@agentxm/client-core 0.1.6 → 0.3.1

package/dist/src/unstable/lint/catalog/skill/manifest-schema-valid.js

@@ -0,0 +1,37 @@
+/**
+ * `skill/manifest-schema-valid` — `skill.json` conforms to
+ * `SkillManifestSchema`.
+ *
+ * Delegates to Effect Schema per `docs/design/lint-engine.md §4`
+ * ("Schema-valid rules delegate to Effect Schema"). Issues map 1:1 to
+ * findings via `issuesToFindings`.
+ *
+ * Early-return arms (no findings):
+ *
+ * - `subject.isNative === false` — non-native skills have no manifest to
+ *   check (complement of `skill/manifest-present`).
+ * - `subject.skillJson === undefined` — manifest is absent (covered by
+ *   `skill/manifest-present`).
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import { SkillManifestSchema } from "../../../skills/manifest-schema.js";
+import { schemaDecodeFindings } from "../shared/schema-rule.js";
+const RULE_ID = "skill/manifest-schema-valid";
+const SKILL_JSON = "skill.json";
+export const manifestSchemaValidRule = {
+    id: RULE_ID,
+    description: "skill.json conforms to SkillManifestSchema.",
+    kind: "advisory",
+    severity: "error",
+    check: (context) => {
+        if (!context.subject.isNative) {
+            // Non-native skills have no skill.json to schema-validate. The
+            // presence rule (manifest-present) does not fire for non-native either.
+            return schemaDecodeFindings(RULE_ID, "error", SKILL_JSON, SkillManifestSchema, undefined);
+        }
+        return schemaDecodeFindings(RULE_ID, "error", SKILL_JSON, SkillManifestSchema, context.subject.skillJson);
+    },
+};
+//# sourceMappingURL=manifest-schema-valid.js.map

package/dist/src/unstable/lint/catalog/skill/manifest-schema-valid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest-schema-valid.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/skill/manifest-schema-valid.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE,MAAM,OAAO,GAAG,6BAA6B,CAAC;AAC9C,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC,MAAM,CAAC,MAAM,uBAAuB,GAAmC;IACrE,EAAE,EAAE,OAAO;IACX,WAAW,EAAE,6CAA6C;IAC1D,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,OAAO;IACjB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE;QACjB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC9B,+DAA+D;YAC/D,wEAAwE;YACxE,OAAO,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,oBAAoB,CACzB,OAAO,EACP,OAAO,EACP,UAAU,EACV,mBAAmB,EACnB,OAAO,CAAC,OAAO,CAAC,SAAS,CAC1B,CAAC;IACJ,CAAC;CACF,CAAC"}

package/dist/src/unstable/lint/catalog/skill/skill-md-present.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `skill/skill-md-present` — every skill must have a `SKILL.md` at its root.
+ *
+ * Applies to every skill context (native and non-native). Upstream-required
+ * by the agentskills specification; also the precondition for the
+ * `skill/frontmatter-parseable` cascade.
+ *
+ * Advisory-only (no autofix). Scaffolding `SKILL.md` is a user-authored action
+ * per `docs/design/lint-engine.md §6`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { SkillRuleContext } from "../../context.js";
+import type { AdvisoryRule } from "../../rule.js";
+export declare const skillMdPresentRule: AdvisoryRule<SkillRuleContext>;
+//# sourceMappingURL=skill-md-present.d.ts.map

package/dist/src/unstable/lint/catalog/skill/skill-md-present.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-md-present.d.ts","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/skill/skill-md-present.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAmB,YAAY,EAAE,MAAM,eAAe,CAAC;AAKnE,eAAO,MAAM,kBAAkB,EAAE,YAAY,CAAC,gBAAgB,CAqB7D,CAAC"}

