@ev-ai/agent-hook 1.3.1 → 1.3.2

package/dist/managed-hooks-snippet.mjs

@@ -1,3 +1,1104 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+var __commonJS = (cb, mod) => function __require2() {
+  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+
+// ../composition-identity/dist/mcp-launch-identity.js
+var require_mcp_launch_identity = __commonJS({
+  "../composition-identity/dist/mcp-launch-identity.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.MCP_MISSING_LAUNCH_SERIALIZED = exports.MCP_LAUNCH_IDENTITY_ALGORITHM = void 0;
+    exports.foldMcpName = foldMcpName;
+    exports.buildMcpFamilyCanonicalKey = buildMcpFamilyCanonicalKey;
+    exports.launchContainsCredentials = launchContainsCredentials;
+    exports.serializeMcpLaunchIdentity = serializeMcpLaunchIdentity;
+    exports.hashMcpLaunchIdentity = hashMcpLaunchIdentity;
+    exports.projectMcpMissingLaunchIdentity = projectMcpMissingLaunchIdentity;
+    exports.projectMcpLaunchIdentity = projectMcpLaunchIdentity;
+    exports.maskMcpLaunchForDisplay = maskMcpLaunchForDisplay;
+    exports.normalizeMcpToolNames = normalizeMcpToolNames;
+    var node_crypto_1 = __require("node:crypto");
+    exports.MCP_LAUNCH_IDENTITY_ALGORITHM = "mcp-launch-v1";
+    exports.MCP_MISSING_LAUNCH_SERIALIZED = `${exports.MCP_LAUNCH_IDENTITY_ALGORITHM}|missing`;
+    function foldCase(value) {
+      return value.toLocaleLowerCase("en-US");
+    }
+    function foldMcpName(nativeName) {
+      return foldCase(nativeName);
+    }
+    function buildMcpFamilyCanonicalKey(nativeName) {
+      return `interface:${foldMcpName(nativeName)}`;
+    }
+    var CREDENTIAL_QUERY_KEYS = /* @__PURE__ */ new Set([
+      "access_token",
+      "api_key",
+      "apikey",
+      "auth",
+      "authorization",
+      "key",
+      "password",
+      "secret",
+      "token"
+    ]);
+    var LITERAL_TOKEN_ARGUMENT = /^(?:--?(?:token|api[-_]?key|password|secret|authorization)(?:=|\s+)|(?:sk-|ghp_|xox[baprs]-|Bearer\s+))/i;
+    function lengthPrefixed(value) {
+      return `${Buffer.byteLength(value, "utf8")}:${value}`;
+    }
+    function launchContainsCredentials(input) {
+      if (input.kind === "url") {
+        return urlContainsCredentials(input.url);
+      }
+      if (input.kind === "command") {
+        return input.arguments.some((argument) => LITERAL_TOKEN_ARGUMENT.test(argument));
+      }
+      return false;
+    }
+    function urlContainsCredentials(rawUrl) {
+      try {
+        const parsed = new URL(rawUrl);
+        if (parsed.username.length > 0 || parsed.password.length > 0) {
+          return true;
+        }
+        for (const key of parsed.searchParams.keys()) {
+          if (CREDENTIAL_QUERY_KEYS.has(foldCase(key))) {
+            return true;
+          }
+        }
+        return false;
+      } catch {
+        const schemeSplit = rawUrl.split("://", 2);
+        const afterScheme = schemeSplit.length === 2 ? schemeSplit[1] : rawUrl;
+        const atIndex = afterScheme.indexOf("@");
+        const slashIndex = afterScheme.indexOf("/");
+        if (atIndex > 0 && (slashIndex === -1 || atIndex < slashIndex)) {
+          return true;
+        }
+        const query = rawUrl.split("?", 2)[1];
+        if (query === void 0) {
+          return false;
+        }
+        return query.split("&").some((pair) => {
+          const key = foldCase(pair.split("=", 1)[0] ?? "");
+          return CREDENTIAL_QUERY_KEYS.has(key);
+        });
+      }
+    }
+    function serializeMcpLaunchIdentity(input) {
+      if (input.kind === "url") {
+        return [
+          exports.MCP_LAUNCH_IDENTITY_ALGORITHM,
+          "url",
+          lengthPrefixed(foldCase(input.url))
+        ].join("|");
+      }
+      if (input.kind === "command") {
+        const foldedArguments = [...input.arguments].map((argument) => foldCase(argument)).sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+        return [
+          exports.MCP_LAUNCH_IDENTITY_ALGORITHM,
+          "command",
+          lengthPrefixed(foldCase(input.command)),
+          String(foldedArguments.length),
+          ...foldedArguments.map(lengthPrefixed)
+        ].join("|");
+      }
+      return [
+        exports.MCP_LAUNCH_IDENTITY_ALGORITHM,
+        "unknown",
+        lengthPrefixed(input.installationRootExternalKey),
+        lengthPrefixed(input.sourcePath),
+        lengthPrefixed(input.nativeKey)
+      ].join("|");
+    }
+    function hashMcpLaunchIdentity(serialized) {
+      return (0, node_crypto_1.createHash)("sha256").update(serialized).digest("hex");
+    }
+    var MCP_MISSING_LAUNCH_CONTENT_HASH = hashMcpLaunchIdentity(exports.MCP_MISSING_LAUNCH_SERIALIZED);
+    function projectMcpMissingLaunchIdentity() {
+      return {
+        kind: "unknown",
+        arguments: [],
+        serialized: exports.MCP_MISSING_LAUNCH_SERIALIZED,
+        contentHash: MCP_MISSING_LAUNCH_CONTENT_HASH
+      };
+    }
+    function projectMcpLaunchIdentity(input) {
+      const serialized = serializeMcpLaunchIdentity(input);
+      if (input.kind === "url") {
+        return {
+          kind: "url",
+          url: foldCase(input.url),
+          arguments: [],
+          serialized,
+          contentHash: hashMcpLaunchIdentity(serialized)
+        };
+      }
+      if (input.kind === "command") {
+        return {
+          kind: "command",
+          command: foldCase(input.command),
+          arguments: [...input.arguments].map((argument) => foldCase(argument)).sort((left, right) => left < right ? -1 : left > right ? 1 : 0),
+          serialized,
+          contentHash: hashMcpLaunchIdentity(serialized)
+        };
+      }
+      return {
+        kind: "unknown",
+        arguments: [],
+        serialized,
+        contentHash: hashMcpLaunchIdentity(serialized)
+      };
+    }
+    var CREDENTIAL_DISPLAY = /^(https?:\/\/)([^/?#]*@)/i;
+    function maskMcpLaunchForDisplay(value) {
+      return value.replace(CREDENTIAL_DISPLAY, "$1***@").replace(/([?&](?:access_token|api_key|apikey|auth|authorization|key|password|secret|token)=)([^&]*)/gi, "$1***");
+    }
+    function normalizeMcpToolNames(names) {
+      const seen = /* @__PURE__ */ new Set();
+      const unique = [];
+      for (const name of names) {
+        if (name.length === 0 || seen.has(name)) {
+          continue;
+        }
+        seen.add(name);
+        unique.push(name);
