@agentxm/client-core 0.1.6 → 0.3.1

package/dist/src/unstable/lint/catalog/pack/manifest-keys-recognized.js

@@ -0,0 +1,41 @@
+/**
+ * `pack/manifest-keys-recognized` — `extension-pack.json` contains only keys
+ * declared by `ExtensionPackManifestSchema`.
+ *
+ * The paired `-schema-valid` rule ignores excess properties by construction
+ * (`onExcessProperty: "ignore"`); this rule surfaces them at warning severity
+ * so newer-schema manifests can roll out ahead of registry deploys.
+ *
+ * A forbidden `packs:` dependency section (ONTOLOGY D015 "Cross-Domain
+ * Extension Pack Semantics") decodes as an unrecognized top-level key here
+ * and surfaces at warning severity in v1; there is no dedicated error-severity
+ * rule for the `packs:` case — see `docs/design/lint-engine.md §10.pack
+ * (Notes)`. A stricter error-severity enforcement can ship in v1.5+ if real
+ * publish traffic motivates it.
+ *
+ * Allowed-keys set is derived from `ExtensionPackManifestSchema.fields` — no
+ * copy-paste of field names. A schema gain (or rename) automatically updates
+ * the allowlist.
+ *
+ * Early-return arm (no findings):
+ *
+ * - `subject.packJson === undefined` / non-object — nothing to enumerate;
+ *   `pack/manifest-present` owns the absence case.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+import { ExtensionPackManifestSchema } from "../../../packs/manifest-schema.js";
+import { enumerateUnknownTopLevelKeys, structFieldKeys } from "../shared/schema-rule.js";
+const RULE_ID = "pack/manifest-keys-recognized";
+const EXTENSION_PACK_JSON = "extension-pack.json";
+const allowedKeys = structFieldKeys(ExtensionPackManifestSchema);
+export const manifestKeysRecognizedRule = {
+    id: RULE_ID,
+    description: "extension-pack.json contains only keys recognized by ExtensionPackManifestSchema.",
+    kind: "advisory",
+    severity: "warning",
+    check: (context) => Effect.succeed(enumerateUnknownTopLevelKeys(RULE_ID, "warning", EXTENSION_PACK_JSON, allowedKeys, context.subject.packJson)),
+};
+//# sourceMappingURL=manifest-keys-recognized.js.map

package/dist/src/unstable/lint/catalog/pack/manifest-keys-recognized.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-keys-recognized.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack/manifest-keys-recognized.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAGxC,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAEzF,MAAM,OAAO,GAAG,+BAA+B,CAAC;AAChD,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD,MAAM,WAAW,GAAG,eAAe,CAAC,2BAA2B,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,0BAA0B,GAAkC;IACvE,EAAE,EAAE,OAAO;IACX,WAAW,EAAE,mFAAmF;IAChG,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,SAAS;IACnB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACjB,MAAM,CAAC,OAAO,CACZ,4BAA4B,CAC1B,OAAO,EACP,SAAS,EACT,mBAAmB,EACnB,WAAW,EACX,OAAO,CAAC,OAAO,CAAC,QAAQ,CACzB,CACF;CACJ,CAAC"}

package/dist/src/unstable/lint/catalog/pack/manifest-present.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `pack/manifest-present` — packs must have an `extension-pack.json` at the
+ * pack root.
+ *
+ * Packs are registry-only at v1; every pack context is expected to expose a
+ * manifest. Unlike `skill/manifest-present`, there is no native-vs-non-native
+ * split — the rule applies to every pack context unconditionally.
+ *
+ * Advisory-only — scaffolding a manifest is `axm packs new` (a user-authored
+ * action) per `docs/design/lint-engine.md §10.pack (Notes)`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { PackRuleContext } from "../../context.js";
+import type { AdvisoryRule } from "../../rule.js";
+export declare const manifestPresentRule: AdvisoryRule<PackRuleContext>;
+//# sourceMappingURL=manifest-present.d.ts.map

package/dist/src/unstable/lint/catalog/pack/manifest-present.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-present.d.ts","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack/manifest-present.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAmB,YAAY,EAAE,MAAM,eAAe,CAAC;AAKnE,eAAO,MAAM,mBAAmB,EAAE,YAAY,CAAC,eAAe,CA2B7D,CAAC"}

