@moldea.ai/core 7.0.3 → 7.1.0

package/dist/chunks/{core-DC9KYL1H.js → core-CMuQrqRI.js}

@@ -1,6 +1,6 @@
-import { E as parseDecisionIdFromPath, O as trimRepositoryFormatWhitespace, S as isRuntimeGuidancePath, T as isVariableId, a as escapeJsonPointerSegment, c as freezeRecursively, d as hasNonWhitespace, g as isContextPath, i as createCoreDiagnosticCollector, l as compareExactStrings, n as normalizeCoreOptions, o as normalizeDiagnostics, r as countDiagnosticsBySeverity, s as createNullPrototypeRecord, t as createCoreOperationOptionsSnapshot, u as countUnicodeScalars } from "./options-AMqX7rx_.js";
+import { E as parseDecisionIdFromPath, O as trimRepositoryFormatWhitespace, S as isRuntimeGuidancePath, T as isVariableId, a as escapeJsonPointerSegment, c as freezeRecursively, d as hasNonWhitespace, g as isContextPath, i as createCoreDiagnosticCollector, l as compareExactStrings, n as normalizeCoreOptions, o as normalizeDiagnostics, r as countDiagnosticsBySeverity, s as createNullPrototypeRecord, t as createCoreOperationOptionsSnapshot, u as countUnicodeScalars } from "./options-BVF3DQHm.js";
 import { n as CoreOperationException } from "./exceptions-CYf1pCKf.js";
-import { a as createSourceLocator, c as calculateContentDigest, i as parseStrictYaml, l as calculateNormalizedTextDigest, n as inspectManifestDocument, o as collectManifestScopeDeclarations, r as parseManifestDocument, s as matchesRepositoryGlob, t as matchManifestScope, u as normalizeTextDocument } from "./scope-DxhC1hq2.js";
+import { a as createSourceLocator, c as calculateContentDigest, i as parseStrictYaml, l as calculateNormalizedTextDigest, n as inspectManifestDocument, o as collectManifestScopeDeclarations, r as parseManifestDocument, s as matchesRepositoryGlob, t as matchManifestScope, u as normalizeTextDocument } from "./scope-DoNl6LhC.js";
 import { REPOSITORY_ROOT, RepositorySourceException, compareRepositoryPaths, createRepositoryIdentity, isRepositoryPath, parseRepositoryPath } from "@moldea.ai/repository";
 //#region \0rolldown/runtime.js
 var __defProp = Object.defineProperty;
@@ -495,6 +495,12 @@ var reserveRetainedBytesIfTracked = (reader, bytes) => {
 //#endregion
 //#region src/repository-inspection-session/index.ts
 var MANIFEST_PATH$3 = parseRepositoryPath("/moldea/moldea.yaml");
+var INSTRUCTION_PATHS = new Set([
+	"/AGENTS.md",
+	"/CLAUDE.md",
+	"/.claude/CLAUDE.md",
+	"/CLAUDE.local.md"
+].map((path) => parseRepositoryPath(path)));
 var SOURCE_PAGE_ENTRIES = 256;
 var SOURCE_PAGE_BYTES = 65536;
 var CANONICAL_BYTE_RETENTION_MULTIPLIER = 4;
@@ -528,6 +534,41 @@ var copyReaderEntry$1 = (candidate, operation, fallbackPath, expectedPath) => {
 		type: typeCandidate
 	};
 };
+var REFUSED_LINK_STATES = [
+	"broken",
+	"denied",
+	"loop",
+	"unsafe"
+];
+var LINK_TARGET_TYPES = [
+	"directory",
+	"file",
+	"other"
+];
+/** Copies one untrusted link resolution, rejecting any shape outside the closed contract. */
+var copyLinkResolution = (candidate, path) => {
+	if (typeof candidate !== "object" || candidate === null) return invalidSourceData$3("get-entry", path);
+	const record = candidate;
+	const keys = Object.keys(record).sort().join();
+	const refusedState = REFUSED_LINK_STATES.find((state) => state === record["state"]);
+	if (Reflect.ownKeys(record).length !== Object.keys(record).length) return invalidSourceData$3("get-entry", path);
+	if (record["state"] === "not-link" || refusedState !== void 0) return keys === "state" ? { state: refusedState ?? "not-link" } : invalidSourceData$3("get-entry", path);
+	const targetIdentity = record["targetIdentity"];
+	const targetType = LINK_TARGET_TYPES.find((type) => type === record["targetType"]);
+	if (typeof targetIdentity !== "string" || targetIdentity.length === 0 || targetType === void 0) return invalidSourceData$3("get-entry", path);
+	if (record["state"] === "outside" && keys === "state,targetIdentity,targetType") return {
+		state: "outside",
+		targetIdentity,
+		targetType
+	};
+	const targetPath = record["targetPath"];
+	return record["state"] === "inside" && keys === "state,targetIdentity,targetPath,targetType" && typeof targetPath === "string" && isRepositoryPath(targetPath) ? {
+		state: "inside",
+		targetIdentity,
+		targetPath: parseRepositoryPath(targetPath),
+		targetType
+	} : invalidSourceData$3("get-entry", path);
+};
 var isStrictDescendant = (path, prefix) => {
 	if (path === prefix) return false;
 	const descendantPrefix = prefix === REPOSITORY_ROOT ? REPOSITORY_ROOT : `${prefix}/`;
@@ -552,11 +593,12 @@ var createSourceOptions = (sessionSignal, operationSignal) => {
 * @param repository The source-neutral reader bound to one coherent snapshot.
