@agentxm/extension-content 0.28.14-preview.1789139351.5cd4595aa

package/dist/src/lint/catalog/mcp-server.d.ts

@@ -0,0 +1,4 @@
+import type { McpServerRuleContext } from "../context.js";
+import type { LintRule } from "../rule.js";
+export declare const mcpServerRules: ReadonlyArray<LintRule<McpServerRuleContext>>;
+//# sourceMappingURL=mcp-server.d.ts.map

package/dist/src/lint/catalog/mcp-server.js

@@ -0,0 +1,4 @@
+import { mcpServerEnvelopeRules } from "./mcp-server/envelope.js";
+import { orderedEnvelopeRules } from "./shared/envelope-rules.js";
+export const mcpServerRules = orderedEnvelopeRules(mcpServerEnvelopeRules);
+//# sourceMappingURL=mcp-server.js.map

package/dist/src/lint/catalog/pack/manifest-keys-recognized.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `pack/manifest-keys-recognized` — `pack.json` contains only keys
+ * declared by `PackManifestSchema`.
+ *
+ * The paired `-schema-valid` rule ignores excess properties by construction
+ * (`onExcessProperty: "ignore"`); this rule rejects them so publish never
+ * silently drops unrecognized manifest data.
+ *
+ * A forbidden `packs:` dependency section (ONTOLOGY D015 "Cross-Domain
+ * Pack Semantics") decodes as an unrecognized top-level key here
+ * and surfaces at error severity here.
+ *
+ * Allowed-keys set is derived from `PackManifestSchema.fields` — no
+ * copy-paste of field names. A schema gain (or rename) automatically updates
+ * the allowlist.
+ *
+ * Early-return arm (no findings):
+ *
+ * - `subject.packJson === undefined` / non-object — nothing to enumerate;
+ *   `pack/manifest-present` owns the absence case.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { PackRuleContext } from "../../context.js";
+import type { AdvisoryRule } from "../../rule.js";
+export declare const manifestKeysRecognizedRule: AdvisoryRule<PackRuleContext>;
+//# sourceMappingURL=manifest-keys-recognized.d.ts.map

package/dist/src/lint/catalog/pack/manifest-keys-recognized.js

@@ -0,0 +1,38 @@
+/**
+ * `pack/manifest-keys-recognized` — `pack.json` contains only keys
+ * declared by `PackManifestSchema`.
+ *
+ * The paired `-schema-valid` rule ignores excess properties by construction
+ * (`onExcessProperty: "ignore"`); this rule rejects them so publish never
+ * silently drops unrecognized manifest data.
+ *
+ * A forbidden `packs:` dependency section (ONTOLOGY D015 "Cross-Domain
+ * Pack Semantics") decodes as an unrecognized top-level key here
+ * and surfaces at error severity here.
+ *
+ * Allowed-keys set is derived from `PackManifestSchema.fields` — no
+ * copy-paste of field names. A schema gain (or rename) automatically updates
+ * the allowlist.
+ *
+ * Early-return arm (no findings):
+ *
+ * - `subject.packJson === undefined` / non-object — nothing to enumerate;
+ *   `pack/manifest-present` owns the absence case.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+import { PackManifestSchema } from "@agentxm/extension-model/unstable/packs/manifest-schema";
+import { enumerateUnknownTopLevelKeys, structFieldKeys } from "../shared/schema-rule.js";
+const RULE_ID = "pack/manifest-keys-recognized";
+const PACK_JSON = "pack.json";
+const allowedKeys = structFieldKeys(PackManifestSchema);
+export const manifestKeysRecognizedRule = {
+    id: RULE_ID,
+    description: "pack.json uses only supported top-level fields.",
+    kind: "advisory",
+    severity: "error",
+    check: (context) => Effect.succeed(enumerateUnknownTopLevelKeys(RULE_ID, "error", PACK_JSON, allowedKeys, context.subject.packJson)),
+};
+//# sourceMappingURL=manifest-keys-recognized.js.map

package/dist/src/lint/catalog/pack/manifest-present.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `pack/manifest-present` — packs must have a `pack.json` at the
+ * pack root.
+ *
+ * Packs are registry-only at v1; every pack context is expected to expose a
+ * manifest. Unlike `skill/manifest-present`, there is no native-vs-non-native
+ * split — the rule applies to every pack context unconditionally.
+ *
+ * Advisory-only — scaffolding a manifest is `axm packs new` (a user-authored
+ * action) per the lint design.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { PackRuleContext } from "../../context.js";
+export declare const manifestPresentRule: import("../../rule.ts").AdvisoryRule<PackRuleContext<import("../../context.js").PackContent>>;
+//# sourceMappingURL=manifest-present.d.ts.map

