@xgent-ai/skills 0.5.0 → 0.7.0

package/vendor/impeccable/bundle/blobs/bea6ebfda78c51b9cf372097a1d77431d0f6bcd96eadec13a2ac95afbb87fb6d

@@ -1,104 +0,0 @@
-One-time live-mode project setup. Loaded from [live.md](live.md) only when `impeccable live` reports `config_missing` / `config_invalid`, when `configDrift` needs handling, or when the config lacks `cspChecked`. Not part of the per-session hot path.
-
-## Write the config
-
-Create the file at the `path` the boot reported (default `.impeccable/live/config.json`):
-
-```json
-{
-  "files": ["<path-or-glob>", "<path-or-glob>", ...],
-  "exclude": ["<optional-glob>", ...],
-  "insertBefore": "</body>",
-  "commentSyntax": "html",
-  "cspChecked": true
-}
-```
-
-`files` is the inject target: **the HTML files the browser actually loads**, not necessarily source (tracked vs generated does not matter here; wrap has its own generated-file guard). Entries are literal paths or globs. `exclude` (optional) skips files a `files` glob would otherwise include (email templates, demo fixtures). `cspChecked` records that the CSP step below has run; absent on first setup.
-
-**Hard-excluded paths (cannot be overridden):** `**/node_modules/**` and `**/.git/**`; injecting there would instrument third-party code.
-
-**Glob syntax:** `**` matches any number of segments (including zero), `*` matches within a segment, `?` matches one character. Paths are project-root-relative with forward slashes.
-
-| Framework | `files` | `insertBefore` | `commentSyntax` |
-|-----------|---------|----------------|-----------------|
-| SPA with single shell (Vite / React / Plain HTML) | `["index.html"]` | `</body>` | `html` |
-| Next.js (App Router) | `["app/layout.tsx"]` | `</body>` | `jsx` |
-| Next.js (Pages) | `["pages/_document.tsx"]` | `</body>` | `jsx` |
-| Nuxt | `["app.vue"]` | `</body>` | `html` |
-| Svelte / SvelteKit | `["src/app.html"]` | `</body>` | `html` |
-| TanStack Router (SPA, Vite) | `["index.html"]` | `</body>` | `html` |
-| TanStack Start (SSR) | `["src/routes/__root.tsx"]` | `<Scripts` | `jsx` |
-| Astro | `[" <root layout .astro>"]` | `</body>` | `html` |
-| Multi-page (separate HTML per route) | `["public/**/*.html"]` glob over the served dir | `</body>` | `html` |
-
-Pick an anchor that exists in every file (`</body>` almost always works); `insertAfter` matches after a line instead. For multi-page sites prefer a glob so new pages are picked up automatically. For sites whose pages are rebuilt by a generator, the inject survives only until the next regeneration: re-run `impeccable live` after each build (accept is unaffected; it writes true source via the fallback flow).
-
-**Framework adapters (auto-detected at inject time).** Every inject records what it wrote in `.impeccable/live/inject-journal.json`; the next inject or remove heals artifacts a crash or wrong-directory stop left behind. SvelteKit, Nuxt, and TanStack Start server-render their document shell, so a raw `<script>` in the entry template will not execute reliably; `impeccable live-inject` detects them and routes to a dedicated adapter (SvelteKit: dev-only root component from `+layout.svelte`; Nuxt: dev-only `.client.ts` plugin; TanStack Start: a generated dev-only `ImpeccableLiveRoot` component in `__root`). The `files` value stays a valid detection/CSP hint but is not the literal insertion site. A plain TanStack Router SPA takes the baseline Vite path.
-
-## Config drift
-
-On every boot the project is scanned for HTML files under common page roots (`public/`, `src/`, `app/`, `pages/`) that the resolved `files` list does not cover; they surface as `configDrift.orphans` with a hint. Tell the user once per session which files are uncovered and offer to add them or switch `files` to a glob. Never auto-update the config; the user decides. `configDrift` is `null` when there is no drift.
-
-## CSP detection (first-time only)
-
-Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
-
-If `config.cspChecked === true`, skip this whole section; the user was already asked once.
-
-```bash
-.codex/skills/impeccable/scripts/impeccable detect-csp
-```
-
-Output `{ shape, signals }`; the shape names the *patch mechanism*, so one template covers many frameworks:
-
-- **`null`**: no CSP; write the config with `cspChecked: true` and stop here.
-- **`append-arrays`**: CSP as structured directive arrays; auto-patchable (monorepo helpers with `additionalScriptSrc`/`additionalConnectSrc`, SvelteKit `kit.csp.directives`, Nuxt `nuxt-security`).
-- **`append-string`**: CSP as a literal value string; auto-patchable (inline `next.config.*` `headers()`, Nuxt `routeRules`).
-- **`middleware`** / **`meta-tag`**: detected but not auto-patched. Show the user the detected files, ask them to add `http://localhost:8400` to `script-src` and `connect-src` manually, then mark `cspChecked: true` and proceed.