 * @param limits The immutable resource limits for the inspection.
 * @param signal Optional cancellation shared by every inspection operation.
+* @param instructions Optional instruction source read only through the instruction view.
 * @returns A session that pages source metadata and range-reads bounded canonical files.
 * @throws
 * - ABORTED: The Core operation was aborted.
 */
-var createRepositoryInspectionSession = (repository, limits, signal) => {
+var createRepositoryInspectionSession = (repository, limits, signal, instructions) => {
 	const seenPaths = /* @__PURE__ */ new Set();
 	let canonicalBytes = 0;
 	let peakRetainedBytes = 0;
@@ -593,14 +635,19 @@ var createRepositoryInspectionSession = (repository, limits, signal) => {
 		if (byteLength > limits.maxTotalBytesRead - totalBytesRead) return throwResourceLimitExceeded("maxTotalBytesRead", limits.maxTotalBytesRead, totalBytesRead + byteLength);
 		totalBytesRead += byteLength;
 	};
-	const getEntry = async (path, options) => {
+	const repositoryPages = {
+		readPage: (path, options) => repository.readFilePage(path, options),
+		snapshotId: repository.snapshot.id
+	};
+	const getEntryFrom = async (source, path, options) => {
 		const parsedPath = parseRepositoryPath(path);
 		throwIfSignalAborted(options?.signal);
 		registerPath(parsedPath);
-		const candidate = await repository.getEntry(parsedPath, createSourceOptions(signal, options?.signal));
+		const candidate = await source.getEntry(parsedPath, createSourceOptions(signal, options?.signal));
 		throwIfSignalAborted(options?.signal);
 		return candidate === null ? null : copyReaderEntry$1(candidate, "get-entry", parsedPath, parsedPath);
 	};
+	const getEntry = (path, options) => getEntryFrom(repository, path, options);
 	const iterateEntries = (options) => {
 		const prefix = options?.prefix === void 0 ? REPOSITORY_ROOT : parseRepositoryPath(options.prefix);
 		return { async *[Symbol.asyncIterator]() {
@@ -635,20 +682,20 @@ var createRepositoryInspectionSession = (repository, limits, signal) => {
 			} while (true);
 		} };
 	};
-	const loadFile = async (path, operationSignal, isSource = false) => {
+	const loadFile = async (path, operationSignal, isSource = false, pages = repositoryPages) => {
 		const multiplier = isSource ? 1 : CANONICAL_BYTE_RETENTION_MULTIPLIER;
 		const fileLimit = path === MANIFEST_PATH$3 ? "maxManifestBytes" : "maxFileBytes";
 		const availableRetainedBytes = limits.maxRetainedBytes - retainedBytes;
 		if (availableRetainedBytes < 1) return throwResourceLimitExceeded("maxRetainedBytes", limits.maxRetainedBytes, retainedBytes + 1);
 		const firstPageMaximumBytes = Math.min(SOURCE_PAGE_BYTES, Math.max(1, limits[fileLimit]), availableRetainedBytes);
 		observeTransientBytes(firstPageMaximumBytes);
-		const firstPage = await repository.readFilePage(path, {
+		const firstPage = await pages.readPage(path, {
 			maxBytes: firstPageMaximumBytes,
 			offset: 0,
 			...createSourceOptions(signal, operationSignal) ?? {}
 		});
 		throwIfSignalAborted(operationSignal);
-		if (firstPage.snapshot.id !== repository.snapshot.id || firstPage.offset !== 0 || !(firstPage.bytes instanceof Uint8Array) || !Number.isSafeInteger(firstPage.totalBytes) || firstPage.totalBytes < 0 || firstPage.bytes.byteLength > SOURCE_PAGE_BYTES || firstPage.bytes.byteLength > firstPage.totalBytes || firstPage.bytes.byteLength === 0 && !firstPage.isComplete) return invalidSourceData$3("read-file-page", path);
+		if (firstPage.snapshot.id !== pages.snapshotId || firstPage.offset !== 0 || !(firstPage.bytes instanceof Uint8Array) || !Number.isSafeInteger(firstPage.totalBytes) || firstPage.totalBytes < 0 || firstPage.bytes.byteLength > SOURCE_PAGE_BYTES || firstPage.bytes.byteLength > firstPage.totalBytes || firstPage.bytes.byteLength === 0 && !firstPage.isComplete) return invalidSourceData$3("read-file-page", path);
 		if (firstPage.totalBytes > limits[fileLimit]) return throwResourceLimitExceeded(fileLimit, limits[fileLimit], firstPage.totalBytes);
 		const firstPageBytes = firstPage.bytes.byteLength;
 		const retainedBytesAvailableForCanonicalContent = limits.maxRetainedBytes - retainedBytes - firstPageBytes;
@@ -667,7 +714,7 @@ var createRepositoryInspectionSession = (repository, limits, signal) => {
 		let isFirstPage = true;
 		while (isFirstPage || offset < content.byteLength) {
 			isFirstPage = false;
-			if (page.snapshot.id !== repository.snapshot.id || page.offset !== offset || page.totalBytes !== content.byteLength || !(page.bytes instanceof Uint8Array) || page.bytes.byteLength > SOURCE_PAGE_BYTES || page.bytes.byteLength > content.byteLength - offset || page.bytes.byteLength === 0 && !page.isComplete) return invalidSourceData$3("read-file-page", path);
