mewkit 1.14.0 → 1.15.0

package/dist/core/plugin-manifest.d.ts

@@ -29,20 +29,20 @@ export declare const ClaudePluginJsonSchema: z.ZodObject<{
     }>>;
     skills: z.ZodArray<z.ZodString, "many">;
 }, "strip", z.ZodTypeAny, {
-    skills: string[];
-    version: string;
     name: string;
     description: string;
+    skills: string[];
+    version: string;
     $schema?: string | undefined;
     author?: {
         name: string;
         email?: string | undefined;
     } | undefined;
 }, {
-    skills: string[];
-    version: string;
     name: string;
     description: string;
+    skills: string[];
+    version: string;
     $schema?: string | undefined;
     author?: {
         name: string;
@@ -85,12 +85,12 @@ export declare const ClaudeMarketplaceJsonSchema: z.ZodObject<{
         description?: string | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
+    name: string;
     owner: {
         name: string;
     } & {
         [k: string]: unknown;
     };
-    name: string;
     plugins: {
         name: string;
         source: string;
@@ -98,12 +98,12 @@ export declare const ClaudeMarketplaceJsonSchema: z.ZodObject<{
     }[];
     $schema?: string | undefined;
 }, {
+    name: string;
     owner: {
         name: string;
     } & {
         [k: string]: unknown;
     };
-    name: string;
     plugins: {
         name: string;
         source: string;
@@ -151,40 +151,40 @@ export declare const CodexPluginJsonSchema: z.ZodObject<{
         defaultPrompt: z.ZodString;
     }, z.ZodTypeAny, "passthrough">>;
 }, "strip", z.ZodTypeAny, {
-    skills: string;
-    version: string;
     name: string;
     description: string;
     interface: {
         displayName: string;
+        category: string;
         shortDescription: string;
         longDescription: string;
         developerName: string;
-        category: string;
         capabilities: string[];
         defaultPrompt: string;
     } & {
         [k: string]: unknown;
     };
+    skills: string;
+    version: string;
     author?: z.objectOutputType<{
         name: z.ZodString;
     }, z.ZodTypeAny, "passthrough"> | undefined;
 }, {
-    skills: string;
-    version: string;
     name: string;
     description: string;
     interface: {
         displayName: string;
+        category: string;
         shortDescription: string;
         longDescription: string;
         developerName: string;
-        category: string;
         capabilities: string[];
         defaultPrompt: string;
     } & {
         [k: string]: unknown;
     };
+    skills: string;
+    version: string;
     author?: z.objectInputType<{
         name: z.ZodString;
     }, z.ZodTypeAny, "passthrough"> | undefined;
@@ -226,8 +226,8 @@ export declare const CodexMarketplaceJsonSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        category?: string | undefined;
         policy?: Record<string, string> | undefined;
+        category?: string | undefined;
     }, {
         name: string;
         source: {
@@ -236,8 +236,8 @@ export declare const CodexMarketplaceJsonSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        category?: string | undefined;
         policy?: Record<string, string> | undefined;
+        category?: string | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
     name: string;
@@ -249,8 +249,8 @@ export declare const CodexMarketplaceJsonSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        category?: string | undefined;
         policy?: Record<string, string> | undefined;
+        category?: string | undefined;
     }[];
     interface: {
         displayName: string;
@@ -267,8 +267,8 @@ export declare const CodexMarketplaceJsonSchema: z.ZodObject<{
         } & {
             [k: string]: unknown;
         };
-        category?: string | undefined;
         policy?: Record<string, string> | undefined;
+        category?: string | undefined;
     }[];
     interface: {
         displayName: string;

package/dist/core/provider-adapter.d.ts

@@ -0,0 +1,28 @@
+import { type ProviderProjection } from "./provider-projection.js";
+import { type AcquisitionDescriptor } from "./repo-context-adapter.js";
+import { type LifecycleMap, type LifecycleEvent, type EnforcementGap } from "./provider-lifecycle.js";
+import { type InvocationShapeMap } from "./provider-invocation.js";
+export interface ProviderAdapterView {
+    provider: string;
+    /** Aggregate: `supported` (projection supported) · `partial` · `report-only` (no projection). */
+    status: ProviderProjection["status"];
+    /** Discovery projection + the four independent support levels (discoverable…enforceable). */
+    projection: ProviderProjection;
+    /** How the host acquires repo-context evidence (read/search tools). */
+    acquisition: AcquisitionDescriptor;
+    /** Per-lifecycle-event support + gate capability. */
+    lifecycle: LifecycleMap;
+    /** The events this provider can actually GATE on (proven deny/block) — may be empty. */
+    gatingEvents: LifecycleEvent[];
+    /** Security/privacy deny events this provider CANNOT guarantee a block on — may be empty. */
+    enforcementGaps: EnforcementGap[];
+    /** Logical invocation id → the provider-native operation shape (adapter-owned constants). */
+    invocation: InvocationShapeMap;
+    /** Where durable task state lives for this provider. */
+    storageBoundary: string;
+}
+/** Compose the full adapter view for a provider (report-only fallbacks compose cleanly). */
+export declare function describeProvider(provider: string): ProviderAdapterView;
+/** The providers with an authored (non-report-only) adapter, for matrix enumeration. */
+export declare const ADAPTED_PROVIDERS: readonly ["claude-code", "claude-plugin", "codex"];
+//# sourceMappingURL=provider-adapter.d.ts.map