-
-### Consent prompt (use this phrasing)
-
-> **CSP patch needed.** I detected a Content Security Policy in your project that blocks `http://localhost:8400`: the live picker won't load without an allowance. Here's the change I'd make:
->
-> ```diff
-> [file: <patchTarget>]
-> [exact diff, 2-5 lines]
-> ```
->
-> It's guarded by `NODE_ENV === "development"` so the extra entry only appears in dev and never reaches production. You can remove it any time by reverting this file. Apply? [y/n]
-
-On "no": skip the patch, note that live will not work until the allowance is added manually, and still write `cspChecked: true` (the question has been asked). On "yes": apply the shape's patch below, then write `cspChecked: true`.
-
-### append-arrays
-
-Declare near the top of the file that holds the CSP arrays, then append `...__impeccableLiveDev` to the script-src and connect-src arrays:
-
-```ts
-// Dev-only allowance so impeccable live mode can load. Guarded by NODE_ENV.
-const __impeccableLiveDev =
-  process.env.NODE_ENV === "development" ? ["http://localhost:8400"] : [];
-```
-
-Per-framework: Next.js + monorepo helper: edit the *app's* `next.config.*` (not the shared helper), appending to `additionalScriptSrc` / `additionalConnectSrc`. SvelteKit: `svelte.config.js`, `kit.csp.directives['script-src']` and `['connect-src']`. Nuxt + nuxt-security: `nuxt.config.*`, `security.headers.contentSecurityPolicy['script-src']` and `['connect-src']`. Reference outputs: [nextjs-turborepo/expected-after-patch.ts](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/nextjs-turborepo/expected-after-patch.ts), [sveltekit-csp/expected-after-patch.js](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/sveltekit-csp/expected-after-patch.js). Idempotency: if `__impeccableLiveDev` already exists in the file, the patch is applied; just mark `cspChecked: true`.
-
-### append-string
-
-Two-point patch: declare a dev-only string, interpolate it into the CSP value at both directives (leading space so it concatenates cleanly; convert literals to template strings as part of the edit):
-
-```ts
-// Dev-only allowance so impeccable live mode can load.
-const __impeccableLiveDev =
-  process.env.NODE_ENV === "development" ? " http://localhost:8400" : "";
-```
-
-- `script-src 'self' 'unsafe-inline'` becomes `` `script-src 'self' 'unsafe-inline'${__impeccableLiveDev}` ``
-- `connect-src 'self'` becomes `` `connect-src 'self'${__impeccableLiveDev}` ``
-
-Per-framework: Next.js inline `headers()` in `next.config.*`; Nuxt `routeRules['/**'].headers['Content-Security-Policy']` in `nuxt.config.*`. Reference outputs: [nextjs-inline-csp/expected-after-patch.js](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/nextjs-inline-csp/expected-after-patch.js), [nuxt-csp/expected-after-patch.ts](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/nuxt-csp/expected-after-patch.ts).
-
-## Troubleshooting
-
-If the user said "no" to the CSP patch and later reports live not working: their dev CSP blocks `http://localhost:8400`. Delete `cspChecked` from `.impeccable/live/config.json` and re-run `impeccable live`; setup asks again.
-
-After setup, re-run `impeccable live`.

package/vendor/impeccable/bundle/blobs/bf3b8883f8550744e08754af82a78939ab8b1237e5fad6f38d819e2f17e8a389

@@ -1,104 +0,0 @@
-One-time live-mode project setup. Loaded from [live.md](live.md) only when `impeccable live` reports `config_missing` / `config_invalid`, when `configDrift` needs handling, or when the config lacks `cspChecked`. Not part of the per-session hot path.
-
-## Write the config
-
-Create the file at the `path` the boot reported (default `.impeccable/live/config.json`):
-
-```json
-{
-  "files": ["<path-or-glob>", "<path-or-glob>", ...],
-  "exclude": ["<optional-glob>", ...],
-  "insertBefore": "</body>",
-  "commentSyntax": "html",
-  "cspChecked": true
-}
-```
-
-`files` is the inject target: **the HTML files the browser actually loads**, not necessarily source (tracked vs generated does not matter here; wrap has its own generated-file guard). Entries are literal paths or globs. `exclude` (optional) skips files a `files` glob would otherwise include (email templates, demo fixtures). `cspChecked` records that the CSP step below has run; absent on first setup.
-
-**Hard-excluded paths (cannot be overridden):** `**/node_modules/**` and `**/.git/**`; injecting there would instrument third-party code.
-
-**Glob syntax:** `**` matches any number of segments (including zero), `*` matches within a segment, `?` matches one character. Paths are project-root-relative with forward slashes.
-
-| Framework | `files` | `insertBefore` | `commentSyntax` |
-|-----------|---------|----------------|-----------------|
-| SPA with single shell (Vite / React / Plain HTML) | `["index.html"]` | `</body>` | `html` |
-| Next.js (App Router) | `["app/layout.tsx"]` | `</body>` | `jsx` |
-| Next.js (Pages) | `["pages/_document.tsx"]` | `</body>` | `jsx` |
-| Nuxt | `["app.vue"]` | `</body>` | `html` |
-| Svelte / SvelteKit | `["src/app.html"]` | `</body>` | `html` |
-| TanStack Router (SPA, Vite) | `["index.html"]` | `</body>` | `html` |
-| TanStack Start (SSR) | `["src/routes/__root.tsx"]` | `<Scripts` | `jsx` |
-| Astro | `[" <root layout .astro>"]` | `</body>` | `html` |
-| Multi-page (separate HTML per route) | `["public/**/*.html"]` glob over the served dir | `</body>` | `html` |
-
-Pick an anchor that exists in every file (`</body>` almost always works); `insertAfter` matches after a line instead. For multi-page sites prefer a glob so new pages are picked up automatically. For sites whose pages are rebuilt by a generator, the inject survives only until the next regeneration: re-run `impeccable live` after each build (accept is unaffected; it writes true source via the fallback flow).