package/dist/src/unstable/lint/catalog/pack/manifest-present.js

@@ -0,0 +1,41 @@
+/**
+ * `pack/manifest-present` — packs must have an `extension-pack.json` at the
+ * pack root.
+ *
+ * Packs are registry-only at v1; every pack context is expected to expose a
+ * manifest. Unlike `skill/manifest-present`, there is no native-vs-non-native
+ * split — the rule applies to every pack context unconditionally.
+ *
+ * Advisory-only — scaffolding a manifest is `axm packs new` (a user-authored
+ * action) per `docs/design/lint-engine.md §10.pack (Notes)`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+const RULE_ID = "pack/manifest-present";
+const EXTENSION_PACK_JSON = "extension-pack.json";
+export const manifestPresentRule = {
+    id: RULE_ID,
+    description: "Pack has an extension-pack.json manifest at its root.",
+    kind: "advisory",
+    severity: "error",
+    check: (context) => Effect.map(context.files.exists(EXTENSION_PACK_JSON), (present) => {
+        if (present) {
+            return [];
+        }
+        return [
+            {
+                kind: "advisory",
+                ruleId: RULE_ID,
+                severity: "error",
+                message: "extension-pack.json is missing; every pack must expose a manifest at the pack root.",
+                suggestions: [
+                    `Create ${EXTENSION_PACK_JSON} with the required manifest fields (owner, type, name, version).`,
+                ],
+                location: { file: EXTENSION_PACK_JSON },
+            },
+        ];
+    }),
+};
+//# sourceMappingURL=manifest-present.js.map

package/dist/src/unstable/lint/catalog/pack/manifest-present.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-present.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack/manifest-present.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,MAAM,OAAO,GAAG,uBAAuB,CAAC;AACxC,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD,MAAM,CAAC,MAAM,mBAAmB,GAAkC;IAChE,EAAE,EAAE,OAAO;IACX,WAAW,EAAE,uDAAuD;IACpE,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,OAAO;IACjB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACjB,MAAM,CAAC,GAAG,CACR,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,mBAAmB,CAAC,EACzC,CAAC,OAAO,EAAkC,EAAE;QAC1C,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO;YACL;gBACE,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,OAAO;gBACjB,OAAO,EACL,qFAAqF;gBACvF,WAAW,EAAE;oBACX,UAAU,mBAAmB,kEAAkE;iBAChG;gBACD,QAAQ,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE;aACxC;SACF,CAAC;IACJ,CAAC,CACF;CACJ,CAAC"}

package/dist/src/unstable/lint/catalog/pack/manifest-schema-valid.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `pack/manifest-schema-valid` — `extension-pack.json` conforms to
+ * `ExtensionPackManifestSchema`.
+ *
+ * Delegates to Effect Schema per `docs/design/lint-engine.md §4`
+ * ("Schema-valid rules delegate to Effect Schema"). Issues map 1:1 to
+ * findings via `issuesToFindings`.
+ *
+ * Early-return arm (no findings):
+ *
+ * - `subject.packJson === undefined` — manifest is absent (covered by
+ *   `pack/manifest-present`).
+ *
+ * Dependency-map FQN grammar and `VersionConstraint` decode arms are owned by
+ * `ExtensionPackManifestSchema` itself — the dependency sections are typed
+ * `Record<FQN, VersionConstraint>` so unknown FQNs, malformed grammar, and
+ * bad semver ranges surface as normal schema issues through the shared
+ * `schemaDecodeFindings` plumbing.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { PackRuleContext } from "../../context.js";
+import type { AdvisoryRule } from "../../rule.js";
+export declare const manifestSchemaValidRule: AdvisoryRule<PackRuleContext>;
+//# sourceMappingURL=manifest-schema-valid.d.ts.map

package/dist/src/unstable/lint/catalog/pack/manifest-schema-valid.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-schema-valid.d.ts","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack/manifest-schema-valid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAOlD,eAAO,MAAM,uBAAuB,EAAE,YAAY,CAAC,eAAe,CAajE,CAAC"}