package/dist/core/provider-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adapter.d.ts","sourceRoot":"","sources":["../../src/core/provider-adapter.ts"],"names":[],"mappings":"AAKA,OAAO,EAAiB,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAA4B,KAAK,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AACjG,OAAO,EAAkD,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,KAAK,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACtJ,OAAO,EAAuB,KAAK,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAExF,MAAM,WAAW,mBAAmB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,iGAAiG;IACjG,MAAM,EAAE,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IACrC,6FAA6F;IAC7F,UAAU,EAAE,kBAAkB,CAAC;IAC/B,uEAAuE;IACvE,WAAW,EAAE,qBAAqB,CAAC;IACnC,qDAAqD;IACrD,SAAS,EAAE,YAAY,CAAC;IACxB,wFAAwF;IACxF,YAAY,EAAE,cAAc,EAAE,CAAC;IAC/B,6FAA6F;IAC7F,eAAe,EAAE,cAAc,EAAE,CAAC;IAClC,6FAA6F;IAC7F,UAAU,EAAE,kBAAkB,CAAC;IAC/B,wDAAwD;IACxD,eAAe,EAAE,MAAM,CAAC;CACxB;AAOD,4FAA4F;AAC5F,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,mBAAmB,CAatE;AAED,wFAAwF;AACxF,eAAO,MAAM,iBAAiB,oDAAqD,CAAC"}

package/dist/core/provider-adapter.js

@@ -0,0 +1,31 @@
+// The unified per-provider ADAPTER view (Phase 6): one object composing the facts that were
+// built across earlier phases — discovery projection + 4 support levels (P3), repo-context
+// read/search acquisition (P5), lifecycle-event mappings (P6) — plus the task-state storage
+// boundary (P4). This is the single surface `mewkit providers` renders and a resolution cites.
+// It composes trusted adapter constants; it introduces no new provider-native claim of its own.
+import { getProjection } from "./provider-projection.js";
+import { getAcquisitionDescriptor } from "./repo-context-adapter.js";
+import { getLifecycleMap, gatingEvents, enforcementGaps } from "./provider-lifecycle.js";
+import { getInvocationShapes } from "./provider-invocation.js";
+/** Task-state storage boundary. Identical across providers by P4 decision #2: task records are the
+ * CONSUMER PROJECT's state (`<cwd>/tasks/active`), never plugin-owned data — so a plugin install
+ * does NOT relocate them to ${CLAUDE_PLUGIN_DATA}. */
+const STORAGE_BOUNDARY = "consumer project <cwd>/tasks/active (cwd-keyed; not plugin-owned)";
+/** Compose the full adapter view for a provider (report-only fallbacks compose cleanly). */
+export function describeProvider(provider) {
+    const projection = getProjection(provider);
+    return {
+        provider,
+        status: projection.status,
+        projection,
+        acquisition: getAcquisitionDescriptor(provider),
+        lifecycle: getLifecycleMap(provider),
+        gatingEvents: gatingEvents(provider),
+        enforcementGaps: enforcementGaps(provider),
+        invocation: getInvocationShapes(provider),
+        storageBoundary: STORAGE_BOUNDARY,
+    };
+}
+/** The providers with an authored (non-report-only) adapter, for matrix enumeration. */
+export const ADAPTED_PROVIDERS = ["claude-code", "claude-plugin", "codex"];
+//# sourceMappingURL=provider-adapter.js.map

package/dist/core/provider-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-adapter.js","sourceRoot":"","sources":["../../src/core/provider-adapter.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,2FAA2F;AAC3F,4FAA4F;AAC5F,+FAA+F;AAC/F,gGAAgG;AAChG,OAAO,EAAE,aAAa,EAA2B,MAAM,0BAA0B,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAA8B,MAAM,2BAA2B,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAA+D,MAAM,yBAAyB,CAAC;AACtJ,OAAO,EAAE,mBAAmB,EAA2B,MAAM,0BAA0B,CAAC;AAsBxF;;sDAEsD;AACtD,MAAM,gBAAgB,GAAG,mEAAmE,CAAC;AAE7F,4FAA4F;AAC5F,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO;QACN,QAAQ;QACR,MAAM,EAAE,UAAU,CAAC,MAAM;QACzB,UAAU;QACV,WAAW,EAAE,wBAAwB,CAAC,QAAQ,CAAC;QAC/C,SAAS,EAAE,eAAe,CAAC,QAAQ,CAAC;QACpC,YAAY,EAAE,YAAY,CAAC,QAAQ,CAAC;QACpC,eAAe,EAAE,eAAe,CAAC,QAAQ,CAAC;QAC1C,UAAU,EAAE,mBAAmB,CAAC,QAAQ,CAAC;QACzC,eAAe,EAAE,gBAAgB;KACjC,CAAC;AACH,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,aAAa,EAAE,eAAe,EAAE,OAAO,CAAU,CAAC"}

package/dist/core/provider-invocation.d.ts

@@ -0,0 +1,14 @@
+export type InvocationSupport = "supported" | "advisory" | "unsupported" | "unknown";
+export interface InvocationShape {
+    /** The provider-native operation, described (not a runnable command). */
+    operation: string;
+    support: InvocationSupport;
+    note: string;
+}
+/** Logical invocation ids ↔ their per-provider shape. Keys are the known logical ids. */
+export type InvocationShapeMap = Record<string, InvocationShape>;
+/** The invocation-shape map for a provider, or an all-`unknown` report-only fallback. */
+export declare function getInvocationShapes(provider: string): InvocationShapeMap;
+/** The shape for one logical invocation id on a provider (unknown-fallback if unrecognized). */
+export declare function getInvocationShape(provider: string, invocationId: string): InvocationShape;
+//# sourceMappingURL=provider-invocation.d.ts.map

package/dist/core/provider-invocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-invocation.d.ts","sourceRoot":"","sources":["../../src/core/provider-invocation.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,iBAAiB,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAC;AAErF,MAAM,WAAW,eAAe;IAC/B,yEAAyE;IACzE,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,iBAAiB,CAAC;IAC3B,IAAI,EAAE,MAAM,CAAC;CACb;AAED,yFAAyF;AACzF,MAAM,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;AA+CjE,yFAAyF;AACzF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAExE;AAED,gGAAgG;AAChG,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,eAAe,CAE1F"}