+			if (page.snapshot.id !== pages.snapshotId || page.offset !== offset || page.totalBytes !== content.byteLength || !(page.bytes instanceof Uint8Array) || page.bytes.byteLength > SOURCE_PAGE_BYTES || page.bytes.byteLength > content.byteLength - offset || page.bytes.byteLength === 0 && !page.isComplete) return invalidSourceData$3("read-file-page", path);
 			content.set(page.bytes, offset);
 			offset += page.bytes.byteLength;
 			if (page.isComplete) {
@@ -675,7 +722,7 @@ var createRepositoryInspectionSession = (repository, limits, signal) => {
 				break;
 			}
 			if (page.nextOffset !== offset) return invalidSourceData$3("read-file-page", path);
-			page = await repository.readFilePage(path, {
+			page = await pages.readPage(path, {
 				maxBytes: Math.min(SOURCE_PAGE_BYTES, Math.max(1, content.byteLength - offset)),
 				offset,
 				...createSourceOptions(signal, operationSignal) ?? {}
@@ -718,6 +765,53 @@ var createRepositoryInspectionSession = (repository, limits, signal) => {
 		throwIfSignalAborted(options?.signal);
 		return content.slice();
 	};
+	/** Loads one complete temporary source buffer whose reservation the caller releases. */
+	const readRetainedSource = async (path, pages) => {
+		throwIfSignalAborted();
+		registerPath(path);
+		const bytes = await awaitWithCancellation(loadFile(path, void 0, true, pages));
+		throwIfSignalAborted();
+		let isReleased = false;
+		return {
+			bytes,
+			release: () => {
+				if (!isReleased) retainedBytes -= bytes.byteLength;
+				isReleased = true;
+			}
+		};
+	};
+	const instructionReader = instructions?.reader ?? repository;
+	const instructionPages = instructions === void 0 ? repositoryPages : {
+		readPage: (path, options) => instructions.reader.readFilePage(path, options),
+		snapshotId: instructions.reader.snapshot.id
+	};
+	const linkResolver = instructions?.linkResolver;
+	const linkPages = linkResolver === void 0 ? void 0 : {
+		readPage: (path, options) => linkResolver.readLinkTargetPage(path, options),
+		snapshotId: linkResolver.snapshot.id
+	};
+	const requireInstructionPath = (path) => {
+		const parsedPath = parseRepositoryPath(path);
+		if (!INSTRUCTION_PATHS.has(parsedPath)) throw new TypeError("The instruction view reads only coding-agent instruction paths.");
+		return parsedPath;
+	};
+	const instructionView = Object.freeze({
+		getEntry: (path) => getEntryFrom(instructionReader, requireInstructionPath(path)),
+		readLinkedSourceFile: (path) => {
+			if (linkPages === void 0) throw new TypeError("The instruction view has no link resolver to read through.");
+			return readRetainedSource(requireInstructionPath(path), linkPages);
+		},
+		readSourceFile: (path) => readRetainedSource(requireInstructionPath(path), instructionPages),
+		resolveLink: async (path) => {
+			const parsedPath = requireInstructionPath(path);
+			if (linkResolver === void 0) return null;
+			throwIfSignalAborted();
+			registerPath(parsedPath);
+			const candidate = await awaitWithCancellation(linkResolver.resolveLink(parsedPath, createSourceOptions(signal, void 0)));
+			throwIfSignalAborted();
+			return copyLinkResolution(candidate, parsedPath);
+		}
+	});
 	const reader = Object.freeze({
 		getEntry,
 		iterateEntries,
@@ -734,20 +828,7 @@ var createRepositoryInspectionSession = (repository, limits, signal) => {
 			if (!Number.isSafeInteger(bytes) || bytes < 0 || bytes > retainedBytes) throw new TypeError("The retained-memory release is invalid.");
 			retainedBytes -= bytes;
 		},
-		readSourceFile: async (path) => {
-			throwIfSignalAborted();
-			registerPath(path);
-			const bytes = await awaitWithCancellation(loadFile(path, void 0, true));
-			throwIfSignalAborted();
-			let isReleased = false;
-			return {
-				bytes,
-				release: () => {
-					if (!isReleased) retainedBytes -= bytes.byteLength;
-					isReleased = true;
-				}
-			};
-		}
+		readSourceFile: (path) => readRetainedSource(path, repositoryPages)
 	});
 	return Object.freeze({
 		getResourceUsage: () => Object.freeze({
@@ -756,6 +837,7 @@ var createRepositoryInspectionSession = (repository, limits, signal) => {
 			retainedBytes,
 			totalBytesRead
 		}),
+		instructions: instructionView,
 		reader,
 		throwIfAborted: throwIfSignalAborted
 	});
@@ -1825,8 +1907,8 @@ var validateManifestRelationships = (manifestPath, manifest, discovery, decision
 		const agent = manifest.agents?.[agentId];
 		if (agent === void 0) continue;
 		const escapedAgentId = escapeJsonPointerSegment(agentId);
