scaffold.js";
+export * from "./skill-discovery-deposit.js";
+export * from "./skill-discovery-hosts.js";
+export * from "./slash-deposit.js";
 export * from "./untrack-core.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/init-deposit/index.js

@@ -6,5 +6,8 @@ export * from "./legacy-detect.js";
 export * from "./migrate.js";
 export * from "./refresh.js";
 export * from "./scaffold.js";
+export * from "./skill-discovery-deposit.js";
+export * from "./skill-discovery-hosts.js";
+export * from "./slash-deposit.js";
 export * from "./untrack-core.js";
 //# sourceMappingURL=index.js.map

package/dist/init-deposit/init-deposit.js

@@ -14,6 +14,7 @@ import { prunePythonArtifactsFromDeposit } from "../deposit/python-free.js";
 import { resolveInstalledContentRoot } from "../deposit/resolve-content.js";
 import { readCorePackageVersion } from "../engine-version.js";
 import { renderProjectDefinition } from "../render/project-render.js";
+import { depositOpenClawL2ProductCommands } from "../slash/openclaw-deposit.js";
 import { removeStaleMigratedFrameworkNarrative } from "../xbrief-migrate/migrate-project.js";
 import { writeAgentHookDeposit } from "./agent-hooks.js";
 import { ensureInitGitignoreLines, reconstituteDepositFromContent } from "./gitignore.js";
@@ -22,6 +23,8 @@ import { buildLegacyRefusalJson, buildLegacyRefusalMessage, detectLegacyLayout,
 import { printMigrateNudgeIfNeeded } from "./migrate.js";
 import { ensurePrettierIgnoreLines } from "./prettierignore.js";
 import { CANONICAL_INSTALL_ROOT, depositNeutralization, ensureTaskfile, writeAgentsMd, writeAgentsSkills, writeConsumerGitHooks, writeConsumerVbrief, writeInstallManifest, } from "./scaffold.js";
+import { writeMultiHostSkillDiscovery } from "./skill-discovery-deposit.js";
+import { writeSlashCommandDeposit } from "./slash-deposit.js";
 import { syncBareVersionMarker } from "./xbrief-projections.js";
 export function parseInitArgv(canonicalArgv, userArgv = []) {
     const args = [...canonicalArgv, ...userArgv];
@@ -181,6 +184,7 @@ export async function runInitDeposit(args, io, seams = {}) {
     writeInstallManifest(projectDir, deftDir, manifestFields);
     writeAgentsMd(projectDir, deftDir, io);
     const skillsCreated = writeAgentsSkills(projectDir, io);
+    writeMultiHostSkillDiscovery(projectDir, io);
     await depositNeutralization(projectDir, io);
     await writeConsumerVbrief(projectDir, deftDir, io);
     seedMinimalProjectDefinition(projectDir, io);
@@ -191,6 +195,12 @@ export async function runInitDeposit(args, io, seams = {}) {
     removeStaleMigratedFrameworkNarrative(projectDir);
     writeConsumerGitHooks(projectDir, deftDir, io, seams.gitHooks);
     writeAgentHookDeposit(projectDir, io);
+    writeSlashCommandDeposit(projectDir, io);
+    // #3064: OpenClaw L2 product-command skills when OC signals present (fail-closed otherwise).
+    depositOpenClawL2ProductCommands({
+        projectRoot: projectDir,
+        printf: (t) => io.printf(t),
+    });
     let taskfileWired = false;
     if (args.nonInteractive) {
         taskfileWired = ensureTaskfile(projectDir, io);