package/dist/core/provider-invocation.js

@@ -0,0 +1,56 @@
+// Per-provider INVOCATION shapes (Phase 6 slice 2): the constant, provider-native operation each
+// LOGICAL invocation id maps to. This is the security seam — provider-native operation strings
+// live ONLY here (trusted adapter code), NEVER in the capability manifest, whose `invocation.id`
+// stays a logical id (KNOWN_INVOCATION_IDS). Hostile frontmatter therefore cannot smuggle an
+// executable command: it can name a logical id at most, and only this table turns that into an
+// operation descriptor. Descriptors are DESCRIPTIVE (what the host does), not runnable strings.
+import { KNOWN_INVOCATION_IDS } from "./capability.js";
+// Claude Code exposes typed primitives the current runtime confirms: a Skill tool, an Agent/Task
+// tool, slash commands, and settings.json hook registration. A "workflow" is not a distinct host
+// primitive — it runs as its entry skill/command — so invoke-workflow is honestly advisory.
+const CLAUDE_CODE_INVOCATION = {
+    "invoke-skill": { operation: "Skill tool (by skill name)", support: "supported", note: "host invokes the skill directly" },
+    "invoke-agent": { operation: "Agent/Task tool (by agent type)", support: "supported", note: "host spawns the subagent" },
+    "invoke-command": { operation: "slash command", support: "supported", note: "user- or model-invoked command" },
+    "invoke-workflow": { operation: "entry skill/command composition", support: "advisory", note: "no distinct workflow primitive — runs as its entry skill" },
+    "lifecycle-hook": { operation: "hook registered in settings.json", support: "supported", note: "host fires the hook on the mapped event" },
+    none: { operation: "(not directly invocable)", support: "unsupported", note: "e.g. a describe-only tool or a hook capability" },
+};
+const CLAUDE_PLUGIN_INVOCATION = {
+    ...CLAUDE_CODE_INVOCATION,
+    "invoke-command": { operation: "plugin slash command", support: "supported", note: "command shipped in the plugin payload" },
+    "lifecycle-hook": { operation: "hook in the plugin payload (via build-plugin)", support: "supported", note: "propagated hook fires on the mapped event" },
+};
+// Codex reaches skills/commands/agents through its instruction/prompt projection (the migration
+// contract), not typed invoke tools — so these are advisory, matching provider-projection's codex
+// invocable=advisory. Hooks are version-gated (see provider-lifecycle).
+const CODEX_INVOCATION = {
+    "invoke-skill": { operation: "skill projected into the AGENTS instruction surface", support: "advisory", note: "prompt-projected, not a typed invoke tool" },
+    "invoke-agent": { operation: "codex subagent surface", support: "advisory", note: "subagent exists (SubagentStart) but is not a typed invoke" },
+    "invoke-command": { operation: "command projected into the instruction surface", support: "advisory", note: "prompt-projected" },
+    "invoke-workflow": { operation: "instruction-surface composition", support: "advisory", note: "no workflow primitive" },
+    "lifecycle-hook": { operation: "codex hook (config.toml)", support: "advisory", note: "version-gated (CODEX_MIN_SUPPORTED_VERSION 0.142)" },
+    none: { operation: "(not directly invocable)", support: "unsupported", note: "describe-only / hook capability" },
+};
+const INVOCATION_BY_PROVIDER = {
+    "claude-code": CLAUDE_CODE_INVOCATION,
+    "claude-plugin": CLAUDE_PLUGIN_INVOCATION,
+    codex: CODEX_INVOCATION,
+};
+/** An all-`unknown` invocation map for a provider with no tested projection (claims nothing). */
+function unknownInvocation() {
+    const out = {};
+    for (const id of KNOWN_INVOCATION_IDS) {
+        out[id] = { operation: "(unknown)", support: "unknown", note: "no tested invocation projection for this provider" };
+    }
+    return out;
+}
+/** The invocation-shape map for a provider, or an all-`unknown` report-only fallback. */
+export function getInvocationShapes(provider) {
+    return INVOCATION_BY_PROVIDER[provider] ?? unknownInvocation();
+}
+/** The shape for one logical invocation id on a provider (unknown-fallback if unrecognized). */
+export function getInvocationShape(provider, invocationId) {
+    return getInvocationShapes(provider)[invocationId] ?? { operation: "(unknown)", support: "unknown", note: "unrecognized invocation id" };
+}
+//# sourceMappingURL=provider-invocation.js.map