package/dist/src/unstable/lint/catalog/pack/manifest-schema-valid.js

@@ -0,0 +1,34 @@
+/**
+ * `pack/manifest-schema-valid` — `extension-pack.json` conforms to
+ * `ExtensionPackManifestSchema`.
+ *
+ * Delegates to Effect Schema per `docs/design/lint-engine.md §4`
+ * ("Schema-valid rules delegate to Effect Schema"). Issues map 1:1 to
+ * findings via `issuesToFindings`.
+ *
+ * Early-return arm (no findings):
+ *
+ * - `subject.packJson === undefined` — manifest is absent (covered by
+ *   `pack/manifest-present`).
+ *
+ * Dependency-map FQN grammar and `VersionConstraint` decode arms are owned by
+ * `ExtensionPackManifestSchema` itself — the dependency sections are typed
+ * `Record<FQN, VersionConstraint>` so unknown FQNs, malformed grammar, and
+ * bad semver ranges surface as normal schema issues through the shared
+ * `schemaDecodeFindings` plumbing.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import { ExtensionPackManifestSchema } from "../../../packs/manifest-schema.js";
+import { schemaDecodeFindings } from "../shared/schema-rule.js";
+const RULE_ID = "pack/manifest-schema-valid";
+const EXTENSION_PACK_JSON = "extension-pack.json";
+export const manifestSchemaValidRule = {
+    id: RULE_ID,
+    description: "extension-pack.json conforms to ExtensionPackManifestSchema.",
+    kind: "advisory",
+    severity: "error",
+    check: (context) => schemaDecodeFindings(RULE_ID, "error", EXTENSION_PACK_JSON, ExtensionPackManifestSchema, context.subject.packJson),
+};
+//# sourceMappingURL=manifest-schema-valid.js.map

package/dist/src/unstable/lint/catalog/pack/manifest-schema-valid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-schema-valid.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack/manifest-schema-valid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAIH,OAAO,EAAE,2BAA2B,EAAE,MAAM,mCAAmC,CAAC;AAChF,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,OAAO,GAAG,4BAA4B,CAAC;AAC7C,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD,MAAM,CAAC,MAAM,uBAAuB,GAAkC;IACpE,EAAE,EAAE,OAAO;IACX,WAAW,EAAE,8DAA8D;IAC3E,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,OAAO;IACjB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACjB,oBAAoB,CAClB,OAAO,EACP,OAAO,EACP,mBAAmB,EACnB,2BAA2B,EAC3B,OAAO,CAAC,OAAO,CAAC,QAAQ,CACzB;CACJ,CAAC"}

package/dist/src/unstable/lint/catalog/pack-accessor/contexts.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `buildPackRuleContexts` — build `PackRuleContext[]` from a
+ * `WorkspaceIndex`-shaped input.
+ *
+ * Phase 3c owns `WorkspaceIndex`; Phase 3b pins the minimal shape
+ * `buildPackRuleContexts` consumes so Phase 3c can satisfy it without
+ * renegotiation. The minimal shape is **exactly** the set of fields the
+ * function reads per installed pack:
+ *
+ * - `packJson` — pre-decoded `extension-pack.json` when present (caller
+ *   decodes once per pack, so rules don't re-read + re-parse).
+ * - `displayRoot` — posix-relative root used by the renderer; the caller
+ *   picks per provenance (see the table below).
+ * - `files` — the pre-bound `PackFileAccessor`. The caller chooses VFT or
+ *   platform-backed.
+ *
+ * Provenance → `displayRoot` table:
+ *
+ * | Surface                            | `displayRoot`                             |
+ * | ---------------------------------- | ----------------------------------------- |
+ * | Publish (Phase 4)                  | `""`                                      |
+ * | Registry-installed pack            | `.axm/extensions/<@owner>/packs/<name>`   |
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { PackFileAccessor, PackRuleContext } from "../../context.js";
+/**
+ * Minimal structural shape `buildPackRuleContexts` needs per installed
+ * pack. Phase 3c's `WorkspaceIndex` satisfies this by construction — its
+ * `installedPacks` field is `ReadonlyArray<InstalledPackInfo>`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface InstalledPackInfo {
+    readonly packJson: unknown;
+    readonly displayRoot: string;
+    readonly files: PackFileAccessor;
+}
+/**
+ * Minimal structural shape of the WorkspaceIndex subset `buildPackRuleContexts`
+ * consumes. Keeping the function input narrow keeps Phase 3b and Phase 3c
+ * decoupled: the index implementation (Phase 3c) can add more methods
+ * without affecting this call site.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface PackIndexView {
+    readonly installedPacks: ReadonlyArray<InstalledPackInfo>;
+}
+/**
+ * Project an index's `installedPacks` into `PackRuleContext`s with their
+ * `displayRoot` and `subject` fields pre-populated.
+ *
+ * Publish callers bypass this helper and construct a single context directly
+ * — they have exactly one pack in play and no workspace.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const buildPackRuleContexts: (index: PackIndexView) => ReadonlyArray<PackRuleContext>;
+//# sourceMappingURL=contexts.d.ts.map