+      }
+      unique.sort((left, right) => left < right ? -1 : left > right ? 1 : 0);
+      return unique;
+    }
+  }
+});
+
+// ../composition-identity/dist/npx-package.js
+var require_npx_package = __commonJS({
+  "../composition-identity/dist/npx-package.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.PACKAGE_FIELD_MAX = void 0;
+    exports.npxExecBin = npxExecBin;
+    exports.packageNameFromSpec = packageNameFromSpec;
+    exports.pinnedPackageVersionFromSpec = pinnedPackageVersionFromSpec;
+    exports.pinnedPackageVersionFromNpx = pinnedPackageVersionFromNpx;
+    exports.npxPackageSpecs = npxPackageSpecs;
+    exports.PACKAGE_FIELD_MAX = 128;
+    var PACKAGE_NAME_RE = /^(?:@[A-Za-z0-9~-][A-Za-z0-9._~-]*\/)?[A-Za-z0-9~-][A-Za-z0-9._~-]*$/;
+    var PACKAGE_FLAGS = /* @__PURE__ */ new Set(["-p", "--package"]);
+    var CALL_FLAGS = /* @__PURE__ */ new Set(["-c", "--call"]);
+    var VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "--registry",
+      "--userconfig",
+      "--globalconfig",
+      "--prefix",
+      "--cache",
+      "--node-options",
+      "--workspace",
+      "-w",
+      "--loglevel"
+    ]);
+    var BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+      "-y",
+      "--yes",
+      "-n",
+      "--no",
+      "-q",
+      "-s",
+      "--quiet",
+      "--silent",
+      "--offline",
+      "--prefer-offline",
+      "--prefer-online",
+      "--ignore-existing",
+      "--ignore-scripts",
+      "--legacy-peer-deps",
+      "--foreground-scripts"
+    ]);
+    var NEGATED_FLAG_RE = /^--no-/;
+    function booleanFlag(flag) {
+      return BOOLEAN_FLAGS.has(flag) || NEGATED_FLAG_RE.test(flag);
+    }
+    function npxExecBin(command) {
+      const base = command.replace(/\\/g, "/").split("/").pop() ?? "";
+      const bare = base.replace(/\.(cmd|exe|bat|ps1)$/i, "").toLowerCase();
+      if (bare === "npx") {
+        return "npx";
+      }
+      return bare === "npm" ? "npm" : null;
+    }
+    var EXACT_SEMVER_RE = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+    function packageNameFromSpec(spec) {
+      if (spec.length === 0 || spec.length > exports.PACKAGE_FIELD_MAX) {
+        return null;
+      }
+      const at = spec.lastIndexOf("@");
+      const name = at > 0 ? spec.slice(0, at) : spec;
+      return PACKAGE_NAME_RE.test(name) ? name : null;
+    }
+    function pinnedPackageVersionFromSpec(spec) {
+      const name = packageNameFromSpec(spec);
+      if (name === null || !spec.startsWith(`${name}@`)) {
+        return void 0;
+      }
+      const selector = spec.slice(name.length + 1);
+      return EXACT_SEMVER_RE.test(selector) ? selector : void 0;
+    }
+    function pinnedPackageVersionFromNpx(command, args) {
+      for (const spec of npxPackageSpecs(command, args)) {
+        const pinned = pinnedPackageVersionFromSpec(spec);
+        if (pinned !== void 0) {
+          return pinned;
+        }
+      }
+      return void 0;
+    }
+    function npxPackageSpecs(command, args) {
+      const bin = npxExecBin(command);
+      if (bin === null) {
+        return [];
+      }
+      let rest = [...args];
+      if (bin === "npm") {
+        const sub = rest[0]?.toLowerCase();
+        if (sub !== "exec" && sub !== "x") {
+          return [];
+        }
+        rest = rest.slice(1);
+      }
+      const explicit = [];
+      let firstPositional = null;
+      for (let i = 0; i < rest.length; i += 1) {
+        const token = rest[i] ?? "";
+        if (token === "--") {
+          firstPositional = rest[i + 1] ?? null;
+          break;
+        }
+        if (!token.startsWith("-")) {
+          firstPositional = token;
+          break;
+        }
+        const eq = token.indexOf("=");
+        const flag = eq === -1 ? token : token.slice(0, eq);
+        if (CALL_FLAGS.has(flag)) {
+          return [];
+        }
+        if (PACKAGE_FLAGS.has(flag)) {
+          const value = eq === -1 ? rest[i + 1] : token.slice(eq + 1);
+          if (value !== void 0 && value.length > 0) {
+            explicit.push(value);
+          }
+          if (eq === -1) {
+            i += 1;
+          }
+          continue;
+        }
+        if (eq !== -1 || booleanFlag(flag)) {
+          continue;
+        }
+        if (VALUE_FLAGS.has(flag)) {
+          i += 1;
+          continue;
+        }
+        return [];
+      }
+      if (explicit.length > 0) {
+        return explicit.every((spec) => packageNameFromSpec(spec) !== null) ? explicit : [];
+      }
+      if (firstPositional === null || packageNameFromSpec(firstPositional) === null) {
+        return [];
+      }
+      return [firstPositional];
+    }
+  }
+});
+
+// ../composition-identity/dist/mcp-package-identity.js
+var require_mcp_package_identity = __commonJS({
+  "../composition-identity/dist/mcp-package-identity.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.McpPackageEcosystem = void 0;
+    exports.resolveMcpPackageIdentity = resolveMcpPackageIdentity;
+    var mcp_launch_identity_js_1 = require_mcp_launch_identity();
+    var npx_package_js_1 = require_npx_package();
+    exports.McpPackageEcosystem = {
+      NPM: "npm",
+      PYPI: "pypi"
+    };
+    var NPM_EXACT_VERSION_RE = /^\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?$/;
+    var PYPI_NAME_RE = /^[A-Za-z0-9](?:[A-Za-z0-9._-]*[A-Za-z0-9])?$/;
+    var PYPI_EXACT_VERSION_RE = /^(?:\d+!)?\d+(?:\.\d+)*(?:(?:a|b|rc)\d+)?(?:\.post\d+)?(?:\.dev\d+)?(?:\+[0-9A-Za-z]+(?:[.][0-9A-Za-z]+)*)?$/;
+    function pythonRunnerBin(command) {
+      const base = command.replaceAll("\\", "/").split("/").pop() ?? "";
+      const bare = base.replace(/\.(cmd|exe|bat|ps1)$/i, "").toLowerCase();
+      if (bare === "uvx" || bare === "uv" || bare === "pipx") {
+        return bare;
+      }
+      return null;
+    }
+    var PYTHON_SPEC_FLAGS = /* @__PURE__ */ new Set(["--from", "--spec"]);
+    var PYTHON_VALUE_FLAGS = /* @__PURE__ */ new Set([
+      "--python",
+      "-p",
+      "--with",
+      "--with-editable",
+      "--with-requirements",
+      "--index",
+      "--index-url",
+      "--default-index",
+      "--extra-index-url",
+      "--find-links",
+      "-f",
+      "--constraint",
+      "-c",
+      "--override",
+      "--refresh-package",
+      "--cache-dir",
+      "--directory",
+      "--project",
+      "--config-file",
+      "--color",
+      "--exclude-newer",