package/dist/core/provider-invocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-invocation.js","sourceRoot":"","sources":["../../src/core/provider-invocation.ts"],"names":[],"mappings":"AAAA,iGAAiG;AACjG,+FAA+F;AAC/F,iGAAiG;AACjG,6FAA6F;AAC7F,+FAA+F;AAC/F,gGAAgG;AAChG,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AAcvD,iGAAiG;AACjG,iGAAiG;AACjG,4FAA4F;AAC5F,MAAM,sBAAsB,GAAuB;IAClD,cAAc,EAAE,EAAE,SAAS,EAAE,4BAA4B,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,iCAAiC,EAAE;IAC1H,cAAc,EAAE,EAAE,SAAS,EAAE,iCAAiC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,0BAA0B,EAAE;IACxH,gBAAgB,EAAE,EAAE,SAAS,EAAE,eAAe,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,gCAAgC,EAAE;IAC9G,iBAAiB,EAAE,EAAE,SAAS,EAAE,iCAAiC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,0DAA0D,EAAE;IAC1J,gBAAgB,EAAE,EAAE,SAAS,EAAE,kCAAkC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,yCAAyC,EAAE;IAC1I,IAAI,EAAE,EAAE,SAAS,EAAE,0BAA0B,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,gDAAgD,EAAE;CAC/H,CAAC;AAEF,MAAM,wBAAwB,GAAuB;IACpD,GAAG,sBAAsB;IACzB,gBAAgB,EAAE,EAAE,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,uCAAuC,EAAE;IAC5H,gBAAgB,EAAE,EAAE,SAAS,EAAE,+CAA+C,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,2CAA2C,EAAE;CACzJ,CAAC;AAEF,gGAAgG;AAChG,kGAAkG;AAClG,wEAAwE;AACxE,MAAM,gBAAgB,GAAuB;IAC5C,cAAc,EAAE,EAAE,SAAS,EAAE,qDAAqD,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,2CAA2C,EAAE;IAC5J,cAAc,EAAE,EAAE,SAAS,EAAE,wBAAwB,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,2DAA2D,EAAE;IAC/I,gBAAgB,EAAE,EAAE,SAAS,EAAE,gDAAgD,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,kBAAkB,EAAE;IAChI,iBAAiB,EAAE,EAAE,SAAS,EAAE,iCAAiC,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,uBAAuB,EAAE;IACvH,gBAAgB,EAAE,EAAE,SAAS,EAAE,0BAA0B,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,mDAAmD,EAAE;IAC3I,IAAI,EAAE,EAAE,SAAS,EAAE,0BAA0B,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,iCAAiC,EAAE;CAChH,CAAC;AAEF,MAAM,sBAAsB,GAAuC;IAClE,aAAa,EAAE,sBAAsB;IACrC,eAAe,EAAE,wBAAwB;IACzC,KAAK,EAAE,gBAAgB;CACvB,CAAC;AAEF,iGAAiG;AACjG,SAAS,iBAAiB;IACzB,MAAM,GAAG,GAAuB,EAAE,CAAC;IACnC,KAAK,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;QACvC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,mDAAmD,EAAE,CAAC;IACrH,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IACnD,OAAO,sBAAsB,CAAC,QAAQ,CAAC,IAAI,iBAAiB,EAAE,CAAC;AAChE,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,kBAAkB,CAAC,QAAgB,EAAE,YAAoB;IACxE,OAAO,mBAAmB,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC;AAC1I,CAAC"}

package/dist/core/provider-lifecycle.d.ts

@@ -0,0 +1,35 @@
+/** The 9 portable lifecycle events (host-neutral names). */
+export declare const LIFECYCLE_EVENTS: readonly ["session_start", "pre_tool", "post_tool", "tool_failure", "prompt_submitted", "stop", "pre_compaction", "subagent_start", "subagent_stop"];
+export type LifecycleEvent = (typeof LIFECYCLE_EVENTS)[number];
+export type LifecycleStatus = "supported" | "advisory" | "unsupported" | "unknown";
+export interface LifecycleSupport {
+    status: LifecycleStatus;
+    /** True ONLY where a runtime hook can deny/block (proven). Observe-only or version-gated ⇒ false. */
+    gate: boolean;
+    /** In-repo basis for the claim — what proves the status/gate. */
+    evidence: string;
+}
+export type LifecycleMap = Record<LifecycleEvent, LifecycleSupport>;
+/** The lifecycle map for a provider, or an all-`unknown` report-only fallback. */
+export declare function getLifecycleMap(provider: string): LifecycleMap;
+/** The events on which a provider can actually GATE (deny/block) — proven only. */
+export declare function gatingEvents(provider: string): LifecycleEvent[];
+/** The deny-capable events that carry security/privacy enforcement: a hook here can BLOCK a
+ * dangerous tool call, a risky prompt, or an unsafe stop (the gate-enforcement / privacy-block
+ * class of safety hooks). */
+export declare const SECURITY_ENFORCEMENT_EVENTS: readonly LifecycleEvent[];
+export interface EnforcementGap {
+    event: LifecycleEvent;
+    /** The event's lifecycle status on this provider (why the gate can't be guaranteed). */
+    status: LifecycleStatus;
+    reason: string;
+}
+/**
+ * Security/privacy ENFORCEMENT GAPS: the safety-critical deny events (`SECURITY_ENFORCEMENT_EVENTS`)
+ * that this provider CANNOT statically guarantee a block on (`gate:false`). An empty list means the
+ * provider can enforce all of them. A non-empty list is the honest "this provider cannot guarantee
+ * <safety hook> will block here" signal — surfaced prominently so a consumer never assumes a
+ * privacy/gate-enforcement hook is enforced when it is only advisory.
+ */
+export declare function enforcementGaps(provider: string): EnforcementGap[];
+//# sourceMappingURL=provider-lifecycle.d.ts.map

package/dist/core/provider-lifecycle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-lifecycle.d.ts","sourceRoot":"","sources":["../../src/core/provider-lifecycle.ts"],"names":[],"mappings":"AAQA,4DAA4D;AAC5D,eAAO,MAAM,gBAAgB,sJAUnB,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAC;AAEnF,MAAM,WAAW,gBAAgB;IAChC,MAAM,EAAE,eAAe,CAAC;IACxB,qGAAqG;IACrG,IAAI,EAAE,OAAO,CAAC;IACd,iEAAiE;IACjE,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;AAuDpE,kFAAkF;AAClF,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAE9D;AAED,mFAAmF;AACnF,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAG/D;AAED;;6BAE6B;AAC7B,eAAO,MAAM,2BAA2B,EAAE,SAAS,cAAc,EAA6C,CAAC;AAE/G,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,cAAc,CAAC;IACtB,wFAAwF;IACxF,MAAM,EAAE,eAAe,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAYlE"}