-
-**Framework adapters (auto-detected at inject time).** Every inject records what it wrote in `.impeccable/live/inject-journal.json`; the next inject or remove heals artifacts a crash or wrong-directory stop left behind. SvelteKit, Nuxt, and TanStack Start server-render their document shell, so a raw `<script>` in the entry template will not execute reliably; `impeccable live-inject` detects them and routes to a dedicated adapter (SvelteKit: dev-only root component from `+layout.svelte`; Nuxt: dev-only `.client.ts` plugin; TanStack Start: a generated dev-only `ImpeccableLiveRoot` component in `__root`). The `files` value stays a valid detection/CSP hint but is not the literal insertion site. A plain TanStack Router SPA takes the baseline Vite path.
-
-## Config drift
-
-On every boot the project is scanned for HTML files under common page roots (`public/`, `src/`, `app/`, `pages/`) that the resolved `files` list does not cover; they surface as `configDrift.orphans` with a hint. Tell the user once per session which files are uncovered and offer to add them or switch `files` to a glob. Never auto-update the config; the user decides. `configDrift` is `null` when there is no drift.
-
-## CSP detection (first-time only)
-
-Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
-
-If `config.cspChecked === true`, skip this whole section; the user was already asked once.
-
-```bash
-.gemini/skills/impeccable/scripts/impeccable detect-csp
-```
-
-Output `{ shape, signals }`; the shape names the *patch mechanism*, so one template covers many frameworks:
-
-- **`null`**: no CSP; write the config with `cspChecked: true` and stop here.
-- **`append-arrays`**: CSP as structured directive arrays; auto-patchable (monorepo helpers with `additionalScriptSrc`/`additionalConnectSrc`, SvelteKit `kit.csp.directives`, Nuxt `nuxt-security`).
-- **`append-string`**: CSP as a literal value string; auto-patchable (inline `next.config.*` `headers()`, Nuxt `routeRules`).
-- **`middleware`** / **`meta-tag`**: detected but not auto-patched. Show the user the detected files, ask them to add `http://localhost:8400` to `script-src` and `connect-src` manually, then mark `cspChecked: true` and proceed.
-
-### Consent prompt (use this phrasing)
-
-> **CSP patch needed.** I detected a Content Security Policy in your project that blocks `http://localhost:8400`: the live picker won't load without an allowance. Here's the change I'd make:
->
-> ```diff
-> [file: <patchTarget>]
-> [exact diff, 2-5 lines]
-> ```
->
-> It's guarded by `NODE_ENV === "development"` so the extra entry only appears in dev and never reaches production. You can remove it any time by reverting this file. Apply? [y/n]
-
-On "no": skip the patch, note that live will not work until the allowance is added manually, and still write `cspChecked: true` (the question has been asked). On "yes": apply the shape's patch below, then write `cspChecked: true`.
-
-### append-arrays
-
-Declare near the top of the file that holds the CSP arrays, then append `...__impeccableLiveDev` to the script-src and connect-src arrays:
-
-```ts
-// Dev-only allowance so impeccable live mode can load. Guarded by NODE_ENV.
-const __impeccableLiveDev =
-  process.env.NODE_ENV === "development" ? ["http://localhost:8400"] : [];
-```
-
-Per-framework: Next.js + monorepo helper: edit the *app's* `next.config.*` (not the shared helper), appending to `additionalScriptSrc` / `additionalConnectSrc`. SvelteKit: `svelte.config.js`, `kit.csp.directives['script-src']` and `['connect-src']`. Nuxt + nuxt-security: `nuxt.config.*`, `security.headers.contentSecurityPolicy['script-src']` and `['connect-src']`. Reference outputs: [nextjs-turborepo/expected-after-patch.ts](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/nextjs-turborepo/expected-after-patch.ts), [sveltekit-csp/expected-after-patch.js](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/sveltekit-csp/expected-after-patch.js). Idempotency: if `__impeccableLiveDev` already exists in the file, the patch is applied; just mark `cspChecked: true`.
-
-### append-string
-
-Two-point patch: declare a dev-only string, interpolate it into the CSP value at both directives (leading space so it concatenates cleanly; convert literals to template strings as part of the edit):
-
-```ts
-// Dev-only allowance so impeccable live mode can load.
-const __impeccableLiveDev =
-  process.env.NODE_ENV === "development" ? " http://localhost:8400" : "";
-```
-
-- `script-src 'self' 'unsafe-inline'` becomes `` `script-src 'self' 'unsafe-inline'${__impeccableLiveDev}` ``
-- `connect-src 'self'` becomes `` `connect-src 'self'${__impeccableLiveDev}` ``
-
-Per-framework: Next.js inline `headers()` in `next.config.*`; Nuxt `routeRules['/**'].headers['Content-Security-Policy']` in `nuxt.config.*`. Reference outputs: [nextjs-inline-csp/expected-after-patch.js](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/nextjs-inline-csp/expected-after-patch.js), [nuxt-csp/expected-after-patch.ts](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/nuxt-csp/expected-after-patch.ts).