+      "--pip-args",
+      "--verbose-pip"
+    ]);
+    var PYTHON_BOOLEAN_FLAGS = /* @__PURE__ */ new Set([
+      "-q",
+      "--quiet",
+      "-v",
+      "--verbose",
+      "-n",
+      "--native-tls",
+      "--offline",
+      "--isolated",
+      "--preview",
+      "--refresh",
+      "--reinstall",
+      "--upgrade",
+      "-U",
+      "--force",
+      "--system",
+      "--system-site-packages",
+      "--path",
+      "--managed-python",
+      "--progress"
+    ]);
+    var NEGATED_FLAG_RE = /^--no-/;
+    function pythonRunnerSpec(command, args) {
+      const bin = pythonRunnerBin(command);
+      if (bin === null) {
+        return null;
+      }
+      let rest = [...args];
+      if (bin === "uv") {
+        if (rest[0]?.toLowerCase() !== "tool" || rest[1]?.toLowerCase() !== "run") {
+          return null;
+        }
+        rest = rest.slice(2);
+      } else if (bin === "pipx") {
+        if (rest[0]?.toLowerCase() !== "run") {
+          return null;
+        }
+        rest = rest.slice(1);
+      }
+      let explicit = null;
+      let firstPositional = null;
+      for (let i = 0; i < rest.length; i += 1) {
+        const token = rest[i] ?? "";
+        if (token === "--") {
+          firstPositional = rest[i + 1] ?? null;
+          break;
+        }
+        if (!token.startsWith("-")) {
+          firstPositional = token;
+          break;
+        }
+        const eq = token.indexOf("=");
+        const flag = eq === -1 ? token : token.slice(0, eq);
+        if (PYTHON_SPEC_FLAGS.has(flag)) {
+          const value = eq === -1 ? rest[i + 1] : token.slice(eq + 1);
+          if (value !== void 0 && value.length > 0) {
+            explicit = value;
+          }
+          if (eq === -1) {
+            i += 1;
+          }
+          continue;
+        }
+        if (eq !== -1 || PYTHON_BOOLEAN_FLAGS.has(flag) || NEGATED_FLAG_RE.test(flag)) {
+          continue;
+        }
+        if (PYTHON_VALUE_FLAGS.has(flag)) {
+          i += 1;
+          continue;
+        }
+        return null;
+      }
+      return explicit ?? firstPositional;
+    }
+    function pypiIdentityFromSpec(spec) {
+      if (spec.length === 0 || spec.length > npx_package_js_1.PACKAGE_FIELD_MAX) {
+        return null;
+      }
+      const separator = spec.includes("==") ? "==" : spec.includes("@") ? "@" : null;
+      if (separator === null) {
+        return null;
+      }
+      const at = spec.indexOf(separator);
+      const name = spec.slice(0, at);
+      const version = spec.slice(at + separator.length);
+      if (!PYPI_NAME_RE.test(name) || !PYPI_EXACT_VERSION_RE.test(version)) {
+        return null;
+      }
+      return { ecosystem: exports.McpPackageEcosystem.PYPI, packageName: name, version };
+    }
+    function npmIdentityFromSpec(spec) {
+      const packageName = (0, npx_package_js_1.packageNameFromSpec)(spec);
+      if (packageName === null || !spec.startsWith(`${packageName}@`)) {
+        return null;
+      }
+      const version = spec.slice(packageName.length + 1);
+      if (!NPM_EXACT_VERSION_RE.test(version)) {
+        return null;
+      }
+      return { ecosystem: exports.McpPackageEcosystem.NPM, packageName, version };
+    }
+    function resolveMcpPackageIdentity(launch) {
+      if (launch?.kind !== "command") {
+        return void 0;
+      }
+      if ((0, mcp_launch_identity_js_1.launchContainsCredentials)(launch)) {
+        return void 0;
+      }
+      for (const spec of (0, npx_package_js_1.npxPackageSpecs)(launch.command, launch.arguments)) {
+        const identity = npmIdentityFromSpec(spec);
+        if (identity !== null) {
+          return identity;
+        }
+      }
+      const pythonSpec = pythonRunnerSpec(launch.command, launch.arguments);
+      if (pythonSpec !== null) {
+        return pypiIdentityFromSpec(pythonSpec) ?? void 0;
+      }
+      return void 0;
+    }
+  }
+});
+
+// ../composition-identity/dist/mcp-provenance.js
+var require_mcp_provenance = __commonJS({
+  "../composition-identity/dist/mcp-provenance.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.EMPTY_NPM_PUBLISHER = void 0;
+    exports.isNpmRegistryPublisher = isNpmRegistryPublisher;
+    exports.displayPublisherName = displayPublisherName;
+    exports.classifyMcpProvenance = classifyMcpProvenance;
+    var mcp_launch_identity_js_1 = require_mcp_launch_identity();
+    var npx_package_js_1 = require_npx_package();
+    exports.EMPTY_NPM_PUBLISHER = "npm:";
+    var NPM_ACCOUNT_PREFIX = "npm:";
+    var NPM_USERNAME_RE = /^[A-Za-z0-9._-]+$/;
+    function isNpmRegistryPublisher(name) {
+      return name.startsWith(NPM_ACCOUNT_PREFIX) && name !== exports.EMPTY_NPM_PUBLISHER && NPM_USERNAME_RE.test(name.slice(NPM_ACCOUNT_PREFIX.length));
+    }
+    function displayPublisherName(name) {
+      if (name == null || name === "" || name === exports.EMPTY_NPM_PUBLISHER) {
+        return void 0;
+      }
+      return name;
+    }
+    function privateIpv4(hostname) {
+      const parts = hostname.split(".").map(Number);
+      if (parts.length !== 4 || parts.some((part) => !Number.isInteger(part) || part < 0 || part > 255)) {
+        return false;
+      }
+      return parts[0] === 0 || parts[0] === 10 || parts[0] === 127 || parts[0] === 169 && parts[1] === 254 || parts[0] === 172 && (parts[1] ?? 0) >= 16 && (parts[1] ?? 0) <= 31 || parts[0] === 192 && parts[1] === 168;
+    }
+    function ipv4MappedAddress(host) {
+      const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(host);
+      if (dotted?.[1]) {
+        return dotted[1];
+      }
+      const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(host);
+      if (!hex) {
+        return void 0;
+      }
+      const high = Number.parseInt(hex[1], 16);
+      const low = Number.parseInt(hex[2], 16);
+      return `${high >> 8 & 255}.${high & 255}.${low >> 8 & 255}.${low & 255}`;
+    }
+    function normalizedHost(hostname) {
+      return hostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+    }
+    function privateHostname(hostname) {
+      const host = normalizedHost(hostname);
+      const mappedIpv4 = ipv4MappedAddress(host);
+      return host === "localhost" || host.endsWith(".localhost") || host === "::1" || host.endsWith(".local") || // A single-label host resolves only through a local suffix search; it is
+      // never a public internet endpoint.