package/dist/core/provider-lifecycle.js

@@ -0,0 +1,101 @@
+// Per-provider LIFECYCLE-EVENT mappings (Phase 6). For each of the 9 portable lifecycle events,
+// declare whether a provider fires it and — separately — whether a handler can GATE (deny/block)
+// on it. Trusted adapter constants (like provider-projection.ts): they must never over-claim.
+// `gate` is true ONLY where a runtime hook proof exists; a version-gated or observe-only event is
+// `advisory`/`gate:false`, never asserted as enforceable. MeowKit records these facts; the host
+// runs the hooks. Evidence strings cite the in-repo proof (shipped settings.json / the codex
+// capability table) so a provider claim is auditable.
+/** The 9 portable lifecycle events (host-neutral names). */
+export const LIFECYCLE_EVENTS = [
+    "session_start",
+    "pre_tool",
+    "post_tool",
+    "tool_failure",
+    "prompt_submitted",
+    "stop",
+    "pre_compaction",
+    "subagent_start",
+    "subagent_stop",
+];
+/** Claude Code: all 9 events are registered hooks in the shipped `.claude/settings.json`
+ * (SessionStart, PreToolUse, PostToolUse, PostToolUseFailure, UserPromptSubmit, Stop, PreCompact,
+ * SubagentStart, SubagentStop). Deny/block is real on PreToolUse, UserPromptSubmit, and Stop. */
+const CLAUDE_CODE_LIFECYCLE = {
+    session_start: { status: "supported", gate: false, evidence: "SessionStart hook in shipped settings.json (observe/inject)" },
+    pre_tool: { status: "supported", gate: true, evidence: "PreToolUse hook denies a tool call via exit 2 / permissionDecision:deny" },
+    post_tool: { status: "supported", gate: false, evidence: "PostToolUse hook in shipped settings.json (observe)" },
+    tool_failure: { status: "supported", gate: false, evidence: "PostToolUseFailure hook in shipped settings.json (observe)" },
+    prompt_submitted: { status: "supported", gate: true, evidence: "UserPromptSubmit hook can block/annotate the prompt" },
+    stop: { status: "supported", gate: true, evidence: "Stop hook can block the stop (exit 2)" },
+    pre_compaction: { status: "supported", gate: false, evidence: "PreCompact hook in shipped settings.json (observe)" },
+    subagent_start: { status: "supported", gate: false, evidence: "SubagentStart hook in shipped settings.json (observe)" },
+    subagent_stop: { status: "supported", gate: false, evidence: "SubagentStop hook in shipped settings.json (observe)" },
+};
+/** Claude plugin: the same SessionStart-et-al hooks, propagated into the plugin payload by
+ * `build-plugin` — identical lifecycle surface to the flat copy. */
+const CLAUDE_PLUGIN_LIFECYCLE = {
+    ...CLAUDE_CODE_LIFECYCLE,
+    session_start: { status: "supported", gate: false, evidence: "SessionStart hook propagated into the plugin payload by build-plugin (observe/inject)" },
+};
+/** Codex: per `migrate/providers/codex/capabilities.ts` CODEX_CAPABILITY_TABLE (v0.142). Codex
+ * fires most events, and PreToolUse/PermissionRequest deny is documented — BUT enforcement is
+ * version-gated (CODEX_MIN_SUPPORTED_VERSION 0.142). Statically we cannot prove the installed
+ * version, so `gate` stays false here (advisory); a runtime `detectCodexCapabilities()` probe is
+ * what would promote it. `tool_failure` has no codex event ⇒ unsupported. */
+const CODEX_VERSION_NOTE = "codex hooks are version-gated (CODEX_MIN_SUPPORTED_VERSION 0.142); deny needs a runtime version probe";
+const CODEX_LIFECYCLE = {
+    session_start: { status: "supported", gate: false, evidence: "codex SessionStart (capability table 0.142)" },
+    pre_tool: { status: "advisory", gate: false, evidence: `codex PreToolUse deny documented but ${CODEX_VERSION_NOTE}` },
+    post_tool: { status: "supported", gate: false, evidence: "codex PostToolUse (capability table 0.142, observe)" },
+    tool_failure: { status: "unsupported", gate: false, evidence: "codex exposes no tool-failure event" },
+    prompt_submitted: { status: "supported", gate: false, evidence: "codex UserPromptSubmit (capability table 0.142)" },
+    stop: { status: "supported", gate: false, evidence: "codex Stop (capability table 0.142, observe)" },
+    pre_compaction: { status: "supported", gate: false, evidence: "codex PreCompact (capability table 0.142)" },
+    subagent_start: { status: "supported", gate: false, evidence: "codex SubagentStart (capability table 0.142)" },
+    subagent_stop: { status: "supported", gate: false, evidence: "codex SubagentStop (capability table 0.142)" },
+};
+const LIFECYCLE_BY_PROVIDER = {
+    "claude-code": CLAUDE_CODE_LIFECYCLE,
+    "claude-plugin": CLAUDE_PLUGIN_LIFECYCLE,
+    codex: CODEX_LIFECYCLE,
+};
+/** An all-`unknown` lifecycle map for a provider with no tested projection (claims nothing). */
+function unknownLifecycle() {
+    const out = {};
+    for (const e of LIFECYCLE_EVENTS)
+        out[e] = { status: "unknown", gate: false, evidence: "no tested lifecycle projection for this provider" };
+    return out;
+}
+/** The lifecycle map for a provider, or an all-`unknown` report-only fallback. */
+export function getLifecycleMap(provider) {
+    return LIFECYCLE_BY_PROVIDER[provider] ?? unknownLifecycle();
+}
+/** The events on which a provider can actually GATE (deny/block) — proven only. */
+export function gatingEvents(provider) {
+    const map = getLifecycleMap(provider);
+    return LIFECYCLE_EVENTS.filter((e) => map[e].gate);
+}
+/** The deny-capable events that carry security/privacy enforcement: a hook here can BLOCK a
+ * dangerous tool call, a risky prompt, or an unsafe stop (the gate-enforcement / privacy-block
+ * class of safety hooks). */
+export const SECURITY_ENFORCEMENT_EVENTS = ["pre_tool", "prompt_submitted", "stop"];
+/**
+ * Security/privacy ENFORCEMENT GAPS: the safety-critical deny events (`SECURITY_ENFORCEMENT_EVENTS`)
+ * that this provider CANNOT statically guarantee a block on (`gate:false`). An empty list means the
+ * provider can enforce all of them. A non-empty list is the honest "this provider cannot guarantee
+ * <safety hook> will block here" signal — surfaced prominently so a consumer never assumes a
+ * privacy/gate-enforcement hook is enforced when it is only advisory.
+ */
+export function enforcementGaps(provider) {
+    const map = getLifecycleMap(provider);
+    return SECURITY_ENFORCEMENT_EVENTS.filter((e) => !map[e].gate).map((e) => ({
+        event: e,
+        status: map[e].status,
+        reason: map[e].status === "unsupported"
+            ? `no ${e} event — a safety hook here cannot run at all`
+            : map[e].status === "unknown"
+                ? `${e} support unproven for this provider — enforcement cannot be assumed`
+                : `${e} fires but cannot guarantee a block (${map[e].evidence})`,
+    }));
+}
+//# sourceMappingURL=provider-lifecycle.js.map