package/dist/src/unstable/lint/catalog/skill/skill-md-present.js

@@ -0,0 +1,38 @@
+/**
+ * `skill/skill-md-present` — every skill must have a `SKILL.md` at its root.
+ *
+ * Applies to every skill context (native and non-native). Upstream-required
+ * by the agentskills specification; also the precondition for the
+ * `skill/frontmatter-parseable` cascade.
+ *
+ * Advisory-only (no autofix). Scaffolding `SKILL.md` is a user-authored action
+ * per `docs/design/lint-engine.md §6`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+const RULE_ID = "skill/skill-md-present";
+const SKILL_MD = "SKILL.md";
+export const skillMdPresentRule = {
+    id: RULE_ID,
+    description: "Skill has a SKILL.md at its root.",
+    kind: "advisory",
+    severity: "error",
+    check: (context) => Effect.map(context.files.exists(SKILL_MD), (present) => {
+        if (present) {
+            return [];
+        }
+        return [
+            {
+                kind: "advisory",
+                ruleId: RULE_ID,
+                severity: "error",
+                message: "SKILL.md is missing; every skill must expose a SKILL.md at its root.",
+                suggestions: [`Create ${SKILL_MD} with required frontmatter (name, description).`],
+                location: { file: SKILL_MD },
+            },
+        ];
+    }),
+};
+//# sourceMappingURL=skill-md-present.js.map

package/dist/src/unstable/lint/catalog/skill/skill-md-present.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-md-present.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/skill/skill-md-present.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAIxC,MAAM,OAAO,GAAG,wBAAwB,CAAC;AACzC,MAAM,QAAQ,GAAG,UAAU,CAAC;AAE5B,MAAM,CAAC,MAAM,kBAAkB,GAAmC;IAChE,EAAE,EAAE,OAAO;IACX,WAAW,EAAE,mCAAmC;IAChD,IAAI,EAAE,UAAU;IAChB,QAAQ,EAAE,OAAO;IACjB,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CACjB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAkC,EAAE;QACrF,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,OAAO;YACL;gBACE,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,sEAAsE;gBAC/E,WAAW,EAAE,CAAC,UAAU,QAAQ,iDAAiD,CAAC;gBAClF,QAAQ,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;aAC7B;SACF,CAAC;IACJ,CAAC,CAAC;CACL,CAAC"}

package/dist/src/unstable/lint/catalog/skill-accessor/contexts.d.ts

@@ -0,0 +1,65 @@
+/**
+ * `buildSkillRuleContexts` — build `SkillRuleContext[]` from a
+ * `WorkspaceIndex`-shaped input.
+ *
+ * Phase 3c owns `WorkspaceIndex`; Phase 3a pins the minimal shape
+ * `buildSkillRuleContexts` consumes so Phase 3c can satisfy it without
+ * renegotiation. The minimal shape is **exactly** the set of fields the
+ * function reads per installed skill:
+ *
+ * - `isNative` — whether the skill is expected to expose `skill.json`
+ *   (registry-installed natives: `true`; managed external: `false`).
+ * - `skillJson` — pre-decoded `skill.json` when present (caller decodes
+ *   once per skill, so rules don't re-read + re-parse).
+ * - `displayRoot` — posix-relative root used by the renderer; the caller
+ *   picks per provenance (see the table below).
+ * - `files` — the pre-bound `SkillFileAccessor`. The caller chooses VFT or
+ *   platform-backed.
+ *
+ * Provenance → `displayRoot` table:
+ *
+ * | Surface                                   | `displayRoot`                                 |
+ * | ----------------------------------------- | --------------------------------------------- |
+ * | Publish (Phase 4)                         | `""`                                          |
+ * | Registry-installed native skill           | `.axm/extensions/<@owner>/skills/<name>/src`  |
+ * | External skill                            | `.axm/extensions/external/skills/<name>`      |
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { SkillFileAccessor, SkillRuleContext } from "../../context.js";
+/**
+ * Minimal structural shape `buildSkillRuleContexts` needs per installed
+ * skill. Phase 3c's `WorkspaceIndex` satisfies this by construction — its
+ * `installedSkills` field is `ReadonlyArray<InstalledSkillInfo>`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface InstalledSkillInfo {
+    readonly isNative: boolean;
+    readonly skillJson: unknown;
+    readonly displayRoot: string;
+    readonly files: SkillFileAccessor;
+}
+/**
+ * Minimal structural shape of the WorkspaceIndex subset `buildSkillRuleContexts`
+ * consumes. Keeping the function input narrow keeps Phase 3a and Phase 3c
+ * decoupled: the index implementation (Phase 3c) can add more methods
+ * without affecting this call site.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface SkillIndexView {
+    readonly installedSkills: ReadonlyArray<InstalledSkillInfo>;
+}
+/**
+ * Project an index's `installedSkills` into `SkillRuleContext`s with their
+ * `displayRoot` and `subject` fields pre-populated.
+ *
+ * Publish callers bypass this helper and construct a single context directly
+ * — they have exactly one skill in play and no workspace.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const buildSkillRuleContexts: (index: SkillIndexView) => ReadonlyArray<SkillRuleContext>;
+//# sourceMappingURL=contexts.d.ts.map