+      !host.includes(".") && !host.includes(":") || privateIpv4(host) || mappedIpv4 !== void 0 && privateIpv4(mappedIpv4) || /^(?:fc|fd)[0-9a-f]{2}:/i.test(host) || /^fe[89ab][0-9a-f]:/i.test(host);
+    }
+    function publisherHost(hostname) {
+      const host = normalizedHost(hostname);
+      if (host.includes(":") || /^[0-9.]+$/.test(host)) {
+        return null;
+      }
+      return host.split(".").filter(Boolean).length < 2 ? null : host;
+    }
+    function publicOrigin(url) {
+      const host = normalizedHost(url.hostname);
+      const hostname = host.includes(":") ? `[${host}]` : host;
+      const port = url.port ? `:${url.port}` : "";
+      return `${url.protocol}//${hostname}${port}`;
+    }
+    function classifyUrl(rawUrl) {
+      const launch = { kind: "url", url: rawUrl };
+      if ((0, mcp_launch_identity_js_1.launchContainsCredentials)(launch)) {
+        return { origin: "UNKNOWN" };
+      }
+      try {
+        const url = new URL(rawUrl);
+        if (!["http:", "https:"].includes(url.protocol) || privateHostname(url.hostname)) {
+          return { origin: "UNKNOWN" };
+        }
+        const publisherName = publisherHost(url.hostname);
+        return {
+          origin: "THIRD_PARTY",
+          ...publisherName === null ? {} : { publisherName },
+          packageSourceUrl: publicOrigin(url)
+        };
+      } catch {
+        return { origin: "UNKNOWN" };
+      }
+    }
+    var MCP_REMOTE_PACKAGE = "mcp-remote";
+    function remoteUrlChild(packageName, args) {
+      if (packageName !== MCP_REMOTE_PACKAGE) {
+        return void 0;
+      }
+      return args.find((arg) => /^https?:\/\//i.test(arg));
+    }
+    function thirdPartyPackage(packageName, publisherName) {
+      return {
+        origin: "THIRD_PARTY",
+        ...publisherName ? { publisherName } : {},
+        packageName,
+        packageKey: packageName
+      };
+    }
+    function classifyRegistryPackage(packageName, args, publisherName) {
+      const childUrl = remoteUrlChild(packageName, args);
+      if (childUrl !== void 0) {
+        return classifyUrl(childUrl);
+      }
+      if (packageName === MCP_REMOTE_PACKAGE) {
+        return { origin: "UNKNOWN" };
+      }
+      return thirdPartyPackage(packageName, publisherName);
+    }
+    function isRepoRelativeCommand(command) {
+      const normalized = command.replaceAll("\\", "/");
+      if (normalized.startsWith("~/") || normalized.startsWith("/") || /^[A-Za-z]:\//.test(normalized)) {
+        return false;
+      }
+      return normalized.startsWith("./") || normalized.startsWith("../") || normalized === "scripts" || normalized.startsWith("scripts/");
+    }
+    function classifyMcpProvenance(input) {
+      const launch = input.launch;
+      if (launch === void 0 || launch.kind === "unknown") {
+        return { origin: "UNKNOWN" };
+      }
+      if ((0, mcp_launch_identity_js_1.launchContainsCredentials)(launch)) {
+        return { origin: "UNKNOWN" };
+      }
+      if (launch.kind === "url") {
+        return classifyUrl(launch.url);
+      }
+      const specs = (0, npx_package_js_1.npxPackageSpecs)(launch.command, launch.arguments);
+      const spec = specs[0];
+      if (spec !== void 0) {
+        const parsedPackageName = (0, npx_package_js_1.packageNameFromSpec)(spec);
+        if (parsedPackageName === null) {
+          return { origin: "UNKNOWN" };
+        }
+        const classified = classifyRegistryPackage(parsedPackageName, launch.arguments, input.publisherName);
+        const hookPackageName = typeof input.packageName === "string" ? (0, npx_package_js_1.packageNameFromSpec)(input.packageName) : null;
+        if (hookPackageName !== null && hookPackageName === parsedPackageName && classified.packageName !== void 0) {
+          return {
+            ...classified,
+            packageName: hookPackageName,
+            packageKey: hookPackageName
+          };
+        }
+        return classified;
+      }
+      if (isRepoRelativeCommand(launch.command)) {
+        return { origin: "INTERNAL" };
+      }
+      return { origin: "UNKNOWN" };
+    }
+  }
+});
+
+// ../composition-identity/dist/mcp-server-name.js
+var require_mcp_server_name = __commonJS({
+  "../composition-identity/dist/mcp-server-name.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.mcpServerToolSegmentForms = mcpServerToolSegmentForms2;
+    exports.mcpServerNameMatchesToolSegment = mcpServerNameMatchesToolSegment2;
+    function mcpServerToolSegmentForms2(name) {
+      return [
+        .../* @__PURE__ */ new Set([
+          name,
+          name.replaceAll(/[^A-Za-z0-9_-]/g, "_"),
+          name.replaceAll(/[^A-Za-z0-9_-]+/g, "_")
+        ])
+      ];
+    }
+    function mcpServerNameMatchesToolSegment2(name, segment) {
+      const lower = segment.toLowerCase();
+      return mcpServerToolSegmentForms2(name).some((form) => form.toLowerCase() === lower);
+    }
+  }
+});
+
+// ../composition-identity/dist/catalog-text.js
+var require_catalog_text = __commonJS({
+  "../composition-identity/dist/catalog-text.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.parseFrontmatterField = exports.parseFrontmatterDescription = exports.usableCatalogText = void 0;
+    var YAML_BLOCK_SCALAR_TOKEN = /^(?:>|\|)[-+]?$/;
+    var YAML_BLOCK_HEADER = /^(?:>|\|)[-+]?(?:\s+(.*))?$/;
+    var usableCatalogText = (value) => {
+      const trimmed = value?.trim() ?? "";
+      if (trimmed.length === 0 || YAML_BLOCK_SCALAR_TOKEN.test(trimmed)) {
+        return void 0;
+      }
+      return trimmed;
+    };
+    exports.usableCatalogText = usableCatalogText;
+    var parseFrontmatterDescription = (content) => (0, exports.parseFrontmatterField)(content, "description");
+    exports.parseFrontmatterDescription = parseFrontmatterDescription;
+    var parseFrontmatterField = (content, field) => {
+      const match = /^---\s*\n([\s\S]*?)\n---/.exec(content);
+      if (!match) {
+        return void 0;
+      }
+      return parseYamlFrontmatterScalar(match[1], field);
+    };
+    exports.parseFrontmatterField = parseFrontmatterField;
+    var stripYamlQuotes = (value) => value.replace(/^["']|["']$/g, "");
+    function parseYamlFrontmatterScalar(block, field) {
+      const lines = block.split("\n");
+      const prefix = `${field}:`;
+      const start = lines.findIndex((line) => line === prefix || line.startsWith(`${prefix} `) || line.startsWith(`${prefix}	`));
+      if (start < 0) {
+        return void 0;
+      }
+      const remainder = (lines[start] ?? "").slice(prefix.length).trim();
+      const header = YAML_BLOCK_HEADER.exec(remainder);
+      if (!header) {
+        const inline = stripYamlQuotes(remainder).trim();
+        return (0, exports.usableCatalogText)(inline);
+      }
+      const indented = [];
+      for (let index = start + 1; index < lines.length; index += 1) {
+        const line = lines[index] ?? "";
+        if (line.trim() === "") {
+          indented.push("");
+          continue;
+        }
+        if (line.length === line.trimStart().length) {
+          break;
+        }
+        indented.push(line);
+      }
+      const blockIndent = indented.reduce((min, line) => line.trim() === "" ? min : Math.min(min, line.length - line.trimStart().length), Number.POSITIVE_INFINITY);
+      const body = [];
+      const sameLine = header[1]?.trim();
+      if (sameLine) {
+        body.push(sameLine);
+      }
+      for (const line of indented) {
+        body.push(line.trim() === "" ? "" : line.slice(blockIndent));
+      }
+      while (body.length > 0 && body[body.length - 1] === "") {
+        body.pop();
+      }
+      const folded = remainder.startsWith(">");
+      const text = folded ? body.join("\n").split(/\n{2,}/).map((paragraph) => paragraph.split("\n").map((line) => line.trim()).filter(Boolean).join(" ")).filter((paragraph) => paragraph.length > 0).join("\n\n") : body.join("\n").trimEnd();
+      return (0, exports.usableCatalogText)(text);
+    }
+  }
+});
+
+// ../composition-identity/dist/skill-source-redaction.js
+var require_skill_source_redaction = __commonJS({
+  "../composition-identity/dist/skill-source-redaction.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.SNAPSHOT_INSPECTION_TEXT_MAX_BYTES = exports.COMPONENT_INSPECTION_TEXT_MAX_BYTES = exports.COMPONENT_SOURCE_REDACTION_PLACEHOLDER = void 0;
+    exports.fitSnapshotInspectionTextBudget = fitSnapshotInspectionTextBudget;
+    exports.capComponentTextBytes = capComponentTextBytes;
+    exports.prepareComponentInspectionText = prepareComponentInspectionText;
+    exports.redactComponentSource = redactComponentSource;
+    exports.componentSourceContainsRedactableSecret = componentSourceContainsRedactableSecret;
+    exports.COMPONENT_SOURCE_REDACTION_PLACEHOLDER = "[REDACTED]";
+    exports.COMPONENT_INSPECTION_TEXT_MAX_BYTES = 256 * 1024;
+    exports.SNAPSHOT_INSPECTION_TEXT_MAX_BYTES = 3 * 1024 * 1024;
+    function fitSnapshotInspectionTextBudget(definitions) {
+      let usedBytes = 0;
+      return definitions.map((definition) => {
+        const flat = definition;
+        const inspectionText = flat.skill?.inspectionText;
+        if (inspectionText === void 0)
+          return definition;
+        const byteLength = Buffer.byteLength(inspectionText, "utf8");
+        if (usedBytes + byteLength <= exports.SNAPSHOT_INSPECTION_TEXT_MAX_BYTES) {
+          usedBytes += byteLength;
+          return definition;
+        }
+        return {
+          ...definition,
+          skill: {
+            ...flat.skill,
+            inspectionText: void 0
+          }
+        };
+      });
+    }
+    function capComponentTextBytes(text, maxBytes) {
+      if (text == null || text.length === 0) {
+        return void 0;
+      }
+      const buf = Buffer.from(text, "utf8");
+      if (buf.byteLength <= maxBytes) {
+        return text;
+      }
+      const decoder = new TextDecoder("utf-8", { fatal: true });
+      for (let end = maxBytes; end > 0; end -= 1) {
+        try {
+          return decoder.decode(buf.subarray(0, end));
+        } catch {
+        }
+      }
+      return void 0;
+    }
+    function prepareComponentInspectionText(text) {
+      if (text == null || text.length === 0) {
+        return void 0;
+      }
+      return capComponentTextBytes(redactComponentSource(text), exports.COMPONENT_INSPECTION_TEXT_MAX_BYTES);
+    }
+    var TOKEN_LITERAL_RES = [
+      // OpenAI-style and generic `sk-` / `sk-proj-` keys.