-
-## Troubleshooting
-
-If the user said "no" to the CSP patch and later reports live not working: their dev CSP blocks `http://localhost:8400`. Delete `cspChecked` from `.impeccable/live/config.json` and re-run `impeccable live`; setup asks again.
-
-After setup, re-run `impeccable live`.

package/vendor/impeccable/bundle/blobs/bf92a4a51b29de9661c5fa82f3d79244718a67d385ef661990f0c4a5b367e843

@@ -1,104 +0,0 @@
-One-time live-mode project setup. Loaded from [live.md](live.md) only when `impeccable live` reports `config_missing` / `config_invalid`, when `configDrift` needs handling, or when the config lacks `cspChecked`. Not part of the per-session hot path.
-
-## Write the config
-
-Create the file at the `path` the boot reported (default `.impeccable/live/config.json`):
-
-```json
-{
-  "files": ["<path-or-glob>", "<path-or-glob>", ...],
-  "exclude": ["<optional-glob>", ...],
-  "insertBefore": "</body>",
-  "commentSyntax": "html",
-  "cspChecked": true
-}
-```
-
-`files` is the inject target: **the HTML files the browser actually loads**, not necessarily source (tracked vs generated does not matter here; wrap has its own generated-file guard). Entries are literal paths or globs. `exclude` (optional) skips files a `files` glob would otherwise include (email templates, demo fixtures). `cspChecked` records that the CSP step below has run; absent on first setup.
-
-**Hard-excluded paths (cannot be overridden):** `**/node_modules/**` and `**/.git/**`; injecting there would instrument third-party code.
-
-**Glob syntax:** `**` matches any number of segments (including zero), `*` matches within a segment, `?` matches one character. Paths are project-root-relative with forward slashes.
-
-| Framework | `files` | `insertBefore` | `commentSyntax` |
-|-----------|---------|----------------|-----------------|
-| SPA with single shell (Vite / React / Plain HTML) | `["index.html"]` | `</body>` | `html` |
-| Next.js (App Router) | `["app/layout.tsx"]` | `</body>` | `jsx` |
-| Next.js (Pages) | `["pages/_document.tsx"]` | `</body>` | `jsx` |
-| Nuxt | `["app.vue"]` | `</body>` | `html` |
-| Svelte / SvelteKit | `["src/app.html"]` | `</body>` | `html` |
-| TanStack Router (SPA, Vite) | `["index.html"]` | `</body>` | `html` |
-| TanStack Start (SSR) | `["src/routes/__root.tsx"]` | `<Scripts` | `jsx` |
-| Astro | `[" <root layout .astro>"]` | `</body>` | `html` |
-| Multi-page (separate HTML per route) | `["public/**/*.html"]` glob over the served dir | `</body>` | `html` |
-
-Pick an anchor that exists in every file (`</body>` almost always works); `insertAfter` matches after a line instead. For multi-page sites prefer a glob so new pages are picked up automatically. For sites whose pages are rebuilt by a generator, the inject survives only until the next regeneration: re-run `impeccable live` after each build (accept is unaffected; it writes true source via the fallback flow).
-
-**Framework adapters (auto-detected at inject time).** Every inject records what it wrote in `.impeccable/live/inject-journal.json`; the next inject or remove heals artifacts a crash or wrong-directory stop left behind. SvelteKit, Nuxt, and TanStack Start server-render their document shell, so a raw `<script>` in the entry template will not execute reliably; `impeccable live-inject` detects them and routes to a dedicated adapter (SvelteKit: dev-only root component from `+layout.svelte`; Nuxt: dev-only `.client.ts` plugin; TanStack Start: a generated dev-only `ImpeccableLiveRoot` component in `__root`). The `files` value stays a valid detection/CSP hint but is not the literal insertion site. A plain TanStack Router SPA takes the baseline Vite path.
-
-## Config drift
-
-On every boot the project is scanned for HTML files under common page roots (`public/`, `src/`, `app/`, `pages/`) that the resolved `files` list does not cover; they surface as `configDrift.orphans` with a hint. Tell the user once per session which files are uncovered and offer to add them or switch `files` to a glob. Never auto-update the config; the user decides. `configDrift` is `null` when there is no drift.
-
-## CSP detection (first-time only)
-
-Keep all allowances below development-only, including manual middleware and meta-tag edits. Do not change a deployed production site's CSP to load the localhost helper; see [live.md](live.md) for production inspection alternatives.
-
-If `config.cspChecked === true`, skip this whole section; the user was already asked once.
-
-```bash
-.trae/skills/impeccable/scripts/impeccable detect-csp
-```
-
-Output `{ shape, signals }`; the shape names the *patch mechanism*, so one template covers many frameworks:
-
-- **`null`**: no CSP; write the config with `cspChecked: true` and stop here.
-- **`append-arrays`**: CSP as structured directive arrays; auto-patchable (monorepo helpers with `additionalScriptSrc`/`additionalConnectSrc`, SvelteKit `kit.csp.directives`, Nuxt `nuxt-security`).