-		for (const referencedPath of [...agent.context ?? []].sort(compareExactStrings)) validateContextRelationship(referencedPath, `/agents/${escapedAgentId}/context`, validationContext.validAgentContextPaths, validationContext, agentId);
-		for (const referencedPath of [...agent.decisions ?? []].sort(compareExactStrings)) validateDecisionRelationship(referencedPath, `/agents/${escapedAgentId}/decisions`, validationContext, agentId);
+		for (const [index, referencedPath] of (agent.context ?? []).entries()) validateContextRelationship(referencedPath, `/agents/${escapedAgentId}/context/${index}`, validationContext.validAgentContextPaths, validationContext, agentId);
+		for (const [index, referencedPath] of (agent.decisions ?? []).entries()) validateDecisionRelationship(referencedPath, `/agents/${escapedAgentId}/decisions/${index}`, validationContext, agentId);
 	}
 	return collector.finalize();
 };
@@ -1879,11 +1961,34 @@ var parseIntegrationBlock = (text) => {
 		skillPath
 	};
 };
+var ROOT_AGENTS_IMPORTS = /* @__PURE__ */ new Set(["@AGENTS.md", "@./AGENTS.md"]);
+var NESTED_AGENTS_IMPORTS = /* @__PURE__ */ new Set(["@../AGENTS.md"]);
+/**
+* Reports whether Claude Code instruction text imports the root AGENTS.md on a line of its own.
+* Lines inside fenced code blocks and imports embedded in other text do not count.
+* @param text The decoded instruction text.
+* @param isNested Whether the text belongs to `/.claude/CLAUDE.md` rather than a root file.
+* @returns `true` when one unfenced line, trimmed of spaces and tabs, is an AGENTS.md import.
+*/
+var hasAgentsImport = (text, isNested) => {
+	const imports = isNested ? NESTED_AGENTS_IMPORTS : ROOT_AGENTS_IMPORTS;
+	let fence = null;
+	for (const rawLine of text.replace(/^\uFEFF/u, "").split(/\r\n|\n|\r/u)) {
+		const line = rawLine.replace(/^[ \t]+|[ \t]+$/gu, "");
+		const marker = /^(`{3,}|~{3,})/u.exec(line)?.[1];
+		if (fence !== null) {
+			if (marker !== void 0 && marker[0] === fence[0] && marker.length >= fence.length) fence = null;
+		} else if (marker !== void 0) fence = marker;
+		else if (imports.has(line)) return true;
+	}
+	return false;
+};
 //#endregion
-//#region src/integration-validation/inspection.ts
-var AGENTS_PATH = parseRepositoryPath("/AGENTS.md");
+//#region src/integration-validation/utilities.ts
 /**
 * Reads bounded untrusted text with a reservation for decoding and temporary string copies.
+* @param ledger The session ledger that owns the reservation.
+* @param load Loads the complete bounded source buffer.
 * @returns Decoded text or null for invalid UTF-8, with its reservation-release operation.
 * @throws
 * - ENTRY_NOT_FOUND: The requested repository entry was not found.
@@ -1897,8 +2002,8 @@ var AGENTS_PATH = parseRepositoryPath("/AGENTS.md");
 * - SNAPSHOT_CHANGED: The repository snapshot changed during the operation.
 * - INVALID_SOURCE_DATA: The repository source returned invalid data.
 */
-var readText = async (ledger, path) => {
-	const source = await ledger.readSourceFile(path);
+var readRetainedText = async (ledger, load) => {
+	const source = await load();
 	const reservation = source.bytes.byteLength * 8;
 	let isReserved = false;
 	try {
@@ -1924,8 +2029,21 @@ var readText = async (ledger, path) => {
 /** Distinguishes missing and non-regular files without an extra entry lookup or following symlinks. */
 var getAbsentKind = (error) => error instanceof RepositorySourceException ? error.code === "ENTRY_NOT_FOUND" ? "missing" : error.code === "ENTRY_NOT_FILE" ? "non-regular" : null : null;
 /**
-* Checks the root integration against its installed asset with at most two reads and two lookups.
-* @returns Completed content-free integration warnings, never an execution or runtime-wiring claim.
+* Explains why a linked instruction file cannot be read, or returns null for a readable link.
+* @param resolution The resolver's classification, or null when no resolver is available.
+* @returns The content-free link state, or null when the final target is a regular file.
+*/
+var getUnreadableLinkState = (resolution) => {
+	if (resolution === null) return "unavailable";
+	if (resolution.state === "inside" || resolution.state === "outside") return resolution.targetType === "file" ? null : resolution.targetType;
+	return resolution.state;
+};
+//#endregion
+//#region src/integration-validation/agents-inspection.ts
+var AGENTS_PATH$1 = parseRepositoryPath("/AGENTS.md");
+/**
+* Checks one readable AGENTS.md text against its referenced skill installation.
+* @returns A promise that settles after at most one integration warning was recorded.
 * @throws
 * - RESOURCE_LIMIT_EXCEEDED: A Core resource limit was exceeded.