+      /\bsk-(?:proj-)?[A-Za-z0-9_-]{16,}/g,
+      // GitHub personal access, OAuth, user, server, and refresh tokens.
+      /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{20,}/g,
+      /\bgithub_pat_[A-Za-z0-9_]{20,}/g,
+      // Slack bot / user / app / refresh tokens.
+      /\bxox[baprs]-[A-Za-z0-9-]{10,}/g,
+      // AWS access key ids.
+      /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+      // Google API keys.
+      /\bAIza[0-9A-Za-z_-]{35}\b/g,
+      // JWTs (three base64url segments).
+      /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g
+    ];
+    var BEARER_RE = /\b(Bearer\s+)[A-Za-z0-9._~+/=-]{8,}/gi;
+    var URL_USERINFO_RE = /\b([a-z][a-z0-9+.-]*:\/\/)([^\s/@:]+):([^\s/@]*)@/gi;
+    var URL_CREDENTIAL_PARAM_RE = /([?&](?:access_token|api_key|apikey|auth|authorization|client_secret|key|password|secret|token)=)[^&\s"'<>]+/gi;
+    var PRIVATE_KEY_BEGIN_RE = /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----/;
+    var PRIVATE_KEY_END_RE = /-----END [A-Z0-9 ]*PRIVATE KEY-----/;
+    function redactLine(line) {
+      let redacted = line.replace(URL_USERINFO_RE, (_match, scheme) => `${scheme}${exports.COMPONENT_SOURCE_REDACTION_PLACEHOLDER}:${exports.COMPONENT_SOURCE_REDACTION_PLACEHOLDER}@`);
+      redacted = redacted.replace(URL_CREDENTIAL_PARAM_RE, (_match, prefix) => `${prefix}${exports.COMPONENT_SOURCE_REDACTION_PLACEHOLDER}`);
+      redacted = redacted.replace(BEARER_RE, (_match, prefix) => `${prefix}${exports.COMPONENT_SOURCE_REDACTION_PLACEHOLDER}`);
+      for (const pattern of TOKEN_LITERAL_RES) {
+        redacted = redacted.replace(pattern, exports.COMPONENT_SOURCE_REDACTION_PLACEHOLDER);
+      }
+      return redacted;
+    }
+    function redactComponentSource(text) {
+      if (text.length === 0) {
+        return text;
+      }
+      const lines = text.split("\n");
+      let insidePrivateKey = false;
+      const redacted = lines.map((line) => {
+        if (insidePrivateKey) {
+          if (PRIVATE_KEY_END_RE.test(line)) {
+            insidePrivateKey = false;
+            return line;
+          }
+          return line.trim().length === 0 ? line : exports.COMPONENT_SOURCE_REDACTION_PLACEHOLDER;
+        }
+        if (PRIVATE_KEY_BEGIN_RE.test(line) && !PRIVATE_KEY_END_RE.test(line)) {
+          insidePrivateKey = true;
+          return line;
+        }
+        return redactLine(line);
+      });
+      return redacted.join("\n");
+    }
+    function componentSourceContainsRedactableSecret(text) {
+      return redactComponentSource(text) !== text;
+    }
+  }
+});
+
+// ../composition-identity/dist/index.js
+var require_dist = __commonJS({
+  "../composition-identity/dist/index.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.redactComponentSource = exports.prepareComponentInspectionText = exports.fitSnapshotInspectionTextBudget = exports.componentSourceContainsRedactableSecret = exports.capComponentTextBytes = exports.SNAPSHOT_INSPECTION_TEXT_MAX_BYTES = exports.COMPONENT_SOURCE_REDACTION_PLACEHOLDER = exports.COMPONENT_INSPECTION_TEXT_MAX_BYTES = exports.usableCatalogText = exports.parseFrontmatterField = exports.parseFrontmatterDescription = exports.mcpServerToolSegmentForms = exports.mcpServerNameMatchesToolSegment = exports.isNpmRegistryPublisher = exports.EMPTY_NPM_PUBLISHER = exports.displayPublisherName = exports.classifyMcpProvenance = exports.resolveMcpPackageIdentity = exports.McpPackageEcosystem = exports.pinnedPackageVersionFromSpec = exports.pinnedPackageVersionFromNpx = exports.packageNameFromSpec = exports.npxPackageSpecs = exports.npxExecBin = exports.PACKAGE_FIELD_MAX = exports.serializeMcpLaunchIdentity = exports.projectMcpMissingLaunchIdentity = exports.projectMcpLaunchIdentity = exports.normalizeMcpToolNames = exports.MCP_MISSING_LAUNCH_SERIALIZED = exports.MCP_LAUNCH_IDENTITY_ALGORITHM = exports.maskMcpLaunchForDisplay = exports.launchContainsCredentials = exports.hashMcpLaunchIdentity = exports.foldMcpName = exports.buildMcpFamilyCanonicalKey = exports.ComponentKind = void 0;
+    exports.userConfigRootFromPath = userConfigRootFromPath;
+    exports.installationRootExternalKey = installationRootExternalKey;
+    exports.normalizeRepositoryRelativePath = normalizeRepositoryRelativePath;
+    exports.nativeKeyForSkillPath = nativeKeyForSkillPath;
+    exports.nativeKeyForRulePath = nativeKeyForRulePath2;
+    exports.nativeKeyForCommandPath = nativeKeyForCommandPath2;
+    exports.serializeComponentIdentity = serializeComponentIdentity;
+    exports.buildComponentReference = buildComponentReference;
+    exports.validateComponentReference = validateComponentReference;
+    var node_crypto_1 = __require("node:crypto");
+    var node_path_1 = __require("node:path");
+    var REFERENCE_PREFIX = "cmp1_";
+    var REFERENCE_PATTERN = /^cmp1_[A-Za-z0-9_-]{43}$/;
+    var SKILLS_DIR_MARKERS = ["/skills/", "/skills-cursor/"];
+    var RULE_PATH_RE = /(?:^|\/)\.(?:cursor|claude|codex)\/rules\/(.+)$/i;
+    var COMMAND_PATH_RE = /(?:^|\/)\.(?:cursor|claude|codex)\/(?:commands|prompts)\/(.+)$/i;
+    var USER_CONFIG_ROOTS = [".cursor", ".claude", ".codex"];
+    var USER_CONFIG_ROOT_ALIASES = {
+      ".claude.json": ".claude",
+      ".agents": ".codex"
+    };
+    exports.ComponentKind = {
+      SKILL: "SKILL",
+      INTERFACE: "INTERFACE",
+      RULE: "RULE",
+      COMMAND: "COMMAND"
+    };
+    function userConfigRootFromPath(path) {
+      const segments = path.replaceAll("\\", "/").split("/").filter(Boolean);
+      const knownRoot = segments.find((segment) => USER_CONFIG_ROOTS.includes(segment));
+      if (knownRoot) {
+        return knownRoot;
+      }
+      const aliasedRoot = segments.map((segment) => USER_CONFIG_ROOT_ALIASES[segment]).find((root) => root !== void 0);
+      return aliasedRoot ?? "unknown";
+    }
+    function installationRootExternalKey(installationId, configRoot) {
+      return `runtime-install:${installationId}/${configRoot}`;
+    }
+    function requireValue(value, field2) {
+      if (value.length === 0) {
+        throw new Error(`${field2} is required`);
+      }
+      return value;
+    }
+    function normalizeRepositoryRelativePath(path) {