package/dist/core/provider-lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-lifecycle.js","sourceRoot":"","sources":["../../src/core/provider-lifecycle.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,iGAAiG;AACjG,8FAA8F;AAC9F,kGAAkG;AAClG,gGAAgG;AAChG,6FAA6F;AAC7F,sDAAsD;AAEtD,4DAA4D;AAC5D,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC/B,eAAe;IACf,UAAU;IACV,WAAW;IACX,cAAc;IACd,kBAAkB;IAClB,MAAM;IACN,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;CACN,CAAC;AAeX;;iGAEiG;AACjG,MAAM,qBAAqB,GAAiB;IAC3C,aAAa,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,6DAA6D,EAAE;IAC5H,QAAQ,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,yEAAyE,EAAE;IAClI,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,qDAAqD,EAAE;IAChH,YAAY,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,4DAA4D,EAAE;IAC1H,gBAAgB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,qDAAqD,EAAE;IACtH,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,uCAAuC,EAAE;IAC5F,cAAc,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,oDAAoD,EAAE;IACpH,cAAc,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,uDAAuD,EAAE;IACvH,aAAa,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,sDAAsD,EAAE;CACrH,CAAC;AAEF;oEACoE;AACpE,MAAM,uBAAuB,GAAiB;IAC7C,GAAG,qBAAqB;IACxB,aAAa,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,uFAAuF,EAAE;CACtJ,CAAC;AAEF;;;;6EAI6E;AAC7E,MAAM,kBAAkB,GAAG,uGAAuG,CAAC;AACnI,MAAM,eAAe,GAAiB;IACrC,aAAa,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,6CAA6C,EAAE;IAC5G,QAAQ,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,wCAAwC,kBAAkB,EAAE,EAAE;IACrH,SAAS,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,qDAAqD,EAAE;IAChH,YAAY,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,qCAAqC,EAAE;IACrG,gBAAgB,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,iDAAiD,EAAE;IACnH,IAAI,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,8CAA8C,EAAE;IACpG,cAAc,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,2CAA2C,EAAE;IAC3G,cAAc,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,8CAA8C,EAAE;IAC9G,aAAa,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,6CAA6C,EAAE;CAC5G,CAAC;AAEF,MAAM,qBAAqB,GAAiC;IAC3D,aAAa,EAAE,qBAAqB;IACpC,eAAe,EAAE,uBAAuB;IACxC,KAAK,EAAE,eAAe;CACtB,CAAC;AAEF,gGAAgG;AAChG,SAAS,gBAAgB;IACxB,MAAM,GAAG,GAAG,EAAkB,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,gBAAgB;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,kDAAkD,EAAE,CAAC;IAC5I,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,OAAO,qBAAqB,CAAC,QAAQ,CAAC,IAAI,gBAAgB,EAAE,CAAC;AAC9D,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED;;6BAE6B;AAC7B,MAAM,CAAC,MAAM,2BAA2B,GAA8B,CAAC,UAAU,EAAE,kBAAkB,EAAE,MAAM,CAAC,CAAC;AAS/G;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC/C,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,2BAA2B,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,KAAK,EAAE,CAAC;QACR,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM;QACrB,MAAM,EACL,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,aAAa;YAC9B,CAAC,CAAC,MAAM,CAAC,+CAA+C;YACxD,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS;gBAC5B,CAAC,CAAC,GAAG,CAAC,qEAAqE;gBAC3E,CAAC,CAAC,GAAG,CAAC,wCAAwC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG;KACnE,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/core/provider-projection.d.ts

@@ -0,0 +1,29 @@
+/** Where/how the always-visible bootstrap reaches a provider's instruction surface. */
+export type BootstrapPlacement = "sessionstart-hook" | "sessionstart-hook-via-plugin-build" | "instruction-file" | "none";
+export type LevelSupport = "supported" | "advisory" | "unsupported" | "unknown";
+export interface SupportLevelsDetail {
+    /** Agent can learn capability resolution exists (bootstrap placed on an always-on surface). */
+    discoverable: LevelSupport;
+    /** The resolver can rank + pick a capability for an intent (the CLI is reachable). */
+    selectable: LevelSupport;
+    /** The host can actually invoke a resolved capability now. */
+    invocable: LevelSupport;
+    /** The host GUARANTEES the behavior (a real hook gate) — never true for prompt-only compliance. */
+    enforceable: LevelSupport;
+}
+export interface ProviderProjection {
+    provider: string;
+    status: "supported" | "partial" | "report-only";
+    bootstrapPlacement: BootstrapPlacement;
+    levels: SupportLevelsDetail;
+    /** Plain-language basis for the claims — what makes each level what it is. */
+    evidence: string;
+}
+/** Providers whose bootstrap projection is authored + evidenced. Others are report-only. */
+export declare const PROVIDER_PROJECTIONS: Record<string, ProviderProjection>;
+/** Bootstrap providers that have an authored placement (supported or partial). */
+export type ProjectedProvider = "claude-code" | "claude-plugin" | "codex";
+export declare function getProjection(provider: string): ProviderProjection;
+/** True when the provider has an authored bootstrap placement (not report-only). */
+export declare function isProjectedProvider(provider: string): provider is ProjectedProvider;
+//# sourceMappingURL=provider-projection.d.ts.map