 * - RESOURCE_LIMIT_EXCEEDED: A named repository resource limit was exceeded.
@@ -1936,52 +2054,43 @@ var getAbsentKind = (error) => error instanceof RepositorySourceException ? erro
 * - SNAPSHOT_CHANGED: The repository snapshot changed during the operation.
 * - INVALID_SOURCE_DATA: The repository source returned invalid data.
 */
-var inspectCodingAgentIntegration = async (reader, limits, signal) => {
-	const ledger = getRetainedMemory(reader);
-	const collector = createCoreDiagnosticCollector(limits, "validate-project");
-	const report = (code, details) => {
-		collector.add({
-			code,
-			path: AGENTS_PATH,
-			subject: AGENTS_PATH,
-			qualifier: null,
-			entity: { integrationPath: AGENTS_PATH },
-			details
-		});
-		return collector.finalize();
-	};
+var checkAgentsDocument = async (context, report, load, entryDetails) => {
+	const { ledger, reader, signal } = context;
 	let document;
 	try {
-		document = await readText(ledger, AGENTS_PATH);
+		document = await readRetainedText(ledger, load);
 	} catch (error) {
-		const entryKind = getAbsentKind(error);
-		if (entryKind !== null) return report("MOLDEA_INTEGRATION_BLOCK_MISSING", { entryKind });
-		throw error;
+		const absentKind = getAbsentKind(error);
+		if (absentKind === null) throw error;
+		return entryDetails["entryKind"] === "symlink" ? report("MOLDEA_INTEGRATION_UNVERIFIED", {
+			entryKind: "symlink",
+			linkState: "not-file"
+		}) : report("MOLDEA_INTEGRATION_BLOCK_MISSING", { entryKind: absentKind });
 	}
 	try {
 		if (document.text === null) return report("MOLDEA_INTEGRATION_BLOCK_MISSING", {
-			entryKind: "file",
+			...entryDetails,
 			reason: "invalid-utf8"
 		});
 		const parsed = parseIntegrationBlock(document.text);
 		if (parsed.kind === "missing") return report(parsed.reason.startsWith("block-") ? "MOLDEA_INTEGRATION_BLOCK_MISSING" : "MOLDEA_INTEGRATION_SKILL_MISSING", {
-			entryKind: "file",
+			...entryDetails,
 			reason: parsed.reason
 		});
 		const { skillPath } = parsed;
 		for (const file of ["SKILL.md", "scripts/relevance-gate.mjs"]) {
 			const path = parseRepositoryPath(`/${skillPath}/${file}`);
-			const entry = await reader.getEntry(path, signal === void 0 ? void 0 : { signal });
-			if (entry?.type !== "file") return report("MOLDEA_INTEGRATION_SKILL_MISSING", {
+			const skillEntry = await reader.getEntry(path, signal === void 0 ? void 0 : { signal });
+			if (skillEntry?.type !== "file") return report("MOLDEA_INTEGRATION_SKILL_MISSING", {
 				referencedPath: `/${skillPath}`,
 				missingFile: path,
-				entryKind: entry?.type ?? "missing"
+				entryKind: skillEntry?.type ?? "missing"
 			});
 		}
 		const assetPath = parseRepositoryPath(`/${skillPath}/assets/managed-agents-block.md`);
 		let asset;
 		try {
-			asset = await readText(ledger, assetPath);
+			asset = await readRetainedText(ledger, () => ledger.readSourceFile(assetPath));
 		} catch (error) {
 			const entryKind = getAbsentKind(error);
 			if (entryKind !== null) return report("MOLDEA_INTEGRATION_SKILL_MISSING", {
@@ -2011,7 +2120,6 @@ var inspectCodingAgentIntegration = async (reader, limits, signal) => {
 			} finally {
 				ledger.release(renderedReservation);
 			}
-			return collector.finalize();
 		} finally {
 			asset.release();
 		}
@@ -2019,6 +2127,210 @@ var inspectCodingAgentIntegration = async (reader, limits, signal) => {
 		document.release();
 	}
 };
+/**
+* Checks root AGENTS.md against its referenced skill installation. A symlinked AGENTS.md whose
+* final target is a readable regular file, inside or outside the repository, is checked on the
+* target text; any other link is reported as unverifiable without reading it.
+* @param context The instruction view, repository reader, ledger, and warning recorder.
+* @returns What AGENTS.md is, including its link resolution, for the Claude Code check.
+* @throws
+* - RESOURCE_LIMIT_EXCEEDED: A Core resource limit was exceeded.
+* - RESOURCE_LIMIT_EXCEEDED: A named repository resource limit was exceeded.
+* - ABORTED: The Core operation was aborted.
+* - ABORTED: The repository operation was aborted.
+* - ACCESS_DENIED: Access to the repository source was denied.
+* - SOURCE_UNAVAILABLE: The repository source is unavailable.
+* - SNAPSHOT_CHANGED: The repository snapshot changed during the operation.
+* - INVALID_SOURCE_DATA: The repository source returned invalid data.