+      const slashPath = path.replaceAll("\\", "/");
+      if (slashPath.startsWith("/") || /^[A-Za-z]:\//.test(slashPath)) {
+        throw new Error("sourcePath must be repository-relative");
+      }
+      const normalized = node_path_1.posix.normalize(slashPath).replace(/^\.\//, "");
+      if (normalized === "." || normalized === ".." || normalized.startsWith("../")) {
+        throw new Error("sourcePath must be repository-relative");
+      }
+      return requireValue(normalized, "sourcePath");
+    }
+    function nativeKeyForSkillPath(path) {
+      const normalized = path.replaceAll("\\", "/");
+      for (const marker of SKILLS_DIR_MARKERS) {
+        const segment = normalized.split(marker)[1]?.split("/")[0];
+        if (segment && segment.length > 0) {
+          return segment;
+        }
+      }
+      return null;
+    }
+    function nativeKeyUnderLayoutRoot(path, rootPattern, extensionPattern) {
+      const normalized = path.replaceAll("\\", "/");
+      const match = rootPattern.exec(normalized);
+      const rest = match?.[1];
+      if (!rest || rest.split("/").includes("..")) {
+        return null;
+      }
+      const stripped = rest.replace(extensionPattern, "");
+      return stripped.length > 0 ? stripped : null;
+    }
+    function nativeKeyForRulePath2(path) {
+      return nativeKeyUnderLayoutRoot(path, RULE_PATH_RE, /\.(mdc|md|rules)$/i);
+    }
+    function nativeKeyForCommandPath2(path) {
+      return nativeKeyUnderLayoutRoot(path, COMMAND_PATH_RE, /\.(md|mdc|toml)$/i);
+    }
+    function field(value) {
+      return `${Buffer.byteLength(value, "utf8")}:${value}`;
+    }
+    function serializeComponentIdentity(input) {
+      const values = [
+        requireValue(input.installationRootExternalKey, "installationRootExternalKey"),
+        requireValue(input.installableKind, "installableKind"),
+        normalizeRepositoryRelativePath(input.sourcePath),
+        requireValue(input.nativeKey, "nativeKey")
+      ];
+      return Buffer.from(`1|${values.map(field).join("|")}`, "utf8");
+    }
+    function buildComponentReference(input) {
+      const digest = (0, node_crypto_1.createHash)("sha256").update(serializeComponentIdentity(input)).digest("base64url");
+      return `${REFERENCE_PREFIX}${digest}`;
+    }
+    function validateComponentReference(value) {
+      return REFERENCE_PATTERN.test(value);
+    }
+    var mcp_launch_identity_js_1 = require_mcp_launch_identity();
+    Object.defineProperty(exports, "buildMcpFamilyCanonicalKey", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.buildMcpFamilyCanonicalKey;
+    } });
+    Object.defineProperty(exports, "foldMcpName", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.foldMcpName;
+    } });
+    Object.defineProperty(exports, "hashMcpLaunchIdentity", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.hashMcpLaunchIdentity;
+    } });
+    Object.defineProperty(exports, "launchContainsCredentials", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.launchContainsCredentials;
+    } });
+    Object.defineProperty(exports, "maskMcpLaunchForDisplay", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.maskMcpLaunchForDisplay;
+    } });
+    Object.defineProperty(exports, "MCP_LAUNCH_IDENTITY_ALGORITHM", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.MCP_LAUNCH_IDENTITY_ALGORITHM;
+    } });
+    Object.defineProperty(exports, "MCP_MISSING_LAUNCH_SERIALIZED", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.MCP_MISSING_LAUNCH_SERIALIZED;
+    } });
+    Object.defineProperty(exports, "normalizeMcpToolNames", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.normalizeMcpToolNames;
+    } });
+    Object.defineProperty(exports, "projectMcpLaunchIdentity", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.projectMcpLaunchIdentity;
+    } });
+    Object.defineProperty(exports, "projectMcpMissingLaunchIdentity", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.projectMcpMissingLaunchIdentity;
+    } });
+    Object.defineProperty(exports, "serializeMcpLaunchIdentity", { enumerable: true, get: function() {
+      return mcp_launch_identity_js_1.serializeMcpLaunchIdentity;
+    } });
+    var npx_package_js_1 = require_npx_package();
+    Object.defineProperty(exports, "PACKAGE_FIELD_MAX", { enumerable: true, get: function() {
+      return npx_package_js_1.PACKAGE_FIELD_MAX;
+    } });
+    Object.defineProperty(exports, "npxExecBin", { enumerable: true, get: function() {
+      return npx_package_js_1.npxExecBin;
+    } });
+    Object.defineProperty(exports, "npxPackageSpecs", { enumerable: true, get: function() {
+      return npx_package_js_1.npxPackageSpecs;
+    } });
+    Object.defineProperty(exports, "packageNameFromSpec", { enumerable: true, get: function() {
+      return npx_package_js_1.packageNameFromSpec;
+    } });
+    Object.defineProperty(exports, "pinnedPackageVersionFromNpx", { enumerable: true, get: function() {
+      return npx_package_js_1.pinnedPackageVersionFromNpx;
+    } });
+    Object.defineProperty(exports, "pinnedPackageVersionFromSpec", { enumerable: true, get: function() {
+      return npx_package_js_1.pinnedPackageVersionFromSpec;
+    } });
+    var mcp_package_identity_js_1 = require_mcp_package_identity();
+    Object.defineProperty(exports, "McpPackageEcosystem", { enumerable: true, get: function() {
+      return mcp_package_identity_js_1.McpPackageEcosystem;
+    } });
+    Object.defineProperty(exports, "resolveMcpPackageIdentity", { enumerable: true, get: function() {
+      return mcp_package_identity_js_1.resolveMcpPackageIdentity;
+    } });
+    var mcp_provenance_js_1 = require_mcp_provenance();
+    Object.defineProperty(exports, "classifyMcpProvenance", { enumerable: true, get: function() {
+      return mcp_provenance_js_1.classifyMcpProvenance;
+    } });
+    Object.defineProperty(exports, "displayPublisherName", { enumerable: true, get: function() {
+      return mcp_provenance_js_1.displayPublisherName;
+    } });
+    Object.defineProperty(exports, "EMPTY_NPM_PUBLISHER", { enumerable: true, get: function() {
+      return mcp_provenance_js_1.EMPTY_NPM_PUBLISHER;