package/dist/src/unstable/lint/catalog/pack-accessor/contexts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contexts.d.ts","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack-accessor/contexts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAM1E;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;CAClC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,cAAc,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;CAC3D;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,GAAI,OAAO,aAAa,KAAG,aAAa,CAAC,eAAe,CASvF,CAAC"}

package/dist/src/unstable/lint/catalog/pack-accessor/contexts.js

@@ -0,0 +1,46 @@
+/**
+ * `buildPackRuleContexts` — build `PackRuleContext[]` from a
+ * `WorkspaceIndex`-shaped input.
+ *
+ * Phase 3c owns `WorkspaceIndex`; Phase 3b pins the minimal shape
+ * `buildPackRuleContexts` consumes so Phase 3c can satisfy it without
+ * renegotiation. The minimal shape is **exactly** the set of fields the
+ * function reads per installed pack:
+ *
+ * - `packJson` — pre-decoded `extension-pack.json` when present (caller
+ *   decodes once per pack, so rules don't re-read + re-parse).
+ * - `displayRoot` — posix-relative root used by the renderer; the caller
+ *   picks per provenance (see the table below).
+ * - `files` — the pre-bound `PackFileAccessor`. The caller chooses VFT or
+ *   platform-backed.
+ *
+ * Provenance → `displayRoot` table:
+ *
+ * | Surface                            | `displayRoot`                             |
+ * | ---------------------------------- | ----------------------------------------- |
+ * | Publish (Phase 4)                  | `""`                                      |
+ * | Registry-installed pack            | `.axm/extensions/<@owner>/packs/<name>`   |
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+// -----------------------------------------------------------------------------
+// buildPackRuleContexts
+// -----------------------------------------------------------------------------
+/**
+ * Project an index's `installedPacks` into `PackRuleContext`s with their
+ * `displayRoot` and `subject` fields pre-populated.
+ *
+ * Publish callers bypass this helper and construct a single context directly
+ * — they have exactly one pack in play and no workspace.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const buildPackRuleContexts = (index) => index.installedPacks.map((info) => ({
+    subject: {
+        packJson: info.packJson,
+    },
+    files: info.files,
+    displayRoot: info.displayRoot,
+}));
+//# sourceMappingURL=contexts.js.map

package/dist/src/unstable/lint/catalog/pack-accessor/contexts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contexts.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack-accessor/contexts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAiCH,gFAAgF;AAChF,wBAAwB;AACxB,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,KAAoB,EAAkC,EAAE,CAC5F,KAAK,CAAC,cAAc,CAAC,GAAG,CACtB,CAAC,IAAI,EAAmB,EAAE,CAAC,CAAC;IAC1B,OAAO,EAAE;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;KACxB;IACD,KAAK,EAAE,IAAI,CAAC,KAAK;IACjB,WAAW,EAAE,IAAI,CAAC,WAAW;CAC9B,CAAC,CACH,CAAC"}