package/dist/init-deposit/refresh.js

@@ -21,6 +21,7 @@ import { resolveLifecycleRoot } from "../layout/resolve.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { runOrgForceOnMigration } from "../policy/org-force-on-migration.js";
 import { checkLocalEngineIntegrity, classify, ENGINE_PACKAGE, plan, renderGlobalInstall, resolveEngine, } from "../resolution/index.js";
+import { depositOpenClawL2ProductCommands } from "../slash/openclaw-deposit.js";
 import { gitPorcelain } from "../story-ready/git.js";
 import { removeStaleMigratedFrameworkNarrative } from "../xbrief-migrate/migrate-project.js";
 import { writeAgentHookDeposit } from "./agent-hooks.js";
@@ -31,6 +32,8 @@ import { buildLegacyRefusalJson, buildLegacyRefusalMessage, detectLegacyLayout,
 import { printMigrateNudgeIfNeeded } from "./migrate.js";
 import { ensurePrettierIgnoreLines } from "./prettierignore.js";
 import { CANONICAL_INSTALL_ROOT, depositNeutralization, ensureTaskfile, writeAgentsMd, writeConsumerGitHooks, writeInstallManifest, } from "./scaffold.js";
+import { writeMultiHostSkillDiscovery } from "./skill-discovery-deposit.js";
+import { writeSlashCommandDeposit } from "./slash-deposit.js";
 import { syncBareVersionMarker, syncConsumerXbriefSchemas, syncExistingBareVersionMarker, } from "./xbrief-projections.js";
 function hasCanonicalXbriefLifecycle(projectDir) {
     try {
@@ -464,6 +467,14 @@ export async function runRefreshDeposit(args, io, seams = {}) {
     }
     const agentsMdUpdated = writeAgentsMd(projectDir, deftDir, io);
     writeAgentHookDeposit(projectDir, io);
+    // #75 residual: multi-host thin skill discovery (mirror `.agents/skills` inventory).
+    writeMultiHostSkillDiscovery(projectDir, io);
+    writeSlashCommandDeposit(projectDir, io);
+    // #3064: OpenClaw L2 product-command skills when OC signals present (fail-closed otherwise).
+    depositOpenClawL2ProductCommands({
+        projectRoot: projectDir,
+        printf: (t) => io.printf(t),
+    });
     // #2530: root `.githooks/` is a consumer derivative like #2595 marker/schemas —
     // repair on every refresh, including the already-current no-op path.
     writeConsumerGitHooks(projectDir, deftDir, io, seams.gitHooks);