package/dist/src/unstable/lint/catalog/skill-accessor/contexts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contexts.d.ts","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/skill-accessor/contexts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAM5E;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,eAAe,EAAE,aAAa,CAAC,kBAAkB,CAAC,CAAC;CAC7D;AAMD;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,GAAI,OAAO,cAAc,KAAG,aAAa,CAAC,gBAAgB,CAU1F,CAAC"}

package/dist/src/unstable/lint/catalog/skill-accessor/contexts.js

@@ -0,0 +1,50 @@
+/**
+ * `buildSkillRuleContexts` — build `SkillRuleContext[]` from a
+ * `WorkspaceIndex`-shaped input.
+ *
+ * Phase 3c owns `WorkspaceIndex`; Phase 3a pins the minimal shape
+ * `buildSkillRuleContexts` consumes so Phase 3c can satisfy it without
+ * renegotiation. The minimal shape is **exactly** the set of fields the
+ * function reads per installed skill:
+ *
+ * - `isNative` — whether the skill is expected to expose `skill.json`
+ *   (registry-installed natives: `true`; managed external: `false`).
+ * - `skillJson` — pre-decoded `skill.json` when present (caller decodes
+ *   once per skill, so rules don't re-read + re-parse).
+ * - `displayRoot` — posix-relative root used by the renderer; the caller
+ *   picks per provenance (see the table below).
+ * - `files` — the pre-bound `SkillFileAccessor`. The caller chooses VFT or
+ *   platform-backed.
+ *
+ * Provenance → `displayRoot` table:
+ *
+ * | Surface                                   | `displayRoot`                                 |
+ * | ----------------------------------------- | --------------------------------------------- |
+ * | Publish (Phase 4)                         | `""`                                          |
+ * | Registry-installed native skill           | `.axm/extensions/<@owner>/skills/<name>/src`  |
+ * | External skill                            | `.axm/extensions/external/skills/<name>`      |
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+// -----------------------------------------------------------------------------
+// buildSkillRuleContexts
+// -----------------------------------------------------------------------------
+/**
+ * Project an index's `installedSkills` into `SkillRuleContext`s with their
+ * `displayRoot` and `subject` fields pre-populated.
+ *
+ * Publish callers bypass this helper and construct a single context directly
+ * — they have exactly one skill in play and no workspace.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const buildSkillRuleContexts = (index) => index.installedSkills.map((info) => ({
+    subject: {
+        isNative: info.isNative,
+        skillJson: info.skillJson,
+    },
+    files: info.files,
+    displayRoot: info.displayRoot,
+}));
+//# sourceMappingURL=contexts.js.map

package/dist/src/unstable/lint/catalog/skill-accessor/contexts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contexts.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/skill-accessor/contexts.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAkCH,gFAAgF;AAChF,yBAAyB;AACzB,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,KAAqB,EAAmC,EAAE,CAC/F,KAAK,CAAC,eAAe,CAAC,GAAG,CACvB,CAAC,IAAI,EAAoB,EAAE,CAAC,CAAC;IAC3B,OAAO,EAAE;QACP,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,SAAS,EAAE,IAAI,CAAC,SAAS;KAC1B;IACD,KAAK,EAAE,IAAI,CAAC,KAAK;IACjB,WAAW,EAAE,IAAI,CAAC,WAAW;CAC9B,CAAC,CACH,CAAC"}