-- **`append-string`**: CSP as a literal value string; auto-patchable (inline `next.config.*` `headers()`, Nuxt `routeRules`).
-- **`middleware`** / **`meta-tag`**: detected but not auto-patched. Show the user the detected files, ask them to add `http://localhost:8400` to `script-src` and `connect-src` manually, then mark `cspChecked: true` and proceed.
-
-### Consent prompt (use this phrasing)
-
-> **CSP patch needed.** I detected a Content Security Policy in your project that blocks `http://localhost:8400`: the live picker won't load without an allowance. Here's the change I'd make:
->
-> ```diff
-> [file: <patchTarget>]
-> [exact diff, 2-5 lines]
-> ```
->
-> It's guarded by `NODE_ENV === "development"` so the extra entry only appears in dev and never reaches production. You can remove it any time by reverting this file. Apply? [y/n]
-
-On "no": skip the patch, note that live will not work until the allowance is added manually, and still write `cspChecked: true` (the question has been asked). On "yes": apply the shape's patch below, then write `cspChecked: true`.
-
-### append-arrays
-
-Declare near the top of the file that holds the CSP arrays, then append `...__impeccableLiveDev` to the script-src and connect-src arrays:
-
-```ts
-// Dev-only allowance so impeccable live mode can load. Guarded by NODE_ENV.
-const __impeccableLiveDev =
-  process.env.NODE_ENV === "development" ? ["http://localhost:8400"] : [];
-```
-
-Per-framework: Next.js + monorepo helper: edit the *app's* `next.config.*` (not the shared helper), appending to `additionalScriptSrc` / `additionalConnectSrc`. SvelteKit: `svelte.config.js`, `kit.csp.directives['script-src']` and `['connect-src']`. Nuxt + nuxt-security: `nuxt.config.*`, `security.headers.contentSecurityPolicy['script-src']` and `['connect-src']`. Reference outputs: [nextjs-turborepo/expected-after-patch.ts](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/nextjs-turborepo/expected-after-patch.ts), [sveltekit-csp/expected-after-patch.js](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/sveltekit-csp/expected-after-patch.js). Idempotency: if `__impeccableLiveDev` already exists in the file, the patch is applied; just mark `cspChecked: true`.
-
-### append-string
-
-Two-point patch: declare a dev-only string, interpolate it into the CSP value at both directives (leading space so it concatenates cleanly; convert literals to template strings as part of the edit):
-
-```ts
-// Dev-only allowance so impeccable live mode can load.
-const __impeccableLiveDev =
-  process.env.NODE_ENV === "development" ? " http://localhost:8400" : "";
-```
-
-- `script-src 'self' 'unsafe-inline'` becomes `` `script-src 'self' 'unsafe-inline'${__impeccableLiveDev}` ``
-- `connect-src 'self'` becomes `` `connect-src 'self'${__impeccableLiveDev}` ``
-
-Per-framework: Next.js inline `headers()` in `next.config.*`; Nuxt `routeRules['/**'].headers['Content-Security-Policy']` in `nuxt.config.*`. Reference outputs: [nextjs-inline-csp/expected-after-patch.js](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/nextjs-inline-csp/expected-after-patch.js), [nuxt-csp/expected-after-patch.ts](https://github.com/pbakaus/impeccable/blob/8dac6ae7e020c43ab10ce9b41939f6fd42627b96/tests/framework-fixtures/nuxt-csp/expected-after-patch.ts).
-
-## Troubleshooting
-
-If the user said "no" to the CSP patch and later reports live not working: their dev CSP blocks `http://localhost:8400`. Delete `cspChecked` from `.impeccable/live/config.json` and re-run `impeccable live`; setup asks again.
-
-After setup, re-run `impeccable live`.

package/vendor/impeccable/bundle/blobs/c06effcdc60859157208d3b7ee23d56160f2386f6a2dfa2514ba82fe21828ae0

@@ -1,24 +0,0 @@
-# Command guidance
-
-## Workflow questions
-
-Give advice without executing commands; the menu below is only for bare invocations. Consult relevant command references as needed for prerequisites and scope. Link to the [docs](https://impeccable.style/docs/) for the broader workflow guide. If the user also requests execution, follow that request.
-
-## No-argument routing: the context-aware menu
-
-Read this when the user invokes `/impeccable` with no argument. They are asking "what should I do?" Make the menu context-aware instead of static.
-
-Setup has already run `impeccable context`. If that reported `NO_PRODUCT_MD`, the project has no captured context yet: lead the menu with `/impeccable init` as the top recommendation (one line on why) and still show the rest below; don't silently jump into init. Otherwise run `.agent/skills/impeccable/scripts/impeccable signals` once and read its JSON, then lead with the **2-3 highest-value next commands**, each with a one-line reason pulled from the signals, followed by the full menu (the Commands table in SKILL.md, grouped by category). **Never auto-run a command; the recommendation is a suggestion the user confirms.**
-
-Reason over the signals; there is no score to obey:
-
-- `setup.hasDesign` false while `setup.hasCode` true → `document` (capture the visual system).
-- `critique.latest` is `null` → the project has never been critiqued; for a set-up project with a real surface, offering `/impeccable critique <surface>` is a strong default.