package/dist/core/provider-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-projection.d.ts","sourceRoot":"","sources":["../../src/core/provider-projection.ts"],"names":[],"mappings":"AAOA,uFAAuF;AACvF,MAAM,MAAM,kBAAkB,GAC3B,mBAAmB,GACnB,oCAAoC,GACpC,kBAAkB,GAClB,MAAM,CAAC;AAEV,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG,UAAU,GAAG,aAAa,GAAG,SAAS,CAAC;AAEhF,MAAM,WAAW,mBAAmB;IACnC,+FAA+F;IAC/F,YAAY,EAAE,YAAY,CAAC;IAC3B,sFAAsF;IACtF,UAAU,EAAE,YAAY,CAAC;IACzB,8DAA8D;IAC9D,SAAS,EAAE,YAAY,CAAC;IACxB,mGAAmG;IACnG,WAAW,EAAE,YAAY,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,WAAW,GAAG,SAAS,GAAG,aAAa,CAAC;IAChD,kBAAkB,EAAE,kBAAkB,CAAC;IACvC,MAAM,EAAE,mBAAmB,CAAC;IAC5B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,4FAA4F;AAC5F,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAyBnE,CAAC;AAEF,kFAAkF;AAClF,MAAM,MAAM,iBAAiB,GAAG,aAAa,GAAG,eAAe,GAAG,OAAO,CAAC;AAE1E,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,kBAAkB,CAUlE;AAED,oFAAoF;AACpF,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,QAAQ,IAAI,iBAAiB,CAEnF"}

package/dist/core/provider-projection.js

@@ -0,0 +1,47 @@
+// How the capability-resolution surface projects into each host provider, and the four
+// INDEPENDENT support levels per provider. This is a trusted constant declaration backed
+// by adapter evidence — it must never over-claim. In particular `enforceable` is true only
+// where the host actually guarantees the behavior (a real gating hook), NOT where only
+// prompt compliance exists (an instruction the model may or may not follow). Providers
+// without a tested projection are `report-only` with every level `unknown`.
+/** Providers whose bootstrap projection is authored + evidenced. Others are report-only. */
+export const PROVIDER_PROJECTIONS = {
+    "claude-code": {
+        provider: "claude-code",
+        status: "supported",
+        bootstrapPlacement: "sessionstart-hook",
+        levels: { discoverable: "supported", selectable: "supported", invocable: "supported", enforceable: "supported" },
+        evidence: "Bootstrap on a SessionStart hook; host invokes skills/agents; real hooks gate behavior (enforceable).",
+    },
+    "claude-plugin": {
+        provider: "claude-plugin",
+        status: "supported",
+        bootstrapPlacement: "sessionstart-hook-via-plugin-build",
+        levels: { discoverable: "supported", selectable: "supported", invocable: "supported", enforceable: "supported" },
+        evidence: "Same SessionStart hook, propagated into the plugin payload by `build-plugin`; plugin hooks gate behavior.",
+    },
+    codex: {
+        provider: "codex",
+        status: "partial",
+        bootstrapPlacement: "instruction-file",
+        // Codex surfaces the bootstrap via its AGENTS instruction file and can run projected
+        // skills/commands, but its hook enforcement is version-gated and limited — so behavior
+        // is prompt-advisory, NOT host-guaranteed. `enforceable` is honestly unsupported.
+        levels: { discoverable: "supported", selectable: "supported", invocable: "advisory", enforceable: "unsupported" },
+        evidence: "Migration writes a bounded AGENTS bootstrap plus validated .codex/capabilities.json; skill/command projection is advisory and hook enforcement version-gated ⇒ not enforceable.",
+    },
+};
+export function getProjection(provider) {
+    return (PROVIDER_PROJECTIONS[provider] ?? {
+        provider,
+        status: "report-only",
+        bootstrapPlacement: "none",
+        levels: { discoverable: "unknown", selectable: "unknown", invocable: "unknown", enforceable: "unknown" },
+        evidence: "No tested projection for this provider — report-only; no capability behavior is claimed.",
+    });
+}
+/** True when the provider has an authored bootstrap placement (not report-only). */
+export function isProjectedProvider(provider) {
+    return provider in PROVIDER_PROJECTIONS;
+}
+//# sourceMappingURL=provider-projection.js.map

package/dist/core/provider-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-projection.js","sourceRoot":"","sources":["../../src/core/provider-projection.ts"],"names":[],"mappings":"AAAA,uFAAuF;AACvF,yFAAyF;AACzF,2FAA2F;AAC3F,uFAAuF;AACvF,uFAAuF;AACvF,4EAA4E;AA+B5E,4FAA4F;AAC5F,MAAM,CAAC,MAAM,oBAAoB,GAAuC;IACvE,aAAa,EAAE;QACd,QAAQ,EAAE,aAAa;QACvB,MAAM,EAAE,WAAW;QACnB,kBAAkB,EAAE,mBAAmB;QACvC,MAAM,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE;QAChH,QAAQ,EAAE,uGAAuG;KACjH;IACD,eAAe,EAAE;QAChB,QAAQ,EAAE,eAAe;QACzB,MAAM,EAAE,WAAW;QACnB,kBAAkB,EAAE,oCAAoC;QACxD,MAAM,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE;QAChH,QAAQ,EAAE,2GAA2G;KACrH;IACD,KAAK,EAAE;QACN,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,SAAS;QACjB,kBAAkB,EAAE,kBAAkB;QACtC,qFAAqF;QACrF,uFAAuF;QACvF,kFAAkF;QAClF,MAAM,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,aAAa,EAAE;QAChH,QAAQ,EAAE,iLAAiL;KAC5L;CACD,CAAC;AAKF,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC7C,OAAO,CACN,oBAAoB,CAAC,QAAQ,CAAC,IAAI;QACjC,QAAQ;QACR,MAAM,EAAE,aAAa;QACrB,kBAAkB,EAAE,MAAM;QAC1B,MAAM,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;QACxG,QAAQ,EAAE,0FAA0F;KACpG,CACD,CAAC;AACH,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IACnD,OAAO,QAAQ,IAAI,oBAAoB,CAAC;AACzC,CAAC"}