package/dist/src/unstable/lint/catalog/skill-accessor/platform.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Platform-backed `SkillFileAccessor` for `axm lint`.
+ *
+ * Maps accessor-relative posix paths to on-disk absolute paths rooted at
+ * the caller-supplied skill-root directory. Layout conventions per
+ * `docs/design/lint-engine.md §3` "Skill accessor root":
+ *
+ * - **Native (registry-installed):**
+ *   `<workspaceRoot>/.axm/extensions/<@owner>/skills/<sanitized-name>/src/`
+ * - **Non-native (managed external):**
+ *   `<workspaceRoot>/.axm/extensions/external/skills/<sanitized-name>/`
+ *
+ * The accessor is provenance-agnostic — rules see one uniform contract and
+ * never branch on native-vs-non-native. The caller (`buildSkillRuleContexts`
+ * or the CLI entry point) picks the root.
+ *
+ * Bounds enforcement:
+ *
+ * - No `..` segments in accessor-relative paths.
+ * - No absolute paths (posix or Windows drive letters).
+ * - Resolved absolute paths are verified to stay under the accessor root.
+ *
+ * The accessor is built via a factory that captures a pre-resolved
+ * `FileSystem.FileSystem` + `Path.Path` services and an absolute root, so
+ * `SkillFileAccessor` stays Layer-free at rule-evaluation time (per
+ * `lint-engine` spec "Rule contexts expose narrow caller-bound accessors").
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type * as FileSystem from "effect/FileSystem";
+import type * as Path from "effect/Path";
+import type { SkillFileAccessor } from "../../context.js";
+/**
+ * Platform services needed by the platform-backed skill accessor.
+ */
+export interface SkillAccessorPlatform {
+    readonly fs: FileSystem.FileSystem;
+    readonly path: Path.Path;
+}
+/**
+ * Build a platform-backed `SkillFileAccessor` rooted at `absoluteRoot`.
+ *
+ * `absoluteRoot` SHOULD be the absolute path to the skill root directory
+ * (either `.../src/` for native, or `.../external/skills/<name>/` for
+ * non-native). The caller typically sources it from `computeSkillPaths` in
+ * `../../../skills/paths.ts`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const makePlatformSkillFileAccessor: (platform: SkillAccessorPlatform, absoluteRoot: string) => SkillFileAccessor;
+//# sourceMappingURL=platform.d.ts.map

package/dist/src/unstable/lint/catalog/skill-accessor/platform.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.d.ts","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/skill-accessor/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAGH,OAAO,KAAK,KAAK,UAAU,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,EAAmB,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAM3E;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,EAAE,EAAE,UAAU,CAAC,UAAU,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC;CAC1B;AAMD;;;;;;;;;GASG;AACH,eAAO,MAAM,6BAA6B,GACxC,UAAU,qBAAqB,EAC/B,cAAc,MAAM,KACnB,iBA2DF,CAAC"}