package/dist/src/lint/catalog/pack/manifest-present.js

@@ -0,0 +1,24 @@
+/**
+ * `pack/manifest-present` — packs must have a `pack.json` at the
+ * pack root.
+ *
+ * Packs are registry-only at v1; every pack context is expected to expose a
+ * manifest. Unlike `skill/manifest-present`, there is no native-vs-non-native
+ * split — the rule applies to every pack context unconditionally.
+ *
+ * Advisory-only — scaffolding a manifest is `axm packs new` (a user-authored
+ * action) per the lint design.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import { makeManifestPresentRule } from "../shared/manifest-present.js";
+const RULE_ID = "pack/manifest-present";
+const PACK_JSON = "pack.json";
+export const manifestPresentRule = makeManifestPresentRule({
+    ruleId: RULE_ID,
+    description: "Packs include a root pack.json manifest.",
+    manifestFile: PACK_JSON,
+    missingMessage: "pack.json is missing. Create pack.json with the required manifest fields (`owner`, `type`, `name`, `version`).",
+});
+//# sourceMappingURL=manifest-present.js.map

package/dist/src/lint/catalog/pack/manifest-schema-valid.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `pack/manifest-schema-valid` — `pack.json` conforms to
+ * `PackManifestSchema`.
+ *
+ * Delegates to Effect Schema. Issues map 1:1 to findings via
+ * `issuesToFindings`.
+ *
+ * Early-return arm (no findings):
+ *
+ * - `subject.packJson === undefined` — manifest is absent (covered by
+ *   `pack/manifest-present`).
+ *
+ * Dependency-map FQN grammar and `VersionRange` decode arms are owned by
+ * `PackManifestSchema` itself — the dependency sections are typed
+ * `Record<FQN, VersionRange>` so unknown FQNs, malformed grammar, and
+ * bad semver ranges surface as normal schema issues through the shared
+ * `schemaDecodeFindings` plumbing.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { PackRuleContext } from "../../context.js";
+import type { AdvisoryRule } from "../../rule.js";
+export declare const manifestSchemaValidRule: AdvisoryRule<PackRuleContext>;
+//# sourceMappingURL=manifest-schema-valid.d.ts.map

package/dist/src/lint/catalog/pack/manifest-schema-valid.js

@@ -0,0 +1,33 @@
+/**
+ * `pack/manifest-schema-valid` — `pack.json` conforms to
+ * `PackManifestSchema`.
+ *
+ * Delegates to Effect Schema. Issues map 1:1 to findings via
+ * `issuesToFindings`.
+ *
+ * Early-return arm (no findings):
+ *
+ * - `subject.packJson === undefined` — manifest is absent (covered by
+ *   `pack/manifest-present`).
+ *
+ * Dependency-map FQN grammar and `VersionRange` decode arms are owned by
+ * `PackManifestSchema` itself — the dependency sections are typed
+ * `Record<FQN, VersionRange>` so unknown FQNs, malformed grammar, and
+ * bad semver ranges surface as normal schema issues through the shared
+ * `schemaDecodeFindings` plumbing.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import { PackManifestSchema } from "@agentxm/extension-model/unstable/packs/manifest-schema";
+import { schemaDecodeFindings } from "../shared/schema-rule.js";
+const RULE_ID = "pack/manifest-schema-valid";
+const PACK_JSON = "pack.json";
+export const manifestSchemaValidRule = {
+    id: RULE_ID,
+    description: "pack.json defines a valid pack manifest.",
+    kind: "advisory",
+    severity: "error",
+    check: (context) => schemaDecodeFindings(RULE_ID, "error", PACK_JSON, PackManifestSchema, context.subject.packJson),
+};
+//# sourceMappingURL=manifest-schema-valid.js.map