-- `critique.latest` with a low `score` or non-zero `p0` / `p1` → `polish` (it reads that snapshot as its backlog and closes it when stale or cleared).
-- `git.changedFiles` pointing at one surface → scope `audit` or `polish` to those files specifically, naming them.
-- `devServer.running` true → `live` is available for in-browser iteration, and `generate` for one-shot variant runs on a named element; if false, don't lead with either. **`live`, `generate`, and the bundled `impeccable detect` are web-only.** If `setup.platform` is `ios`, `android`, or `adaptive`, don't lead with any of them; the browser overlay and the HTML rule engine don't apply to native app code.
-- Otherwise group by intent (build new / improve what's there / iterate visually), tailored to the current surface and `setup.platform`.
-
-**If `scan.targets` is non-empty and `setup.platform` is not `ios`/`android`/`adaptive`, run `.agent/skills/impeccable/scripts/impeccable detect --json <scan.targets joined by spaces>` once** (the bundled detector over local files: no network, no npx; it reads HTML/CSS, so skip it for native projects). `scan.via` tells you what they are: `git-changes` (the markup/style files in your dirty tree, the most relevant set), `source-dir` (e.g. `src`, `app`), `html`, or `root`. Fold the hits into your picks: many quality / contrast hits → `audit` or `polish`; a specific slop family → the matching command (gradient text or eyebrows → `quieter` / `typeset`, flat or gray palette → `colorize`, and so on). It's a real, current signal that beats guessing. If detect errors or the tree is large and slow, skip it and recommend the user run `audit` themselves; never block the suggestion on it.
-
-Keep it to 2-3 pointed picks with the exact command to type. The menu stays the fallback; the recommendation is the lede.

package/vendor/impeccable/bundle/blobs/c100b67a4ae248ad564182b181acb1ee2fe64c00049aeef62d4e7a3213726f37

@@ -1,26 +0,0 @@
-# Region map
-
-A region map names what is actually visible in the approved comp before asset production. It is not a page build or an asset approval.
-
-1. Run `.gemini/skills/impeccable/scripts/impeccable comp-spec --comp <comp.png> --grid` and open the original and gridded images.
-2. Run `.gemini/skills/impeccable/scripts/impeccable comp-spec --schema` for the JSON fields. Write `regions.json` with a `regions` array. Each region needs a stable `id`, `kind`, `note`, and exactly one of `pixelBox`, normalized `box`, or `grid`. Use the original comp’s dimensions.
-3. Run `.gemini/skills/impeccable/scripts/impeccable comp-spec --comp <comp.png> --regions regions.json --inspect-map`. The output points to a report, overlay, exact crops and `COMPARE` sheets of masked references. The default prints findings; `--json` prints the entire report, with sheet paths in `comparisonSheets`.
-4. Open the comparison sheets first to inspect affected crops together, then open individual crops where more detail is needed. Compare their bounds with the original. Inspect excluded foreground pixels as well as geometry errors. Every overlapping non-container code box is masked in full, including empty space inside it. Bound separate text elements separately so artwork in the gaps stays visible; a container describes their layout extent and never replaces its children. Correct the map and inspect again; use a new output directory each time. Zero errors does not certify crop accuracy. Coverage warnings are hints, not proof of completeness.
-
-If the request ends at mapping, stop with the map, inspection report and unresolved findings. To continue a build, measure the inspected map with `comp-spec --comp <comp.png> --regions regions.json` and follow [new-work.md](new-work.md).
-
-`--auto` produces horizontal band scaffolding, not element identification. It is optional and does not replace authoring a map.
-
-## Containment
-
-`parentId` identifies an enclosing `container: true` region. Parent and children keep separate IDs and crops. Containment never transfers approval.
-
-## What varies independently
-
-Split regions by what varies independently: content the site swaps (room photos, products, people), moving parts (anything a hover or the signature interaction moves), and structure (frames, surrounds, ornament). A window with open shutters onto a room is three kinds of region: the surround as a plate with a transparent opening, the room as an image region beneath it, and each shutter as its own plate. Overlapping regions are composited in the page. `comp-spec` flags a raster region whose note names a frame and the view it opens onto (`baked-composite`), and the plan and asset review shows it to the user first.
-
-## Painted material
-
-When measuring, `comp-spec` flags a `text`, `control` or `chrome` region, containers included, whose crop looks painted (`painted-pixels`: many colours, soft gradients) and lists it in its summary. The plan and asset review shows flagged regions, and those marked `codeDrawn` (painted material you chose to draw in code), to the user first. Do not leave the catch to them: if a region is painted material (a figure, a photograph, a metal or paper surface), classify it `plate`, `image` or `texture` now.
-
-Comp crops are reference evidence only, never production assets. The map inspector marks its PNGs as comp-derived.

package/vendor/impeccable/bundle/blobs/c1cb6877ca99a0c1b38ba0c7d59f32702d3022f6821d8045f7133f7c40b6362f

@@ -1,242 +0,0 @@
-/**
- * Browser-side resolution of project detector waivers for Impeccable live mode.