package/dist/src/unstable/lint/catalog/skill-accessor/platform.js

@@ -0,0 +1,89 @@
+/**
+ * Platform-backed `SkillFileAccessor` for `axm lint`.
+ *
+ * Maps accessor-relative posix paths to on-disk absolute paths rooted at
+ * the caller-supplied skill-root directory. Layout conventions per
+ * `docs/design/lint-engine.md §3` "Skill accessor root":
+ *
+ * - **Native (registry-installed):**
+ *   `<workspaceRoot>/.axm/extensions/<@owner>/skills/<sanitized-name>/src/`
+ * - **Non-native (managed external):**
+ *   `<workspaceRoot>/.axm/extensions/external/skills/<sanitized-name>/`
+ *
+ * The accessor is provenance-agnostic — rules see one uniform contract and
+ * never branch on native-vs-non-native. The caller (`buildSkillRuleContexts`
+ * or the CLI entry point) picks the root.
+ *
+ * Bounds enforcement:
+ *
+ * - No `..` segments in accessor-relative paths.
+ * - No absolute paths (posix or Windows drive letters).
+ * - Resolved absolute paths are verified to stay under the accessor root.
+ *
+ * The accessor is built via a factory that captures a pre-resolved
+ * `FileSystem.FileSystem` + `Path.Path` services and an absolute root, so
+ * `SkillFileAccessor` stays Layer-free at rule-evaluation time (per
+ * `lint-engine` spec "Rule contexts expose narrow caller-bound accessors").
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+/**
+ * Build a platform-backed `SkillFileAccessor` rooted at `absoluteRoot`.
+ *
+ * `absoluteRoot` SHOULD be the absolute path to the skill root directory
+ * (either `.../src/` for native, or `.../external/skills/<name>/` for
+ * non-native). The caller typically sources it from `computeSkillPaths` in
+ * `../../../skills/paths.ts`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const makePlatformSkillFileAccessor = (platform, absoluteRoot) => {
+    const { fs, path } = platform;
+    const normalizedRoot = path.resolve(absoluteRoot);
+    const resolveWithinRoot = (input) => {
+        if (input === "" || input === "." || input === "./") {
+            return { kind: "ok", absolute: normalizedRoot };
+        }
+        if (/^[a-z]:[\\/]/i.test(input) || input.startsWith("/") || input.startsWith("\\")) {
+            return { kind: "escape" };
+        }
+        const normalized = input.replace(/\\/g, "/").replace(/^\.\//, "");
+        for (const segment of normalized.split("/")) {
+            if (segment === "..") {
+                return { kind: "escape" };
+            }
+        }
+        const absolute = path.resolve(normalizedRoot, normalized);
+        if (absolute !== normalizedRoot && !absolute.startsWith(`${normalizedRoot}${path.sep}`)) {
+            return { kind: "escape" };
+        }
+        return { kind: "ok", absolute };
+    };
+    const makeAccessError = (p, reason, message) => ({
+        _tag: "FileAccessError",
+        path: p,
+        reason,
+        message,
+    });
+    return {
+        exists: (p) => {
+            const resolved = resolveWithinRoot(p);
+            if (resolved.kind !== "ok") {
+                return Effect.succeed(false);
+            }
+            return fs.exists(resolved.absolute).pipe(Effect.catch(() => Effect.succeed(false)));
+        },
+        readBytes: (p) => {
+            const resolved = resolveWithinRoot(p);
+            if (resolved.kind === "escape") {
+                return Effect.fail(makeAccessError(p, "path-escape", `path escapes the accessor root: ${p}`));
+            }
+            return fs
+                .readFile(resolved.absolute)
+                .pipe(Effect.mapError((cause) => makeAccessError(p, "read-error", `read failed at ${p}: ${String(cause)}`)));
+        },
+    };
+};
+//# sourceMappingURL=platform.js.map

package/dist/src/unstable/lint/catalog/skill-accessor/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/skill-accessor/platform.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAqBxC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,QAA+B,EAC/B,YAAoB,EACD,EAAE;IACrB,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC;IAC9B,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAElD,MAAM,iBAAiB,GAAG,CAAC,KAAa,EAAiB,EAAE;QACzD,IAAI,KAAK,KAAK,EAAE,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACpD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACnF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;gBACrB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;QAC1D,IAAI,QAAQ,KAAK,cAAc,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;YACxF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,CACtB,CAAS,EACT,MAAiC,EACjC,OAAe,EACE,EAAE,CAAC,CAAC;QACrB,IAAI,EAAE,iBAA0B;QAChC,IAAI,EAAE,CAAC;QACP,MAAM;QACN,OAAO;KACR,CAAC,CAAC;IAEH,OAAO;QACL,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE;YACZ,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC3B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;YACf,MAAM,QAAQ,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;YACtC,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC/B,OAAO,MAAM,CAAC,IAAI,CAChB,eAAe,CAAC,CAAC,EAAE,aAAa,EAAE,mCAAmC,CAAC,EAAE,CAAC,CAC1E,CAAC;YACJ,CAAC;YACD,OAAO,EAAE;iBACN,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAC3B,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,kBAAkB,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAC1E,CACF,CAAC;QACN,CAAC;KACF,CAAC;AACJ,CAAC,CAAC"}