+*/
+var inspectAgentsIntegration = async (context) => {
+	const { instructions } = context;
+	const report = (code, details) => context.report(code, AGENTS_PATH$1, details);
+	const entry = await instructions.getEntry(AGENTS_PATH$1);
+	if (entry === null) {
+		report("MOLDEA_INTEGRATION_BLOCK_MISSING", { entryKind: "missing" });
+		return { kind: "missing" };
+	}
+	if (entry.type === "directory") {
+		report("MOLDEA_INTEGRATION_BLOCK_MISSING", { entryKind: "directory" });
+		return { kind: "directory" };
+	}
+	if (entry.type === "file") {
+		await checkAgentsDocument(context, report, () => instructions.readSourceFile(AGENTS_PATH$1), { entryKind: "file" });
+		return { kind: "file" };
+	}
+	const resolution = await instructions.resolveLink(AGENTS_PATH$1);
+	const linkState = getUnreadableLinkState(resolution);
+	if (linkState !== null || resolution === null) report("MOLDEA_INTEGRATION_UNVERIFIED", {
+		entryKind: "symlink",
+		linkState: linkState ?? "unavailable"
+	});
+	else await checkAgentsDocument(context, report, () => instructions.readLinkedSourceFile(AGENTS_PATH$1), {
+		entryKind: "symlink",
+		linkTarget: resolution.state
+	});
+	return {
+		kind: "link",
+		resolution
+	};
+};
+//#endregion
+//#region src/integration-validation/claude-inspection.ts
+var AGENTS_PATH = parseRepositoryPath("/AGENTS.md");
+var CLAUDE_PATH = parseRepositoryPath("/CLAUDE.md");
+var NESTED_CLAUDE_PATH = parseRepositoryPath("/.claude/CLAUDE.md");
+var LOCAL_CLAUDE_PATH = parseRepositoryPath("/CLAUDE.local.md");
+/** Recognizes a link between a Claude file and AGENTS.md without reading either file. */
+var isLinkedToAgents = (path, resolution, agents) => {
+	const agentsResolution = agents.kind === "link" ? agents.resolution : null;
+	if (agentsResolution?.state === "inside" && agentsResolution.targetPath === path) return true;
+	if (resolution === null || resolution.state !== "inside" && resolution.state !== "outside") return false;
+	if (agents.kind === "file") return resolution.state === "inside" && resolution.targetPath === AGENTS_PATH;
+	return (agentsResolution?.state === "inside" || agentsResolution?.state === "outside") && agentsResolution.targetIdentity === resolution.targetIdentity;
+};
+/**
+* Determines whether one Claude Code file loads AGENTS.md through an import line, a link to the
+* same final target, or AGENTS.md linking to it. A linked Claude file with a regular-file target
+* is checked for an import line as if the file were at the link's own location.
+* @returns The assessment, reading at most the file or its link target once.
+* @throws
+* - RESOURCE_LIMIT_EXCEEDED: A Core resource limit was exceeded.
+* - RESOURCE_LIMIT_EXCEEDED: A named repository resource limit was exceeded.
+* - ABORTED: The Core operation was aborted.
+* - ABORTED: The repository operation was aborted.
+* - ACCESS_DENIED: Access to the repository source was denied.
+* - SOURCE_UNAVAILABLE: The repository source is unavailable.
+* - SNAPSHOT_CHANGED: The repository snapshot changed during the operation.
+* - INVALID_SOURCE_DATA: The repository source returned invalid data.
+*/
+var assessClaudeFile = async (context, path, agents) => {
+	const { instructions, ledger } = context;
+	const entry = await instructions.getEntry(path);
+	if (entry === null) return { kind: "absent" };
+	if (isLinkedToAgents(path, null, agents)) return { kind: "loads" };
+	if (entry.type === "directory") return {
+		entryKind: "directory",
+		kind: "not-loading"
+	};
+	let load = () => instructions.readSourceFile(path);
+	if (entry.type === "symlink") {
+		const resolution = await instructions.resolveLink(path);
+		if (isLinkedToAgents(path, resolution, agents)) return { kind: "loads" };
+		const linkState = getUnreadableLinkState(resolution);
+		if (linkState !== null) return {
+			kind: "unverified",
+			linkState
+		};
+		load = () => instructions.readLinkedSourceFile(path);
+	}
+	let document;
+	try {
+		document = await readRetainedText(ledger, load);
+	} catch (error) {
+		if (getAbsentKind(error) === null) throw error;
+		return entry.type === "symlink" ? {
+			kind: "unverified",
+			linkState: "not-file"
+		} : { kind: "absent" };
+	}
+	try {
+		return document.text !== null && hasAgentsImport(document.text, path === NESTED_CLAUDE_PATH) ? { kind: "loads" } : {
+			entryKind: entry.type,
+			kind: "not-loading"
+		};
+	} finally {
+		document.release();
+	}
+};
+/**
+* Checks whether Claude Code loads AGENTS.md. When `/CLAUDE.md` or `/.claude/CLAUDE.md` exists,
+* only those shared files count; `/CLAUDE.local.md` counts only when neither exists. At most one
+* Claude warning is recorded: unverifiable for the first unverifiable counted file when none
+* loads AGENTS.md, otherwise a missing import for the governing file.
+* @param context The instruction view, ledger, and warning recorder.
+* @param agents What root AGENTS.md is, as the AGENTS.md check observed it.