+    } });
+    Object.defineProperty(exports, "isNpmRegistryPublisher", { enumerable: true, get: function() {
+      return mcp_provenance_js_1.isNpmRegistryPublisher;
+    } });
+    var mcp_server_name_js_1 = require_mcp_server_name();
+    Object.defineProperty(exports, "mcpServerNameMatchesToolSegment", { enumerable: true, get: function() {
+      return mcp_server_name_js_1.mcpServerNameMatchesToolSegment;
+    } });
+    Object.defineProperty(exports, "mcpServerToolSegmentForms", { enumerable: true, get: function() {
+      return mcp_server_name_js_1.mcpServerToolSegmentForms;
+    } });
+    var catalog_text_js_1 = require_catalog_text();
+    Object.defineProperty(exports, "parseFrontmatterDescription", { enumerable: true, get: function() {
+      return catalog_text_js_1.parseFrontmatterDescription;
+    } });
+    Object.defineProperty(exports, "parseFrontmatterField", { enumerable: true, get: function() {
+      return catalog_text_js_1.parseFrontmatterField;
+    } });
+    Object.defineProperty(exports, "usableCatalogText", { enumerable: true, get: function() {
+      return catalog_text_js_1.usableCatalogText;
+    } });
+    var skill_source_redaction_js_1 = require_skill_source_redaction();
+    Object.defineProperty(exports, "COMPONENT_INSPECTION_TEXT_MAX_BYTES", { enumerable: true, get: function() {
+      return skill_source_redaction_js_1.COMPONENT_INSPECTION_TEXT_MAX_BYTES;
+    } });
+    Object.defineProperty(exports, "COMPONENT_SOURCE_REDACTION_PLACEHOLDER", { enumerable: true, get: function() {
+      return skill_source_redaction_js_1.COMPONENT_SOURCE_REDACTION_PLACEHOLDER;
+    } });
+    Object.defineProperty(exports, "SNAPSHOT_INSPECTION_TEXT_MAX_BYTES", { enumerable: true, get: function() {
+      return skill_source_redaction_js_1.SNAPSHOT_INSPECTION_TEXT_MAX_BYTES;
+    } });
+    Object.defineProperty(exports, "capComponentTextBytes", { enumerable: true, get: function() {
+      return skill_source_redaction_js_1.capComponentTextBytes;
+    } });
+    Object.defineProperty(exports, "componentSourceContainsRedactableSecret", { enumerable: true, get: function() {
+      return skill_source_redaction_js_1.componentSourceContainsRedactableSecret;
+    } });
+    Object.defineProperty(exports, "fitSnapshotInspectionTextBudget", { enumerable: true, get: function() {
+      return skill_source_redaction_js_1.fitSnapshotInspectionTextBudget;
+    } });
+    Object.defineProperty(exports, "prepareComponentInspectionText", { enumerable: true, get: function() {
+      return skill_source_redaction_js_1.prepareComponentInspectionText;
+    } });
+    Object.defineProperty(exports, "redactComponentSource", { enumerable: true, get: function() {
+      return skill_source_redaction_js_1.redactComponentSource;
+    } });
+  }
+});
+
 // src/launcher/constants.ts
 var READY_BYTE = Buffer.from([1]);
 var STDIN_BACKLOG_MAX = 1024 * 1024;
@@ -16,6 +1117,196 @@ function buildCollectorUrl(orgToken, baseUrl = DEFAULT_COLLECTOR_BASE_URL) {
   return `${normalizedBase}/${token}/hook`;
 }
 
+// src/collectors/userSpec/layout.ts
+var RUNNER_LAYOUT = {
+  claude: {
+    shared: {
+      skillRoots: [".claude/skills"],
+      dirs: [
+        { dir: ".claude/agents", kind: "SUBAGENT", extensions: [".md"] },
+        { dir: ".claude/commands", kind: "COMMAND", extensions: [".md"] },
+        { dir: ".claude/rules", kind: "RULE", extensions: [".mdc", ".md"] }
+      ],
+      // Claude's memory walk runs to the filesystem root, so a `~/CLAUDE.md`
+      // covering every tree under home is in context and no project anchor
+      // collects it (the parent walk stops before home).
+      memory: [["CLAUDE.md"], ["CLAUDE.local.md"], [".claude/CLAUDE.md"]],
+      // `remote-settings.json` is deliberately absent: it is the cached
+      // server-managed payload, so it belongs to `managed` (which probes and
+      // parses it) rather than to the operator's own settings.
+      settings: [".claude/settings.json", ".claude/settings.local.json", ".claude/hooks.json"]
+    },
+    // The only field where the two scopes name different files rather than one
+    // scope adding to the other: user MCP servers live in `~/.claude.json`,
+    // project ones in a checked-in `.mcp.json` at the tree root.
+    homeOnly: { mcpJson: [".claude.json"], plugins: "claude", managed: "claude" },
+    projectOnly: { mcpJson: [".mcp.json", "mcp.json"] }
+  },
+  cursor: {
+    shared: {
+      skillRoots: [".cursor/skills"],
+      dirs: [
+        { dir: ".cursor/agents", kind: "SUBAGENT", extensions: [".md"] },
+        { dir: ".cursor/commands", kind: "COMMAND", extensions: [".md"] },
+        { dir: ".cursor/rules", kind: "RULE", extensions: [".mdc", ".md"] }
+      ],
+      memory: [["AGENTS.md"]],
+      // Dedicated hooks file plus sandbox / permissions posture. CLI permissions
+      // live in `cli-config.json` at home and `cli.json` at a project anchor —
+      // see the scope deltas; Cursor never reads `cli-config.json` at project
+      // scope.
+      settings: [".cursor/hooks.json", ".cursor/sandbox.json", ".cursor/permissions.json"],
+      mcpJson: [".cursor/mcp.json"]
+    },
+    // `skills-cursor` is the IDE-managed product-internal skills dir and never
+    // appears in a repo; `.cursor/AGENTS.md` is a home-only memory location.
+    homeOnly: {
+      skillRoots: [".cursor/skills-cursor"],
+      memory: [[".cursor/AGENTS.md"]],
+      settings: [".cursor/cli-config.json"],
+      plugins: "cursor",
+      managed: "cursor"
+    },
+    projectOnly: { skillRoots: [".agents/skills"], settings: [".cursor/cli.json"] }
+  },
+  codex: {
+    shared: {
+      skillRoots: [".agents/skills", ".codex/skills"],
+      dirs: [
+        { dir: ".codex/agents", kind: "SUBAGENT", extensions: [".toml", ".md"] },
+        { dir: ".codex/prompts", kind: "COMMAND", extensions: [".md"] },
+        { dir: ".codex/rules", kind: "RULE", extensions: [".md", ".rules"] }
+      ],
+      memory: [["AGENTS.override.md", "AGENTS.md"]],
+      // `managed_config.toml` is deliberately absent: it carries org defaults,
+      // so it is probed by `managed` rather than counted as user settings.