package/dist/src/unstable/lint/catalog/skill-accessor/vft.d.ts

@@ -0,0 +1,58 @@
+/**
+ * VFT-backed `SkillFileAccessor` for publish callers.
+ *
+ * A Virtual File Tree (VFT) is an in-memory representation of an extracted
+ * archive — the registry publish pipeline extracts an upload into a VFT, then
+ * passes that tree into Phase 4 decode/lint. The VFT's schema and bounds
+ * (max size, file count, path depth) are owned by the registry extract phase
+ * (Phase 4 concern); this accessor treats the tree as a read-only
+ * `path -> Uint8Array` map and enforces its own rooted-read + no-`..`-escape
+ * invariants at the rule boundary.
+ *
+ * Bounds enforcement here:
+ *
+ * - Paths are normalized to posix, `./` prefixes are stripped.
+ * - Empty path resolves to the accessor root itself (useful for
+ *   `location.file = ""` findings but not currently exercised by the v1
+ *   catalog).
+ * - Any path containing a `..` segment raises `FileAccessError {
+ *   reason: "path-escape" }` from `readBytes` and resolves to `false` from
+ *   `exists`.
+ * - Absolute paths (starting with `/` or a Windows drive letter) are
+ *   treated as escape attempts.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { SkillFileAccessor } from "../../context.js";
+/**
+ * Minimal shape of a Virtual File Tree consumed by the accessor.
+ *
+ * The registry VFT (Phase 4, this-repo) MUST satisfy this interface. The
+ * registry may (and will) expose additional methods — file count, archive
+ * bounds, iteration — but those are the extract phase's concern.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface VFTNode {
+    /**
+     * Whether the given posix path points to a file within the tree.
+     */
+    readonly hasFile: (posixPath: string) => boolean;
+    /**
+     * Return the bytes for the given posix path, or `undefined` when the path
+     * does not resolve to a file (missing, directory, or outside the tree).
+     */
+    readonly getFile: (posixPath: string) => Uint8Array | undefined;
+}
+/**
+ * Build a VFT-backed `SkillFileAccessor` rooted at the tree's root.
+ *
+ * Callers that root the skill at a sub-path of the archive should pre-strip
+ * that sub-path before constructing the tree — the accessor enforces no
+ * `..` escape above the root it was given.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const makeVftSkillFileAccessor: (tree: VFTNode) => SkillFileAccessor;
+//# sourceMappingURL=vft.d.ts.map

package/dist/src/unstable/lint/catalog/skill-accessor/vft.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vft.d.ts","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/skill-accessor/vft.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAGH,OAAO,KAAK,EAAmB,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAM3E;;;;;;;;GAQG;AACH,MAAM,WAAW,OAAO;IACtB;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,UAAU,GAAG,SAAS,CAAC;CACjE;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,wBAAwB,GAAI,MAAM,OAAO,KAAG,iBAqBxD,CAAC"}