+* @returns A promise that settles after at most one Claude warning was recorded.
+* @throws
+* - RESOURCE_LIMIT_EXCEEDED: A Core resource limit was exceeded.
+* - RESOURCE_LIMIT_EXCEEDED: A named repository resource limit was exceeded.
+* - ABORTED: The Core operation was aborted.
+* - ABORTED: The repository operation was aborted.
+* - ACCESS_DENIED: Access to the repository source was denied.
+* - SOURCE_UNAVAILABLE: The repository source is unavailable.
+* - SNAPSHOT_CHANGED: The repository snapshot changed during the operation.
+* - INVALID_SOURCE_DATA: The repository source returned invalid data.
+*/
+var inspectClaudeIntegration = async (context, agents) => {
+	const counted = [];
+	for (const path of [CLAUDE_PATH, NESTED_CLAUDE_PATH]) {
+		const assessment = await assessClaudeFile(context, path, agents);
+		if (assessment.kind === "loads") return;
+		if (assessment.kind !== "absent") counted.push({
+			assessment,
+			path
+		});
+	}
+	if (counted.length === 0) {
+		const assessment = await assessClaudeFile(context, LOCAL_CLAUDE_PATH, agents);
+		if (assessment.kind === "absent" || assessment.kind === "loads") return;
+		counted.push({
+			assessment,
+			path: LOCAL_CLAUDE_PATH
+		});
+	}
+	const unverifiable = counted.find(({ assessment }) => assessment.kind === "unverified");
+	if (unverifiable?.assessment.kind === "unverified") {
+		context.report("MOLDEA_INTEGRATION_UNVERIFIED", unverifiable.path, {
+			entryKind: "symlink",
+			linkState: unverifiable.assessment.linkState
+		});
+		return;
+	}
+	const governing = counted[0];
+	if (governing?.assessment.kind === "not-loading") context.report("MOLDEA_INTEGRATION_CLAUDE_IMPORT_MISSING", governing.path, { entryKind: governing.assessment.entryKind });
+};
+//#endregion
+//#region src/integration-validation/inspection.ts
+/**
+* Checks the coding-agent integration: root AGENTS.md and the Claude Code instruction files
+* through the instruction view, and the referenced skill installation through the repository
+* reader, with at most six entry lookups, four link resolutions, and five bounded reads.
+* @param reader The repository inspection reader for skill files and the managed asset.
+* @param instructions The instruction view for the coding-agent instruction paths.
+* @param limits The immutable resource limits for the inspection.
+* @param signal Optional cancellation for repository lookups.
+* @returns Completed content-free integration warnings, never an execution or runtime-wiring claim.
+* @throws
+* - RESOURCE_LIMIT_EXCEEDED: A Core resource limit was exceeded.
+* - RESOURCE_LIMIT_EXCEEDED: A named repository resource limit was exceeded.
+* - ABORTED: The Core operation was aborted.
+* - ABORTED: The repository operation was aborted.
+* - ACCESS_DENIED: Access to the repository source was denied.
+* - SOURCE_UNAVAILABLE: The repository source is unavailable.
+* - SNAPSHOT_CHANGED: The repository snapshot changed during the operation.
+* - INVALID_SOURCE_DATA: The repository source returned invalid data.
+*/
+var inspectCodingAgentIntegration = async (reader, instructions, limits, signal) => {
+	const collector = createCoreDiagnosticCollector(limits, "validate-project");
+	const context = {
+		instructions,
+		ledger: getRetainedMemory(reader),
+		reader,
+		report: (code, subject, details) => {
+			collector.add({
+				code,
+				path: subject,
+				subject,
+				qualifier: null,
+				entity: { integrationPath: subject },
+				details
+			});
+		},
+		...signal === void 0 ? {} : { signal }
+	};
+	await inspectClaudeIntegration(context, await inspectAgentsIntegration(context));
+	return collector.finalize();
+};
 //#endregion
 //#region src/impact-pattern-validation/inspection.ts
 /** Identifies the canonical document owning an impact relationship. */
@@ -2245,7 +2557,7 @@ var inspectMirrors = async (repository, manifestPath, agents, options, signal) =
 	for (const agent of [...agents].sort((left, right) => compareExactStrings(left.id, right.id))) {
 		const mirrors = [];
 		if (agent.instruction !== null) {
-			const declaredMirrors = [...agent.declaration.mirrors ?? []].sort(compareExactStrings);
+			const declaredMirrors = agent.declaration.mirrors ?? [];
 			for (const [index, mirrorPath] of declaredMirrors.entries()) {
 				const mirror = await inspectMirror(repository, manifestPath, agent.instruction, mirrorPath, `/agents/${escapeJsonPointerSegment(agent.id)}/mirrors/${index}`, agent.id, options, collector, operationOptions, signal);
 				if (mirror !== null) mirrors.push(mirror);
@@ -2899,7 +3211,7 @@ var inspectUniversalProject = async (context, options) => {
 		addDiagnostics(collector, mirrorInspection.diagnostics);
 	}
 	session.throwIfAborted();
-	addDiagnostics(collector, await inspectCodingAgentIntegration(session.reader, options.limits, signal));