+      settings: [".codex/hooks.json", ".codex/config.toml"],
+      mcpToml: [".codex/config.toml"]
+    },
+    homeOnly: { memory: [[".codex/AGENTS.override.md", ".codex/AGENTS.md"]], managed: "codex" }
+  }
+};
+function concatOptional(shared, delta) {
+  if (!shared && !delta) {
+    return void 0;
+  }
+  return [...shared ?? [], ...delta ?? []];
+}
+function layoutForScope(runner, delta = {}) {
+  const { shared } = runner;
+  return {
+    skillRoots: [...shared.skillRoots, ...delta.skillRoots ?? []],
+    dirs: shared.dirs,
+    memory: [...shared.memory, ...delta.memory ?? []],
+    settings: [...shared.settings, ...delta.settings ?? []],
+    mcpJson: concatOptional(shared.mcpJson, delta.mcpJson),
+    mcpToml: concatOptional(shared.mcpToml, delta.mcpToml),
+    plugins: delta.plugins ?? shared.plugins,
+    managed: delta.managed ?? shared.managed
+  };
+}
+function layoutsForScope(scope) {
+  return Object.fromEntries(
+    Object.entries(RUNNER_LAYOUT).map(([runner, entry]) => [
+      runner,
+      layoutForScope(entry, entry[scope])
+    ])
+  );
+}
+var PLATFORM_USER_LAYOUT = layoutsForScope("homeOnly");
+var PLATFORM_PROJECT_LAYOUT = layoutsForScope("projectOnly");
+function uniqueRels(rels) {
+  return [...new Set(rels)];
+}
+function userScopePathsFromLayouts(layouts) {
+  const skills = [];
+  const subagents = [];
+  const commands = [];
+  const rules = [];
+  const memory = [];
+  const settings = [];
+  const mcp = [];
+  for (const layout of layouts) {
+    skills.push(...layout.skillRoots);
+    for (const entry of layout.dirs) {
+      if (entry.kind === "SUBAGENT") {
+        subagents.push(entry.dir);
+      } else if (entry.kind === "COMMAND") {
+        commands.push(entry.dir);
+      } else {
+        rules.push(entry.dir);
+      }
+    }
+    memory.push(...layout.memory.flat());
+    settings.push(...layout.settings);
+    mcp.push(...layout.mcpJson ?? [], ...layout.mcpToml ?? []);
+  }
+  return {
+    skills: uniqueRels(skills),
+    subagents: uniqueRels(subagents),
+    commands: uniqueRels(commands),
+    rules: uniqueRels(rules),
+    memory: uniqueRels(memory),
+    settings: uniqueRels(settings),
+    mcp: uniqueRels(mcp)
+  };
+}
+var USER_SCOPE_PATHS = userScopePathsFromLayouts(
+  Object.values(PLATFORM_USER_LAYOUT)
+);
+
+// src/extract/layout-resolve.ts
+function uniqueOrderedRoots(preferred, available) {
+  const remaining = new Set(available);
+  const ordered = [];
+  for (const root of preferred) {
+    if (remaining.delete(root)) {
+      ordered.push(root);
+    }
+  }
+  for (const root of [...remaining].sort()) {
+    ordered.push(root);
+  }
+  return ordered;
+}
+
+// src/extract/skill-extract.ts
+var PROJECT_SKILL_ROOT_ORDER = [".cursor/skills", ".claude/skills", ".agents/skills"];
+var USER_SKILL_ROOT_ORDER = [
+  ".cursor/skills",
+  ".cursor/skills-cursor",
+  ".claude/skills",
+  ".agents/skills"
+];
+var PROJECT_SKILL_ROOTS = uniqueOrderedRoots(
+  PROJECT_SKILL_ROOT_ORDER,
+  userScopePathsFromLayouts(Object.values(PLATFORM_PROJECT_LAYOUT)).skills
+);
+var USER_SKILL_ROOTS = uniqueOrderedRoots(
+  USER_SKILL_ROOT_ORDER,
+  userScopePathsFromLayouts(Object.values(PLATFORM_USER_LAYOUT)).skills
+);
+
+// src/extract/rule-extract.ts
+var import_composition_identity = __toESM(require_dist(), 1);
+var RULE_LAYOUT_ROOTS = userScopePathsFromLayouts(Object.values(PLATFORM_PROJECT_LAYOUT)).rules;
+
+// src/extract/command-extract.ts
+var import_composition_identity2 = __toESM(require_dist(), 1);
+var COMMAND_LAYOUT_ROOTS = userScopePathsFromLayouts(
+  Object.values(PLATFORM_PROJECT_LAYOUT)
+).commands;
+
+// src/hook/runner.ts
+var import_composition_identity3 = __toESM(require_dist(), 1);
+function isInProcessEvent(runnerEvent, platform) {
+  const lower = runnerEvent.toLowerCase();
+  if (lower === "sessionend" || lower === "stopfailure" || lower === "subagentstop") {
+    return true;
+  }
+  return lower === "stop" && platform === "codex";
+}
+
 // src/shared/constants.ts
 var HOOK_BINARY_NAME = "ev-ai-agent-hook";
 var HOOK_CHECKSUMS_FILE = "SHA256SUMS";
@@ -25,10 +1316,15 @@ var HOOK_INPUT_ALLOWLIST_MAX_BYTES = 4 * 1024;
 var HOOK_INPUT_FULL_MAX_BYTES = 256 * 1024;
 var HOOK_INPUT_MCP_MAX_BYTES = 4 * 1024;
 var GZIP_MIN_BYTES = 32 * 1024;
-var PACKAGE_VERSION = "1.3.1";
+var PACKAGE_VERSION = "1.3.2";
 var NPX_PACKAGE_SPEC = `@ev-ai/agent-hook@${PACKAGE_VERSION}`;
 var HOOK_STATUS_MESSAGE = "ev-ai runtime report";
 
+// src/config/hook-config.ts
+var HOOK_CONFIG_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+var HOOK_CONFIG_FETCHED_AT_BUMP_MS = 24 * 60 * 60 * 1e3;
+var HOOK_CONFIG_FILE_MAX_BYTES = 1024 * 1024;
+
 // src/install/install.ts
 function isSessionStartEvent(eventName) {
   return eventName === "SessionStart" || eventName === "sessionStart";
@@ -148,12 +1444,30 @@ var PLUGIN_PAYLOAD_FILES = [
 ];
 
 // src/install/managed-hooks-snippet.ts
+var CLAUDE_MANAGED_HOOK_TIMEOUT_SECONDS = 5;
+var CLAUDE_MANAGED_SESSION_START_TIMEOUT_SECONDS = 10;
+function withClaudeManagedHookLimits(doc) {
+  const hooks = {};
+  for (const [eventName, groups] of Object.entries(doc.hooks)) {
+    const timeout = isSessionStartEvent(eventName) ? CLAUDE_MANAGED_SESSION_START_TIMEOUT_SECONDS : CLAUDE_MANAGED_HOOK_TIMEOUT_SECONDS;
+    const limits = isInProcessEvent(eventName, "claude") ? { timeout } : { timeout, async: true };
+    hooks[eventName] = groups.map(
+      (group) => ({
+        ...group,
+        hooks: (group.hooks ?? []).map((entry) => ({ ...entry, ...limits }))
+      })
+    );
+  }
+  return { hooks };
+}
 function managedHooksSnippet(runner, collectorUrl) {
   const command = withUrlFlag(withRunnerFlag(npxHookCommand(), runner), collectorUrl);
-  const doc = runner === "cursor" ? { version: 1, ...buildCursorPluginHooks(command) } : runner === "claude" ? buildClaudePluginHooks(command) : buildCodexPluginHooks(command);
+  const doc = runner === "cursor" ? { version: 1, ...buildCursorPluginHooks(command) } : runner === "claude" ? withClaudeManagedHookLimits(buildClaudePluginHooks(command)) : buildCodexPluginHooks(command);
   return JSON.stringify(doc, null, 2);
 }
 export {
+  CLAUDE_MANAGED_HOOK_TIMEOUT_SECONDS,
+  CLAUDE_MANAGED_SESSION_START_TIMEOUT_SECONDS,
   buildCollectorUrl,
   managedHooksSnippet
 };