package/dist/src/unstable/lint/catalog/pack-accessor/platform.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Platform-backed `PackFileAccessor` for `axm lint`.
+ *
+ * Maps accessor-relative posix paths to on-disk absolute paths rooted at
+ * the caller-supplied pack-root directory. Layout conventions per
+ * `docs/design/lint-engine.md §3` "Pack accessor root":
+ *
+ * - **Registry-installed:**
+ *   `<workspaceRoot>/.axm/extensions/<@owner>/packs/<sanitized-name>/`
+ *
+ * Packs are registry-only at v1 — there is no non-native variant. The caller
+ * (`buildPackRuleContexts` or the CLI entry point) picks the root from
+ * `computeExtensionPackPaths` in `../../../packs/paths.ts`.
+ *
+ * The `extension-pack.json` sits directly under `canonicalPath`; there is no
+ * `src/` subdirectory like skills have — see
+ * `../../../packs/operations/install.ts` for the authoritative layout.
+ *
+ * Bounds enforcement:
+ *
+ * - No `..` segments in accessor-relative paths.
+ * - No absolute paths (posix or Windows drive letters).
+ * - Resolved absolute paths are verified to stay under the accessor root.
+ *
+ * The accessor is built via a factory that captures a pre-resolved
+ * `FileSystem.FileSystem` + `Path.Path` services and an absolute root, so
+ * `PackFileAccessor` stays Layer-free at rule-evaluation time (per
+ * `lint-engine` spec "Rule contexts expose narrow caller-bound accessors").
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type * as FileSystem from "effect/FileSystem";
+import type * as Path from "effect/Path";
+import type { PackFileAccessor } from "../../context.js";
+/**
+ * Platform services needed by the platform-backed pack accessor.
+ */
+export interface PackAccessorPlatform {
+    readonly fs: FileSystem.FileSystem;
+    readonly path: Path.Path;
+}
+/**
+ * Build a platform-backed `PackFileAccessor` rooted at `absoluteRoot`.
+ *
+ * `absoluteRoot` SHOULD be the absolute path to the pack root directory
+ * (`canonicalPath` from `computeExtensionPackPaths` in
+ * `../../../packs/paths.ts`).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const makePlatformPackFileAccessor: (platform: PackAccessorPlatform, absoluteRoot: string) => PackFileAccessor;
+//# sourceMappingURL=platform.d.ts.map

package/dist/src/unstable/lint/catalog/pack-accessor/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack-accessor/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAGH,OAAO,KAAK,KAAK,UAAU,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAmB,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAM1E;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;CAC1B;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,GACvC,UAAU,oBAAoB,EAC9B,cAAc,MAAM,KACnB,gBA2DF,CAAC"}

package/dist/src/unstable/lint/catalog/pack-accessor/platform.js

@@ -0,0 +1,90 @@
+/**
+ * Platform-backed `PackFileAccessor` for `axm lint`.
+ *
+ * Maps accessor-relative posix paths to on-disk absolute paths rooted at
+ * the caller-supplied pack-root directory. Layout conventions per
+ * `docs/design/lint-engine.md §3` "Pack accessor root":
+ *
+ * - **Registry-installed:**
+ *   `<workspaceRoot>/.axm/extensions/<@owner>/packs/<sanitized-name>/`
+ *
+ * Packs are registry-only at v1 — there is no non-native variant. The caller
+ * (`buildPackRuleContexts` or the CLI entry point) picks the root from
+ * `computeExtensionPackPaths` in `../../../packs/paths.ts`.
+ *
+ * The `extension-pack.json` sits directly under `canonicalPath`; there is no
+ * `src/` subdirectory like skills have — see
+ * `../../../packs/operations/install.ts` for the authoritative layout.
+ *
+ * Bounds enforcement:
+ *
+ * - No `..` segments in accessor-relative paths.
+ * - No absolute paths (posix or Windows drive letters).
+ * - Resolved absolute paths are verified to stay under the accessor root.
+ *
+ * The accessor is built via a factory that captures a pre-resolved
+ * `FileSystem.FileSystem` + `Path.Path` services and an absolute root, so
+ * `PackFileAccessor` stays Layer-free at rule-evaluation time (per
+ * `lint-engine` spec "Rule contexts expose narrow caller-bound accessors").
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+/**
+ * Build a platform-backed `PackFileAccessor` rooted at `absoluteRoot`.
+ *
+ * `absoluteRoot` SHOULD be the absolute path to the pack root directory
+ * (`canonicalPath` from `computeExtensionPackPaths` in
+ * `../../../packs/paths.ts`).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const makePlatformPackFileAccessor = (platform, absoluteRoot) => {
+    const { fs, path } = platform;
+    const normalizedRoot = path.resolve(absoluteRoot);
+    const resolveWithinRoot = (input) => {
+        if (input === "" || input === "." || input === "./") {
+            return { kind: "ok", absolute: normalizedRoot };
+        }
+        if (/^[a-z]:[\\/]/i.test(input) || input.startsWith("/") || input.startsWith("\\")) {
+            return { kind: "escape" };
+        }
+        const normalized = input.replace(/\\/g, "/").replace(/^\.\//, "");
+        for (const segment of normalized.split("/")) {
+            if (segment === "..") {
+                return { kind: "escape" };
+            }
+        }
+        const absolute = path.resolve(normalizedRoot, normalized);
+        if (absolute !== normalizedRoot && !absolute.startsWith(`${normalizedRoot}${path.sep}`)) {
+            return { kind: "escape" };
+        }
+        return { kind: "ok", absolute };
+    };
+    const makeAccessError = (p, reason, message) => ({
+        _tag: "FileAccessError",
+        path: p,
+        reason,
+        message,
+    });
+    return {
+        exists: (p) => {
+            const resolved = resolveWithinRoot(p);
+            if (resolved.kind !== "ok") {
+                return Effect.succeed(false);
+            }
+            return fs.exists(resolved.absolute).pipe(Effect.catch(() => Effect.succeed(false)));
+        },
+        readBytes: (p) => {
+            const resolved = resolveWithinRoot(p);
+            if (resolved.kind === "escape") {
+                return Effect.fail(makeAccessError(p, "path-escape", `path escapes the accessor root: ${p}`));
+            }
+            return fs
+                .readFile(resolved.absolute)
+                .pipe(Effect.mapError((cause) => makeAccessError(p, "read-error", `read failed at ${p}: ${String(cause)}`)));
+        },
+    };
+};
+//# sourceMappingURL=platform.js.map