package/dist/src/lint/catalog/pack-accessor/contexts.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `buildPackRuleContexts` — build `PackRuleContext[]` from a structural
+ * `installedPacks` input. The full lint workspace view
+ * (`LintWorkspaceView`) satisfies this by construction.
+ *
+ * The minimal shape is **exactly** the set of fields the function reads per
+ * installed pack:
+ *
+ * - `packJson` — pre-decoded `pack.json` when present (caller
+ *   decodes once per pack, so rules don't re-read + re-parse).
+ * - `displayRoot` — posix-relative root used by the renderer; the caller
+ *   picks per provenance (see the table below).
+ * - `files` — the pre-bound `PackFileAccessor`. The caller chooses VFT or
+ *   platform-backed.
+ *
+ * Provenance → `displayRoot` table:
+ *
+ * | Surface                            | `displayRoot`                             |
+ * | ---------------------------------- | ----------------------------------------- |
+ * | Publish                            | `""`                                      |
+ * | Registry-installed pack            | `agent_extensions/<@owner>/packs/<name>`   |
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { PackFileAccessor, PackRuleContext } from "../../context.js";
+/**
+ * Minimal structural shape `buildPackRuleContexts` needs per installed
+ * pack. The full lint workspace view exposes
+ * `installedPacks: ReadonlyArray<InstalledPackInfo>`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface InstalledPackInfo {
+    readonly packJson: unknown;
+    readonly displayRoot: string;
+    readonly files: PackFileAccessor;
+}
+/**
+ * Project an input's `installedPacks` into `PackRuleContext`s with their
+ * `displayRoot` and `subject` fields pre-populated.
+ *
+ * Publish callers bypass this helper and construct a single context directly
+ * — they have exactly one pack in play and no workspace.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const buildPackRuleContexts: (input: {
+    readonly installedPacks: ReadonlyArray<InstalledPackInfo>;
+}) => ReadonlyArray<PackRuleContext>;
+//# sourceMappingURL=contexts.d.ts.map

package/dist/src/lint/catalog/pack-accessor/contexts.js

@@ -0,0 +1,45 @@
+/**
+ * `buildPackRuleContexts` — build `PackRuleContext[]` from a structural
+ * `installedPacks` input. The full lint workspace view
+ * (`LintWorkspaceView`) satisfies this by construction.
+ *
+ * The minimal shape is **exactly** the set of fields the function reads per
+ * installed pack:
+ *
+ * - `packJson` — pre-decoded `pack.json` when present (caller
+ *   decodes once per pack, so rules don't re-read + re-parse).
+ * - `displayRoot` — posix-relative root used by the renderer; the caller
+ *   picks per provenance (see the table below).
+ * - `files` — the pre-bound `PackFileAccessor`. The caller chooses VFT or
+ *   platform-backed.
+ *
+ * Provenance → `displayRoot` table:
+ *
+ * | Surface                            | `displayRoot`                             |
+ * | ---------------------------------- | ----------------------------------------- |
+ * | Publish                            | `""`                                      |
+ * | Registry-installed pack            | `agent_extensions/<@owner>/packs/<name>`   |
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+// -----------------------------------------------------------------------------
+// buildPackRuleContexts
+// -----------------------------------------------------------------------------
+/**
+ * Project an input's `installedPacks` into `PackRuleContext`s with their
+ * `displayRoot` and `subject` fields pre-populated.
+ *
+ * Publish callers bypass this helper and construct a single context directly
+ * — they have exactly one pack in play and no workspace.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const buildPackRuleContexts = (input) => input.installedPacks.map((info) => ({
+    subject: {
+        packJson: info.packJson,
+    },
+    files: info.files,
+    displayRoot: info.displayRoot,
+}));
+//# sourceMappingURL=contexts.js.map