package/dist/src/unstable/lint/catalog/skill-accessor/vft.js

@@ -0,0 +1,83 @@
+/**
+ * VFT-backed `SkillFileAccessor` for publish callers.
+ *
+ * A Virtual File Tree (VFT) is an in-memory representation of an extracted
+ * archive — the registry publish pipeline extracts an upload into a VFT, then
+ * passes that tree into Phase 4 decode/lint. The VFT's schema and bounds
+ * (max size, file count, path depth) are owned by the registry extract phase
+ * (Phase 4 concern); this accessor treats the tree as a read-only
+ * `path -> Uint8Array` map and enforces its own rooted-read + no-`..`-escape
+ * invariants at the rule boundary.
+ *
+ * Bounds enforcement here:
+ *
+ * - Paths are normalized to posix, `./` prefixes are stripped.
+ * - Empty path resolves to the accessor root itself (useful for
+ *   `location.file = ""` findings but not currently exercised by the v1
+ *   catalog).
+ * - Any path containing a `..` segment raises `FileAccessError {
+ *   reason: "path-escape" }` from `readBytes` and resolves to `false` from
+ *   `exists`.
+ * - Absolute paths (starting with `/` or a Windows drive letter) are
+ *   treated as escape attempts.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+/**
+ * Build a VFT-backed `SkillFileAccessor` rooted at the tree's root.
+ *
+ * Callers that root the skill at a sub-path of the archive should pre-strip
+ * that sub-path before constructing the tree — the accessor enforces no
+ * `..` escape above the root it was given.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const makeVftSkillFileAccessor = (tree) => {
+    return {
+        exists: (path) => {
+            const normalized = normalizeAndCheck(path);
+            if (normalized.kind !== "ok") {
+                return Effect.succeed(false);
+            }
+            return Effect.succeed(tree.hasFile(normalized.path));
+        },
+        readBytes: (path) => {
+            const normalized = normalizeAndCheck(path);
+            if (normalized.kind === "escape") {
+                return failFileAccess(path, "path-escape", `path escapes the accessor root: ${path}`);
+            }
+            const bytes = tree.getFile(normalized.path);
+            if (bytes === undefined) {
+                return failFileAccess(path, "read-error", `file not found at ${path}`);
+            }
+            return Effect.succeed(bytes);
+        },
+    };
+};
+const normalizeAndCheck = (path) => {
+    if (path === "" || path === "." || path === "./") {
+        return { kind: "ok", path: "" };
+    }
+    // Windows drive letters (`C:/`) and absolute posix paths both count as
+    // escape attempts at a skill-rooted accessor.
+    if (/^[a-z]:[\\/]/i.test(path) || path.startsWith("/") || path.startsWith("\\")) {
+        return { kind: "escape" };
+    }
+    const normalized = path.replace(/\\/g, "/").replace(/^\.\//, "");
+    const segments = normalized.split("/");
+    for (const segment of segments) {
+        if (segment === "..") {
+            return { kind: "escape" };
+        }
+    }
+    return { kind: "ok", path: normalized };
+};
+const failFileAccess = (path, reason, message) => Effect.fail({
+    _tag: "FileAccessError",
+    path,
+    reason,
+    message,
+});
+//# sourceMappingURL=vft.js.map

package/dist/src/unstable/lint/catalog/skill-accessor/vft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vft.js","sourceRoot":"","sources":["../../../../../../src/unstable/lint/catalog/skill-accessor/vft.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AA4BxC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAa,EAAqB,EAAE;IAC3E,OAAO;QACL,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACf,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,UAAU,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBAC7B,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,CAAC;QACD,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YAClB,MAAM,UAAU,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACjC,OAAO,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,mCAAmC,IAAI,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,OAAO,cAAc,CAAC,IAAI,EAAE,YAAY,EAAE,qBAAqB,IAAI,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,OAAO,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;KACF,CAAC;AACJ,CAAC,CAAC;AAQF,MAAM,iBAAiB,GAAG,CAAC,IAAY,EAAmB,EAAE;IAC1D,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAClC,CAAC;IACD,uEAAuE;IACvE,8CAA8C;IAC9C,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACjE,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC1C,CAAC,CAAC;AAEF,MAAM,cAAc,GAAG,CACrB,IAAY,EACZ,MAAiC,EACjC,OAAe,EAC6B,EAAE,CAC9C,MAAM,CAAC,IAAI,CAAC;IACV,IAAI,EAAE,iBAA0B;IAChC,IAAI;IACJ,MAAM;IACN,OAAO;CACR,CAAC,CAAC"}