package/dist/init-deposit/scaffold.js

@@ -14,7 +14,8 @@ import { assertDestinationNotSymlink, ProjectionContainmentError, } from "../fs/
 import { agentsRefreshPlan } from "../platform/agents-md.js";
 import { MIGRATED_ARTIFACT_DIR } from "../xbrief-migrate/constants.js";
 import { CANONICAL_INSTALL_ROOT } from "./constants.js";
-import { installerManagedGuardEre } from "./hygiene.js";
+import { assertInstallerAllowlistHonors1430, installerManagedGuardEre } from "./hygiene.js";
+import { writeAgentsSkillsFromInventory } from "./skill-discovery-deposit.js";
 import { syncConsumerXbriefSchemas } from "./xbrief-projections.js";
 export { CANONICAL_INSTALL_ROOT };
 export const CORE_GLOB = ".deft/core/**";
@@ -90,125 +91,6 @@ const DEFT_INCLUDE_CHILD_BLOCK = "  # Added by deft-install --yes (Epic-4)\n" +
     "  deft:\n" +
     "    taskfile: ./.deft/core/Taskfile.yml\n" +
     "    optional: true\n";
-const AGENTS_SKILLS = [
-    {
-        dir: "deft",
-        content: `---
-name: deft
-description: Apply deft framework standards for AI-assisted development. Use when starting projects, writing code, running tests, making commits, or when the user references deft, project standards, or coding guidelines.
----
-
-Read and follow: .deft/core/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-setup",
-        content: `---
-name: deft-directive-setup
-description: >-
-  Set up a new project with Deft framework standards. Use when the user wants
-  to bootstrap user preferences, configure a project, or generate a project
-  specification. Walks through setup conversationally — no separate CLI needed.
----
-
-Read and follow: .deft/core/skills/deft-directive-setup/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-build",
-        content: `---
-name: deft-directive-build
-description: >-
-  Build a project from scope vBRIEFs following Deft framework standards.
-  Use after deft-directive-setup has generated the project definition, or when
-  the user has scope vBRIEFs ready to implement. Handles scaffolding,
-  implementation, testing, and quality checks phase by phase.
----
-
-Read and follow: .deft/core/skills/deft-directive-build/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-review-cycle",
-        content: `---
-name: deft-directive-review-cycle
-description: >-
-  Greptile bot reviewer response workflow. Use when running a review cycle
-  on a PR — to audit process prerequisites, fetch bot findings, fix all
-  issues in a single batch commit, and exit cleanly when no P0/P1 issues
-  remain. Enables cloud agents to run autonomous PR review cycles.
----
-
-Read and follow: .deft/core/skills/deft-directive-review-cycle/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-refinement",
-        content: `---
-name: deft-directive-refinement
-description: >-
-  Structured refinement workflow. Compares open GitHub issues against
-  the roadmap, triages new issues one-at-a-time with human review, and updates
-  the roadmap with phase placement, analysis comments, and index entries.
----
-
-Read and follow: .deft/core/skills/deft-directive-refinement/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-swarm",
-        content: `---
-name: deft-directive-swarm
-description: >-
-  Parallel local agent orchestration. Use when running multiple agents
-  on roadmap items simultaneously — to select non-overlapping tasks, set up
-  isolated worktrees, launch agents with proven prompts, monitor progress,
-  handle stalled review cycles, and close out PRs cleanly.
----
-
-Read and follow: .deft/core/skills/deft-directive-swarm/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-interview",
-        content: `---
-name: deft-directive-interview
-description: >-
-  Deterministic structured Q&A interview skill. Use when a skill or workflow
-  needs to collect structured answers from the user — one question per turn,
-  numbered options, default acceptance, and a confirmation gate.
----
-
-Read and follow: .deft/core/skills/deft-directive-interview/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-pre-pr",
-        content: `---
-name: deft-directive-pre-pr
-description: >-
-  Iterative pre-PR quality loop (Read-Write-Lint-Diff-Loop). Use before
-  pushing a branch for PR creation — structured self-review that agents run
-  to catch issues before they reach the bot reviewer.
----
-
-Read and follow: .deft/core/skills/deft-directive-pre-pr/SKILL.md
-`,
-    },
-    {
-        dir: "deft-directive-sync",
-        content: `---
-name: deft-directive-sync
-description: >-
-  Session-start framework sync skill. Use at the beginning of a session to
-  pull latest framework updates, validate project files, and confirm alignment
-  before starting work.
----
-
-Read and follow: .deft/core/skills/deft-directive-sync/SKILL.md
-`,
-    },
-];
 const BARE_SEMVER = /^\d+\.\d+\.\d+([-+][0-9A-Za-z.-]+)?$/;
 export function buildInstallManifestText(fields) {
     let effectiveTag = fields.tag;
@@ -376,20 +258,8 @@ export async function writeConsumerVbrief(projectDir, deftDir, io) {
     return true;
 }
 export function writeAgentsSkills(projectDir, io) {
-    projectionTarget(projectDir, ".agents");
-    const allExist = AGENTS_SKILLS.every((skill) => existsSync(join(projectDir, ".agents", "skills", skill.dir, "SKILL.md")));
-    if (allExist) {
-        io.printf(".agents/skills/ already present — skipping.\n");
-        return false;
-    }
-    for (const skill of AGENTS_SKILLS) {
-        const path = projectionTarget(projectDir, ".agents", "skills", skill.dir, "SKILL.md");
-        if (existsSync(path))
-            continue;
-        containedProjectWrite(projectDir, path, skill.content);
-    }
-    io.printf(".agents/skills/ created — deft skills will be auto-discovered.\n");
-    return true;
+    // Shared inventory with multi-host skill discovery (#75 residual).
+    return writeAgentsSkillsFromInventory(projectDir, io);
 }
 function hasTopLevelIncludes(content) {
     if (!content)
@@ -632,6 +502,8 @@ export function mergeCoreGuardWorkflowRefresh(existing, desired) {
     return desired.slice(0, idx) + existingCheckout + desired.slice(idx + desiredCheckout.length);
 }
 function coreGuardWorkflowContent() {
+    // Fail closed before emitting guard ERE if allowlist violates #1430 denylist (#3030).
+    assertInstallerAllowlistHonors1430();
     const baseSha = githubActionsExpr("github.event.pull_request.base.sha");
     const headSha = githubActionsExpr("github.event.pull_request.head.sha");
     return ("name: deft-core-guard\n\n" +