package/dist/src/unstable/lint/catalog/pack-accessor/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack-accessor/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAqBxC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAC1C,QAA8B,EAC9B,YAAoB,EACF,EAAE;IACpB,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC9B,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElD,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAiB,EAAE;QACzD,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACxF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,CACtB,CAAS,EACT,MAAiC,EACjC,OAAe,EACE,EAAE,CAAC,CAAC;QACrB,IAAI,EAAE,iBAA0B;QAChC,IAAI,EAAE,CAAC;QACP,MAAM;QACN,OAAO;KACR,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YACZ,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,MAAM,CAAC,IAAI,CAChB,eAAe,CAAC,CAAC,EAAE,aAAa,EAAE,mCAAmC,CAAC,EAAE,CAAC,CAC1E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE;iBACN,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAC3B,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,kBAAkB,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAC1E,CACF,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/src/unstable/lint/catalog/pack-accessor/vft.d.ts

@@ -0,0 +1,60 @@
+/**
+ * VFT-backed `PackFileAccessor` for publish callers.
+ *
+ * A Virtual File Tree (VFT) is an in-memory representation of an extracted
+ * archive — the registry publish pipeline extracts an upload into a VFT, then
+ * passes that tree into Phase 4 decode/lint. The VFT's schema and bounds
+ * (max size, file count, path depth) are owned by the registry extract phase
+ * (Phase 4 concern); this accessor treats the tree as a read-only
+ * `path -> Uint8Array` map and enforces its own rooted-read + no-`..`-escape
+ * invariants at the rule boundary.
+ *
+ * Bounds enforcement here:
+ *
+ * - Paths are normalized to posix, `./` prefixes are stripped.
+ * - Empty path resolves to the accessor root itself.
+ * - Any path containing a `..` segment raises `FileAccessError {
+ *   reason: "path-escape" }` from `readBytes` and resolves to `false` from
+ *   `exists`.
+ * - Absolute paths (starting with `/` or a Windows drive letter) are
+ *   treated as escape attempts.
+ *
+ * Mirrors the skill VFT accessor (`../skill-accessor/vft.ts`). The VFTNode
+ * interface is intentionally the same so a publish caller can extract a
+ * single archive once and pass the same tree to either accessor factory.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { PackFileAccessor } from "../../context.js";
+/**
+ * Minimal shape of a Virtual File Tree consumed by the accessor.
+ *
+ * Shape-compatible with `../skill-accessor/vft.ts#VFTNode`; kept as a local
+ * declaration to avoid a cross-subfolder import and to document what this
+ * accessor uses.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface PackVFTNode {
+    /**
+     * Whether the given posix path points to a file within the tree.
+     */
+    readonly hasFile: (posixPath: string) => boolean;
+    /**
+     * Return the bytes for the given posix path, or `undefined` when the path
+     * does not resolve to a file (missing, directory, or outside the tree).
+     */
+    readonly getFile: (posixPath: string) => Uint8Array | undefined;
+}
+/**
+ * Build a VFT-backed `PackFileAccessor` rooted at the tree's root.
+ *
+ * Callers that root the pack at a sub-path of the archive should pre-strip
+ * that sub-path before constructing the tree — the accessor enforces no
+ * `..` escape above the root it was given.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const makeVftPackFileAccessor: (tree: PackVFTNode) => PackFileAccessor;
+//# sourceMappingURL=vft.d.ts.map