- *
- * The live server serializes `.impeccable/config.json` + `config.local.json`
- * detector ignores (plus the served-root prefixes from the inject config's
- * `files` globs) into `window.__IMPECCABLE_PROJECT_IGNORES__`. This part
- * resolves that config against the current page's URL path when a detect scan
- * starts, so the overlay suppresses the same findings the CLI and the edit
- * hook do (issue #639).
- *
- * Mirrors filterDetectionFindings in cli/lib/impeccable-config.mjs:
- *   1. `ignoreRules` suppress a rule project-wide.
- *   2. `ignoreValues` entries with `value: "*"` suppress their rule in the
- *      files their globs name. The CLI never applies an unscoped wildcard
- *      (isIgnoredFindingValue returns false for it), so neither does this.
- *   3. Remaining `ignoreValues` entries match on the finding's own value;
- *      those are forwarded as `disabledValues` for the detector bundle to
- *      apply where the findings are assembled.
- *   4. `ignoreFiles` globs that name the page waive it wholesale: the
- *      resolver reports `skipScan: true` and the detector answers the scan
- *      with zero findings, mirroring shouldIgnoreDetectionFile in the CLI
- *      and the edit hook's own ignoreFiles gate.
- *
- * `pageFiles`, when the server could resolve it, lists the real project
- * files the inject config serves. A URL that suffix-matches exactly one of
- * them takes that file as its only project identity; an ambiguous or absent
- * match falls back to the served-root common ancestor below.
- *
- * Known gap, unchanged from PR #645: framework apps inject into source files
- * (src/routes/about/+page.svelte) while scans see route URLs (/about), so
- * entries scoped to source or asset paths never match a page candidate and
- * are dropped. That shows the finding, which is the conservative direction.
- *
- * Kept separate from live-browser.js so the glob and page-scope logic can be
- * unit tested in Node (tests/live-browser-ignores.test.mjs) without the full
- * overlay UI bundle.
- */
-(function (root) {
-  'use strict';
-  if (!root) return;
-
-  // Keep in step with normalizeIgnoreRule / normalizeIgnoreValue in
-  // cli/lib/impeccable-config.mjs.
-  function normalizeIgnoreRule(rule) {
-    return String(rule || '').trim().toLowerCase();
-  }
-
-  function normalizeIgnoreValue(value) {
-    return String(value || '')
-      .trim()
-      .replace(/^["']|["']$/g, '')
-      .replace(/\+/g, ' ')
-      .replace(/\s+/g, ' ')
-      .toLowerCase();
-  }
-
-  // Glob -> RegExp. Supports `**`, `*`, `?`, and `{a,b}` alternation.
-  // Keep in step with globToRegex in cli/lib/impeccable-config.mjs.
-  function globToRegex(glob) {
-    let re = '^';
-    let i = 0;
-    while (i < glob.length) {
-      const c = glob[i];
-      if (c === '*') {
-        if (glob[i + 1] === '*') {
-          re += '.*';
-          i += 2;
-          if (glob[i] === '/') i += 1;
-        } else {
-          re += '[^/]*';
-          i += 1;
-        }
-      } else if (c === '?') {
-        re += '[^/]';
-        i += 1;
-      } else if (c === '{') {
-        const end = glob.indexOf('}', i);
-        if (end === -1) { re += '\\{'; i += 1; continue; }
-        const parts = glob.slice(i + 1, end).split(',').map((p) => p.replace(/[.+^$()|[\]\\]/g, '\\$&'));
-        re += `(?:${parts.join('|')})`;
-        i = end + 1;
-      } else if (/[.+^$()|[\]\\]/.test(c)) {
-        re += `\\${c}`;
-        i += 1;
-      } else {
-        re += c;
-        i += 1;
-      }
-    }
-    re += '$';
-    return new RegExp(re);
-  }
-
-  // The project-relative paths this page could be known as. Ignore globs are
-  // project-relative (prototype/foo.html) and the URL is site-relative
-  // (/foo.html), because a static server's root usually sits inside the
-  // project; `roots` carries that prefix. The server reads it from the inject
-  // config's own `files` globs, which already state where the served pages
-  // are. Do not derive it from the ignore globs: a single entry scoped to
-  // prototype/library/** would then lend prototype/library/ as a candidate
-  // prefix to every page, and that rule would suppress site-wide.
-  //
-  // Each prefixed path also contributes its slash suffixes, mirroring
-  // findingMatchesScopedIgnoreFile in cli/lib/impeccable-config.mjs (which
-  // matches globs against every path suffix of the finding's file).
-  //
-  // One live session is served by one server, so a single document root must
-  // sit at or above every configured page. The only prefix that can safely
-  // be asserted is therefore the deepest common ancestor of the glob roots.
-  // Treating each glob's own prefix as an identity goes wrong in both
-  // directions: disjoint roots (src/ and public/) invent simultaneous
-  // identities for one URL, so a waiver scoped to src/foo.html hides a
-  // finding on a page served from public/foo.html; nested roots (prototype/
-  // and prototype/library/, from globs at two depths in one tree) are not
-  // alternatives at all, and demanding a waiver match under both stops
-  // prototype/index.html from applying anywhere. When the globs share no
-  // common root, no prefix is asserted and only the URL path itself matches.
-  function pageCandidates(pathname, roots, pageFiles) {
-    let pagePath = String(pathname || '');
-    try {
-      pagePath = decodeURIComponent(pagePath);
-    } catch {
-      // Malformed percent-escape: match on the raw path rather than throwing.