package/dist/init-deposit/skill-discovery-deposit.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Multi-host thin skill discovery deposit (#75 residual).
+ *
+ * Mirrors the consumer skill inventory already written to `.agents/skills/`
+ * into additional host paths (`.claude/skills/`, `.codex/skills/`,
+ * `.github/skills/`, `.cursor/skills/`). Thin pointers only — no full skill
+ * body copies. Windows-safe file writes (no elevated symlink requirement).
+ *
+ * Distinct from epic #55 slash-command deposit (#3054).
+ */
+import type { InitDepositIo } from "./constants.js";
+import { type HostSkillDiscoveryPolicy, type SkillDiscoveryHostId } from "./skill-discovery-hosts.js";
+export type { InitDepositIo };
+/**
+ * Consumer skill discovery inventory shared by `.agents/skills/` and multi-host
+ * deposit. Each entry is a thin SKILL.md pointer into `.deft/core/…` — never a
+ * full skill body. Keep this list the single SoT for install-time discovery.
+ */
+export declare const CONSUMER_SKILL_DISCOVERY_INVENTORY: ReadonlyArray<{
+    dir: string;
+    content: string;
+}>;
+/** Max bytes for a thin pointer body — fat full-skill copies fail this guard. */
+export declare const MAX_THIN_SKILL_POINTER_BYTES = 1200;
+/**
+ * True when content is a thin discovery pointer (not an inlined skill body).
+ * Managed deposit must stay pointer-shaped so updates do not rot full copies.
+ */
+export declare function isThinSkillPointer(content: string): boolean;
+export interface MultiHostSkillDiscoveryDepositResult {
+    readonly changed: boolean;
+    /** Repo-relative posix paths written or rewritten. */
+    readonly changedPaths: string[];
+    /** Hosts that received at least one write. */
+    readonly hostsTouched: SkillDiscoveryHostId[];
+    /** Hosts skipped because `plan.policy.hostSkillDiscovery.<host>` is false. */
+    readonly hostsSkipped: SkillDiscoveryHostId[];
+}
+export interface WriteMultiHostSkillDiscoveryOptions {
+    /** Override policy (tests); default loads from PROJECT-DEFINITION. */
+    policy?: HostSkillDiscoveryPolicy;
+    /**
+     * Skill inventory to deposit. Defaults to the shared consumer inventory
+     * (same set as `.agents/skills/`).
+     */
+    inventory?: ReadonlyArray<{
+        dir: string;
+        content: string;
+    }>;
+}
+/**
+ * Deposit thin skill discovery pointers into enabled multi-host paths.
+ * Idempotent: skips write when on-disk content already matches. Never creates
+ * symlinks (Windows-safe without elevation).
+ */
+export declare function writeMultiHostSkillDiscovery(projectDir: string, io: InitDepositIo, options?: WriteMultiHostSkillDiscoveryOptions): MultiHostSkillDiscoveryDepositResult;
+/**
+ * Shared inventory helper for `.agents/skills/` (canonical) deposit.
+ * Returns true when any pointer was created (matching writeAgentsSkills).
+ */
+export declare function writeAgentsSkillsFromInventory(projectDir: string, io: InitDepositIo, inventory?: ReadonlyArray<{
+    dir: string;
+    content: string;
+}>): boolean;
+//# sourceMappingURL=skill-discovery-deposit.d.ts.map