+	addDiagnostics(collector, await inspectCodingAgentIntegration(session.reader, session.instructions, options.limits, signal));
 	const patterns = indexedManifest === null ? {
 		completed: false,
 		diagnostics: []
@@ -2909,7 +3221,9 @@ var inspectUniversalProject = async (context, options) => {
 	const diagnostics = applyWarningAcceptances(collector.finalize(), indexedManifest?.value.acceptedWarnings ?? [], /* @__PURE__ */ new Set([...[
 		"MOLDEA_INTEGRATION_BLOCK_MISSING",
 		"MOLDEA_INTEGRATION_SKILL_MISSING",
-		"MOLDEA_INTEGRATION_BLOCK_STALE"
+		"MOLDEA_INTEGRATION_BLOCK_STALE",
+		"MOLDEA_INTEGRATION_UNVERIFIED",
+		"MOLDEA_INTEGRATION_CLAUDE_IMPORT_MISSING"
 	], ...patterns.completed ? ["MOLDEA_IMPACT_PATTERN_UNMATCHED"] : []]), options.limits);
 	const project = !diagnostics.some((diagnostic) => diagnostic.severity === "error") && indexedManifest !== null && projectAssets.project !== null ? createProjectIndex({
 		agentMirrors,
@@ -2941,6 +3255,21 @@ var invalidArgument$1 = () => {
 var isRepositoryReader = (candidate) => {
 	return isRecord(candidate) && isRecord(candidate["snapshot"]) && typeof candidate["snapshot"]["id"] === "string" && typeof candidate["snapshot"]["sourceKind"] === "string" && typeof candidate["compare"] === "function" && typeof candidate["getEntry"] === "function" && typeof candidate["listEntriesPage"] === "function" && typeof candidate["readFilePage"] === "function";
 };
+var isLinkResolver = (candidate) => {
+	return isRecord(candidate) && isRecord(candidate["snapshot"]) && typeof candidate["snapshot"]["id"] === "string" && typeof candidate["snapshot"]["sourceKind"] === "string" && typeof candidate["resolveLink"] === "function" && typeof candidate["readLinkTargetPage"] === "function";
+};
+var validateInstructions = (candidate) => {
+	if (!isRecord(candidate) || Reflect.ownKeys(candidate).some((key) => key !== "reader" && key !== "linkResolver")) return invalidArgument$1();
+	const reader = candidate["reader"];
+	const linkResolver = candidate["linkResolver"];
+	if (!isRepositoryReader(reader)) return invalidArgument$1();
+	if (linkResolver === void 0) return { reader };
+	if (!isLinkResolver(linkResolver) || linkResolver.snapshot.id !== reader.snapshot.id) return invalidArgument$1();
+	return {
+		linkResolver,
+		reader
+	};
+};
 var isAbortSignal = (candidate) => {
 	return isRecord(candidate) && typeof candidate["aborted"] === "boolean" && typeof candidate["addEventListener"] === "function" && typeof candidate["removeEventListener"] === "function";
 };
@@ -2948,9 +3277,11 @@ var validateInput = (candidate) => {
 	try {
 		if (!isRecord(candidate)) return invalidArgument$1();
 		const repository = candidate["repository"];
+		const instructions = candidate["instructions"];
 		const signal = candidate["signal"];
-		if (Reflect.ownKeys(candidate).some((key) => key !== "repository" && key !== "signal") || !isRepositoryReader(repository) || signal !== void 0 && !isAbortSignal(signal)) return invalidArgument$1();
+		if (Reflect.ownKeys(candidate).some((key) => key !== "repository" && key !== "instructions" && key !== "signal") || !isRepositoryReader(repository) || signal !== void 0 && !isAbortSignal(signal)) return invalidArgument$1();
 		return {
+			...instructions === void 0 ? {} : { instructions: validateInstructions(instructions) },
 			repository,
 			...signal === void 0 ? {} : { signal }
 		};
@@ -2961,7 +3292,7 @@ var validateInput = (candidate) => {
 };
 /**
 * Inspects one coherent repository snapshot through universal file and export validation.
-* @param input The untrusted source-neutral reader and optional cancellation signal.
+* @param input The untrusted source-neutral reader, optional instruction source, and signal.
 * @param options The immutable Core configuration snapshot.
 * @returns A promise resolving to the frozen all-or-nothing project inspection result.
 * @throws
@@ -2983,7 +3314,7 @@ var validateInput = (candidate) => {
 var validateProjectState = async (input, options) => {
 	const validatedInput = validateInput(input);
 	const operationOptions = createCoreOperationOptionsSnapshot(options);
-	const session = createRepositoryInspectionSession(validatedInput.repository, operationOptions.limits, validatedInput.signal);
+	const session = createRepositoryInspectionSession(validatedInput.repository, operationOptions.limits, validatedInput.signal, validatedInput.instructions);
 	const universal = await inspectUniversalProject({
 		session,
 		...validatedInput.signal === void 0 ? {} : { signal: validatedInput.signal }
@@ -3363,4 +3694,4 @@ var createCore = (options) => {
 //#endregion
 export { createCore as n, parseIntegrationBlock as r, core_exports as t };
 
-//# sourceMappingURL=core-DC9KYL1H.js.map
+//# sourceMappingURL=core-CMuQrqRI.js.map