package/dist/src/unstable/lint/catalog/pack-accessor/vft.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vft.d.ts","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack-accessor/vft.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,KAAK,EAAmB,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAM1E;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAC;CACjE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,uBAAuB,GAAI,MAAM,WAAW,KAAG,gBAqB3D,CAAC"}

package/dist/src/unstable/lint/catalog/pack-accessor/vft.js

@@ -0,0 +1,85 @@
+/**
+ * VFT-backed `PackFileAccessor` for publish callers.
+ *
+ * A Virtual File Tree (VFT) is an in-memory representation of an extracted
+ * archive — the registry publish pipeline extracts an upload into a VFT, then
+ * passes that tree into Phase 4 decode/lint. The VFT's schema and bounds
+ * (max size, file count, path depth) are owned by the registry extract phase
+ * (Phase 4 concern); this accessor treats the tree as a read-only
+ * `path -> Uint8Array` map and enforces its own rooted-read + no-`..`-escape
+ * invariants at the rule boundary.
+ *
+ * Bounds enforcement here:
+ *
+ * - Paths are normalized to posix, `./` prefixes are stripped.
+ * - Empty path resolves to the accessor root itself.
+ * - Any path containing a `..` segment raises `FileAccessError {
+ *   reason: "path-escape" }` from `readBytes` and resolves to `false` from
+ *   `exists`.
+ * - Absolute paths (starting with `/` or a Windows drive letter) are
+ *   treated as escape attempts.
+ *
+ * Mirrors the skill VFT accessor (`../skill-accessor/vft.ts`). The VFTNode
+ * interface is intentionally the same so a publish caller can extract a
+ * single archive once and pass the same tree to either accessor factory.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+/**
+ * Build a VFT-backed `PackFileAccessor` rooted at the tree's root.
+ *
+ * Callers that root the pack at a sub-path of the archive should pre-strip
+ * that sub-path before constructing the tree — the accessor enforces no
+ * `..` escape above the root it was given.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const makeVftPackFileAccessor = (tree) => {
+    return {
+        exists: (path) => {
+            const normalized = normalizeAndCheck(path);
+            if (normalized.kind !== "ok") {
+                return Effect.succeed(false);
+            }
+            return Effect.succeed(tree.hasFile(normalized.path));
+        },
+        readBytes: (path) => {
+            const normalized = normalizeAndCheck(path);
+            if (normalized.kind === "escape") {
+                return failFileAccess(path, "path-escape", `path escapes the accessor root: ${path}`);
+            }
+            const bytes = tree.getFile(normalized.path);
+            if (bytes === undefined) {
+                return failFileAccess(path, "read-error", `file not found at ${path}`);
+            }
+            return Effect.succeed(bytes);
+        },
+    };
+};
+const normalizeAndCheck = (path) => {
+    if (path === "" || path === "." || path === "./") {
+        return { kind: "ok", path: "" };
+    }
+    // Windows drive letters (`C:/`) and absolute posix paths both count as
+    // escape attempts at a pack-rooted accessor.
+    if (/^[a-z]:[\\/]/i.test(path) || path.startsWith("/") || path.startsWith("\\")) {
+        return { kind: "escape" };
+    }
+    const normalized = path.replace(/\\/g, "/").replace(/^\.\//, "");
+    const segments = normalized.split("/");
+    for (const segment of segments) {
+        if (segment === "..") {
+            return { kind: "escape" };
+        }
+    }
+    return { kind: "ok", path: normalized };
+};
+const failFileAccess = (path, reason, message) => Effect.fail({
+    _tag: "FileAccessError",
+    path,
+    reason,
+    message,
+});
+//# sourceMappingURL=vft.js.map

package/dist/src/unstable/lint/catalog/pack-accessor/vft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vft.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/pack-accessor/vft.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AA4BxC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,IAAiB,EAAoB,EAAE;IAC7E,OAAO;QACL,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACf,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAClB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,mCAAmC,IAAI,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAmB,EAAE;IAC1D,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC;IACD,uEAAuE;IACvE,6CAA6C;IAC7C,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,IAAY,EACZ,MAAiC,EACjC,OAAe,EAC6B,EAAE,CAC9C,MAAM,CAAC,IAAI,CAAC;IACV,IAAI,EAAE,iBAA0B;IAChC,IAAI;IACJ,MAAM;IACN,OAAO;CACR,CAAC,CAAC"}