package/dist/core/release-metadata.d.ts

@@ -40,23 +40,23 @@ export declare const ReleaseManifestSchema: z.ZodObject<{
     deletions: z.ZodDefault<z.ZodArray<z.ZodString, "many">>;
 }, "strip", z.ZodTypeAny, {
     version: string;
-    generatedAt: string;
     files: {
         path: string;
         checksum: string;
         size?: number | undefined;
         lastModified?: string | undefined;
     }[];
+    generatedAt: string;
     deletions: string[];
 }, {
     version: string;
-    generatedAt: string;
     files: {
         path: string;
         checksum: string;
         size?: number | undefined;
         lastModified?: string | undefined;
     }[];
+    generatedAt: string;
     deletions?: string[] | undefined;
 }>;
 export type ReleaseManifest = z.infer<typeof ReleaseManifestSchema>;
@@ -72,6 +72,13 @@ export declare class CorruptReleaseManifestError extends Error {
 export declare function readReleaseMetadata(sourceDir: string): ReleaseManifest | null;
 /** Map each release file path to its source commit timestamp (when recorded). */
 export declare function mapPathToLastModified(release: ReleaseManifest | null): Record<string, string>;
+/**
+ * Map each release file path to its incoming payload checksum. Feeds
+ * `buildInstallMetadata`'s `expectedChecksums` so a byte-identical forward copy of
+ * a file that changed between releases is recognized as toolkit-owned rather than
+ * mislabeled `meowkit-modified`.
+ */
+export declare function mapPathToChecksum(release: ReleaseManifest | null): Record<string, string>;
 /**
  * Project a release manifest onto the `Manifest` shape `findOrphans` consumes —
  * only the checksum keys matter for orphan detection.

package/dist/core/release-metadata.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"release-metadata.d.ts","sourceRoot":"","sources":["../../src/core/release-metadata.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;EAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,oFAAoF;AACpF,qBAAa,2BAA4B,SAAQ,KAAK;aACzB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI1C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAY7E;AAED,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAMnE"}
+{"version":3,"file":"release-metadata.d.ts","sourceRoot":"","sources":["../../src/core/release-metadata.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAEvD,eAAO,MAAM,yBAAyB,0BAA0B,CAAC;AAEjE,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;EAKjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAKhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,oFAAoF;AACpF,qBAAa,2BAA4B,SAAQ,KAAK;aACzB,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM;CAI1C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAY7E;AAED,iFAAiF;AACjF,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM7F;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,eAAe,GAAG,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzF;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,eAAe,GAAG,QAAQ,CAMnE"}

package/dist/core/release-metadata.js

@@ -56,6 +56,19 @@ export function mapPathToLastModified(release) {
     }
     return out;
 }
+/**
+ * Map each release file path to its incoming payload checksum. Feeds
+ * `buildInstallMetadata`'s `expectedChecksums` so a byte-identical forward copy of
+ * a file that changed between releases is recognized as toolkit-owned rather than
+ * mislabeled `meowkit-modified`.
+ */
+export function mapPathToChecksum(release) {
+    const out = {};
+    for (const f of release?.files ?? []) {
+        out[f.path] = f.checksum;
+    }
+    return out;
+}
 /**
  * Project a release manifest onto the `Manifest` shape `findOrphans` consumes —
  * only the checksum keys matter for orphan detection.

package/dist/core/release-metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"release-metadata.js","sourceRoot":"","sources":["../../src/core/release-metadata.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,kDAAkD;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACzB;IAA5B,YAA4B,MAAc;QACzC,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;QADvB,WAAM,GAAN,MAAM,CAAQ;QAEzC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC3C,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,2BAA2B,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,2BAA2B,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACpE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,YAAY;YAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACxD,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;AAClF,CAAC"}
+{"version":3,"file":"release-metadata.js","sourceRoot":"","sources":["../../src/core/release-metadata.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,2EAA2E;AAC3E,0EAA0E;AAC1E,kDAAkD;AAClD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,MAAM,CAAC,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAEjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE;IACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,sBAAsB,CAAC;IACtC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC1C,CAAC,CAAC;AAGH,oFAAoF;AACpF,MAAM,OAAO,2BAA4B,SAAQ,KAAK;IACzB;IAA5B,YAA4B,MAAc;QACzC,KAAK,CAAC,kCAAkC,MAAM,EAAE,CAAC,CAAC;QADvB,WAAM,GAAN,MAAM,CAAQ;QAEzC,IAAI,CAAC,IAAI,GAAG,6BAA6B,CAAC;IAC3C,CAAC;CACD;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,SAAiB;IACpD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;IAChE,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,MAAM,IAAI,2BAA2B,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,2BAA2B,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACjF,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,qBAAqB,CAAC,OAA+B;IACpE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,IAAI,CAAC,CAAC,YAAY;YAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA+B;IAChE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC;QACtC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAwB;IACxD,MAAM,SAAS,GAA0B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAC/B,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3D,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC;AAClF,CAAC"}