package/dist/src/unstable/lint/catalog/skill.d.ts

@@ -0,0 +1,38 @@
+/**
+ * `skill/*` rule catalog — the v1 five-rule set.
+ *
+ * Per `docs/design/lint-engine.md §10.skill`, registry publish and `axm lint`
+ * run exactly these rules against each skill context:
+ *
+ * | ID                               | Severity | Autofix |
+ * | -------------------------------- | -------- | ------- |
+ * | `skill/skill-md-present`         | error    | —       |
+ * | `skill/manifest-present`         | error    | —       |
+ * | `skill/frontmatter-parseable`    | error    | —       |
+ * | `skill/manifest-schema-valid`    | error    | —       |
+ * | `skill/manifest-keys-recognized` | warning  | —       |
+ *
+ * All five ship `kind: "advisory"`. Native-vs-non-native applicability is
+ * expressed via `check` early-return (no separate `applies` predicate); see
+ * each rule's module for the guard.
+ *
+ * Rule ids are **registered with the lint config allowlist at module-load
+ * time**, so importing this catalog extends the set of accepted
+ * `.axm/settings.json` `lint.rules` keys. Consumers that never import the
+ * catalog (the registry Worker bundle for `pack`-only routes, e.g.) don't pay
+ * the registration cost.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { LintRule } from "../rule.js";
+import type { SkillRuleContext } from "../context.js";
+/**
+ * Ordered v1 `skill/*` rule catalog. Declaration order is the evaluation
+ * order within a single `evaluateContexts` call (deterministic ordering is
+ * test-observable; see `evaluate.ts`).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const skillRules: ReadonlyArray<LintRule<SkillRuleContext>>;
+//# sourceMappingURL=skill.d.ts.map

package/dist/src/unstable/lint/catalog/skill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.d.ts","sourceRoot":"","sources":["../../../../../src/unstable/lint/catalog/skill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAOtD;;;;;;GAMG;AACH,eAAO,MAAM,UAAU,EAAE,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAMhE,CAAC"}

package/dist/src/unstable/lint/catalog/skill.js

@@ -0,0 +1,52 @@
+/**
+ * `skill/*` rule catalog — the v1 five-rule set.
+ *
+ * Per `docs/design/lint-engine.md §10.skill`, registry publish and `axm lint`
+ * run exactly these rules against each skill context:
+ *
+ * | ID                               | Severity | Autofix |
+ * | -------------------------------- | -------- | ------- |
+ * | `skill/skill-md-present`         | error    | —       |
+ * | `skill/manifest-present`         | error    | —       |
+ * | `skill/frontmatter-parseable`    | error    | —       |
+ * | `skill/manifest-schema-valid`    | error    | —       |
+ * | `skill/manifest-keys-recognized` | warning  | —       |
+ *
+ * All five ship `kind: "advisory"`. Native-vs-non-native applicability is
+ * expressed via `check` early-return (no separate `applies` predicate); see
+ * each rule's module for the guard.
+ *
+ * Rule ids are **registered with the lint config allowlist at module-load
+ * time**, so importing this catalog extends the set of accepted
+ * `.axm/settings.json` `lint.rules` keys. Consumers that never import the
+ * catalog (the registry Worker bundle for `pack`-only routes, e.g.) don't pay
+ * the registration cost.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import { registerLintRuleIds } from "../config.js";
+import { skillMdPresentRule } from "./skill/skill-md-present.js";
+import { manifestPresentRule } from "./skill/manifest-present.js";
+import { frontmatterParseableRule } from "./skill/frontmatter-parseable.js";
+import { manifestSchemaValidRule } from "./skill/manifest-schema-valid.js";
+import { manifestKeysRecognizedRule } from "./skill/manifest-keys-recognized.js";
+/**
+ * Ordered v1 `skill/*` rule catalog. Declaration order is the evaluation
+ * order within a single `evaluateContexts` call (deterministic ordering is
+ * test-observable; see `evaluate.ts`).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const skillRules = [
+    skillMdPresentRule,
+    manifestPresentRule,
+    frontmatterParseableRule,
+    manifestSchemaValidRule,
+    manifestKeysRecognizedRule,
+];
+// Register ids into the `LintConfig.rules` allowlist. Module-load side effect:
+// a consumer that imports this catalog (or the `catalog/index` barrel) enables
+// `.axm/settings.json` `lint.rules` to reference any of the above rule ids.
+registerLintRuleIds(skillRules.map((r) => r.id));
+//# sourceMappingURL=skill.js.map

package/dist/src/unstable/lint/catalog/skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../../../../../src/unstable/lint/catalog/skill.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,kCAAkC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC3E,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAEjF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAA8C;IACnE,kBAAkB;IAClB,mBAAmB;IACnB,wBAAwB;IACxB,uBAAuB;IACvB,0BAA0B;CAC3B,CAAC;AAEF,+EAA+E;AAC/E,+EAA+E;AAC/E,4EAA4E;AAC5E,mBAAmB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC"}