-    }
-    pagePath = pagePath.replace(/^\/+/, '');
-    // A directory URL serves that directory's index, and the ignore globs
-    // name files. Without this, /news/ never matches prototype/news/index.html.
-    if (pagePath === '' || pagePath.endsWith('/')) pagePath += 'index.html';
-
-    const candidates = new Set();
-    const addSuffixes = (fullPath) => {
-      const parts = fullPath.split('/').filter(Boolean);
-      for (let i = 0; i < parts.length; i++) {
-        candidates.add(parts.slice(i).join('/'));
-      }
-    };
-    addSuffixes(pagePath);
-
-    // The served page list names the real files the inject config serves.
-    // A URL that suffix-matches exactly one of them has an unambiguous
-    // project identity; assert that identity and stop guessing from roots
-    // (PR #645 review: with src/ and public/ both served, /foo.html must not
-    // borrow src/foo.html's waivers while actually serving public/foo.html).
-    // Zero matches or several fall through to the common-ancestor fallback:
-    // ambiguity resolves toward showing the finding.
-    const knownPages = [];
-    for (const entry of Array.isArray(pageFiles) ? pageFiles : []) {
-      if (typeof entry !== 'string' || !entry) continue;
-      if (entry === pagePath || entry.endsWith('/' + pagePath)) knownPages.push(entry);
-    }
-    if (knownPages.length === 1) {
-      addSuffixes(knownPages[0]);
-      return [...candidates];
-    }
-
-    const prefixes = [];
-    for (const entry of Array.isArray(roots) ? roots : []) {
-      if (typeof entry !== 'string') continue;
-      prefixes.push(entry.split('/').filter(Boolean));
-    }
-    let common = prefixes.length > 0 ? prefixes[0] : [];
-    for (const segments of prefixes.slice(1)) {
-      let i = 0;
-      while (i < common.length && i < segments.length && common[i] === segments[i]) i += 1;
-      common = common.slice(0, i);
-    }
-
-    if (common.length > 0) addSuffixes(common.join('/') + '/' + pagePath);
-    return [...candidates];
-  }
-
-  function matchesScope(globs, candidates) {
-    return globs.some((glob) => {
-      let re;
-      try {
-        re = globToRegex(String(glob));
-      } catch {
-        // Malformed glob: skip it, as matchesAnyGlob does in the CLI.
-        return false;
-      }
-      return candidates.some((candidate) => re.test(candidate));
-    });
-  }
-
-  /**
-   * Resolve the serialized project ignores for one page.
-   *
-   * @param {object} options
-   * @param {object} options.ignores  window.__IMPECCABLE_PROJECT_IGNORES__,
-   *   in whatever state it arrived: absent, null, or hand-edited into the
-   *   wrong shape. Every read tolerates that and degrades to no filtering.
-   * @param {string} options.pathname  location.pathname of the scanned page.
-   * @returns {{ disabledRules: string[], disabledValues: Array<{rule: string, value: string}>, skipScan: boolean }}
-   */
-  function resolveDetectIgnores({ ignores, pathname } = {}) {
-    const config = ignores && typeof ignores === 'object' ? ignores : {};
-    const asArray = (value) => (Array.isArray(value) ? value : []);
-    const candidates = pageCandidates(pathname, config.roots, config.pageFiles);
-
-    // detector.ignoreFiles waives whole files. When any glob names this
-    // page, the scan itself is skipped; rule and value lists are returned
-    // empty because nothing will run.
-    const ignoreFileGlobs = asArray(config.ignoreFiles)
-      .filter((glob) => typeof glob === 'string' && glob.trim());
-    if (ignoreFileGlobs.length > 0 && matchesScope(ignoreFileGlobs, candidates)) {
-      return { disabledRules: [], disabledValues: [], skipScan: true };
-    }
-
-    const disabledRules = new Set(
-      asArray(config.ignoreRules)
-        .filter((rule) => typeof rule === 'string')
-        .map(normalizeIgnoreRule)
-        .filter(Boolean),
-    );
-    const disabledValues = [];
-
-    for (const entry of asArray(config.ignoreValues)) {
-      if (!entry || typeof entry !== 'object') continue;
-      const rule = normalizeIgnoreRule(entry.rule);
-      const value = normalizeIgnoreValue(entry.value);
-      if (!rule || !value) continue;
-      const files = [
-        ...(typeof entry.file === 'string' && entry.file.trim() ? [entry.file.trim()] : []),
-        ...asArray(entry.files).filter((glob) => typeof glob === 'string' && glob.trim()),
-      ];
-      if (value === '*') {
-        // Wildcards suppress their rule only inside the files they name.
-        if (files.length > 0 && matchesScope(files, candidates)) disabledRules.add(rule);
-        continue;
-      }
-      if (files.length > 0 && !matchesScope(files, candidates)) continue;
-      disabledValues.push({ rule, value });
-    }
-
-    return { disabledRules: [...disabledRules], disabledValues, skipScan: false };
-  }
-
-  root.__IMPECCABLE_LIVE_IGNORES__ = {
-    version: 1,
-    resolveDetectIgnores,
-  };
-})(typeof window !== 'undefined' ? window : globalThis);