package/dist/src/lint/catalog/pack-accessor/platform.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Platform-backed `PackFileAccessor` for `axm lint`.
+ *
+ * Maps accessor-relative posix paths to on-disk absolute paths rooted at
+ * the caller-supplied pack-root directory. Layout conventions per
+ * the lint design "Pack accessor root":
+ *
+ * - **Registry-installed:**
+ *   `<workspaceRoot>/agent_extensions/<@owner>/packs/<sanitized-name>/`
+ *
+ * Packs are registry-only at v1 — there is no non-native variant. The caller
+ * (`buildPackRuleContexts` or the CLI entry point) picks the root from
+ * `computePackPathsForLayout` in `@agentxm/workspace-state`.
+ *
+ * The `pack.json` sits directly under `canonicalPath`; there is no
+ * `src/` subdirectory like skills have — the pack install operation in
+ * `@agentxm/extension-lifecycle` owns the authoritative layout.
+ *
+ * Bounds enforcement:
+ *
+ * - No `..` segments in accessor-relative paths.
+ * - No absolute paths (posix or Windows drive letters).
+ * - Resolved absolute paths are verified to stay under the accessor root.
+ *
+ * The accessor is built via a factory that captures a pre-resolved
+ * `FileSystem.FileSystem` + `Path.Path` services and an absolute root, so
+ * `PackFileAccessor` stays Layer-free at rule-evaluation time (per
+ * `lint-engine` spec "Rule contexts expose narrow caller-bound accessors").
+ * It mirrors the VFT-backed accessor in `./vft.ts`; the two are the only
+ * `PackFileAccessor` implementations, one for on-disk roots and one for an
+ * extracted archive.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type * as FileSystem from "effect/FileSystem";
+import type * as Path from "effect/Path";
+import type { PackFileAccessor } from "../../context.js";
+/**
+ * Platform services needed by the platform-backed pack accessor.
+ */
+export interface PackAccessorPlatform {
+    readonly fs: FileSystem.FileSystem;
+    readonly path: Path.Path;
+}
+/**
+ * Build a platform-backed `PackFileAccessor` rooted at `absoluteRoot`.
+ *
+ * `absoluteRoot` SHOULD be the absolute path to the pack root directory
+ * (`canonicalPath` from `computePackPathsForLayout` in
+ * `@agentxm/workspace-state`).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const makePlatformPackFileAccessor: (platform: PackAccessorPlatform, absoluteRoot: string) => PackFileAccessor;
+//# sourceMappingURL=platform.d.ts.map

package/dist/src/lint/catalog/pack-accessor/platform.js

@@ -0,0 +1,93 @@
+/**
+ * Platform-backed `PackFileAccessor` for `axm lint`.
+ *
+ * Maps accessor-relative posix paths to on-disk absolute paths rooted at
+ * the caller-supplied pack-root directory. Layout conventions per
+ * the lint design "Pack accessor root":
+ *
+ * - **Registry-installed:**
+ *   `<workspaceRoot>/agent_extensions/<@owner>/packs/<sanitized-name>/`
+ *
+ * Packs are registry-only at v1 — there is no non-native variant. The caller
+ * (`buildPackRuleContexts` or the CLI entry point) picks the root from
+ * `computePackPathsForLayout` in `@agentxm/workspace-state`.
+ *
+ * The `pack.json` sits directly under `canonicalPath`; there is no
+ * `src/` subdirectory like skills have — the pack install operation in
+ * `@agentxm/extension-lifecycle` owns the authoritative layout.
+ *
+ * Bounds enforcement:
+ *
+ * - No `..` segments in accessor-relative paths.
+ * - No absolute paths (posix or Windows drive letters).
+ * - Resolved absolute paths are verified to stay under the accessor root.
+ *
+ * The accessor is built via a factory that captures a pre-resolved
+ * `FileSystem.FileSystem` + `Path.Path` services and an absolute root, so
+ * `PackFileAccessor` stays Layer-free at rule-evaluation time (per
+ * `lint-engine` spec "Rule contexts expose narrow caller-bound accessors").
+ * It mirrors the VFT-backed accessor in `./vft.ts`; the two are the only
+ * `PackFileAccessor` implementations, one for on-disk roots and one for an
+ * extracted archive.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+/**
+ * Build a platform-backed `PackFileAccessor` rooted at `absoluteRoot`.
+ *
+ * `absoluteRoot` SHOULD be the absolute path to the pack root directory
+ * (`canonicalPath` from `computePackPathsForLayout` in
+ * `@agentxm/workspace-state`).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const makePlatformPackFileAccessor = (platform, absoluteRoot) => {
+    const { fs, path } = platform;
+    const normalizedRoot = path.resolve(absoluteRoot);
+    const resolveWithinRoot = (input) => {
+        if (input === "" || input === "." || input === "./") {
+            return { kind: "ok", absolute: normalizedRoot };
+        }
+        if (/^[a-z]:[\\/]/i.test(input) || input.startsWith("/") || input.startsWith("\\")) {
+            return { kind: "escape" };
+        }
+        const normalized = input.replace(/\\/g, "/").replace(/^\.\//, "");
+        for (const segment of normalized.split("/")) {
+            if (segment === "..") {
+                return { kind: "escape" };
+            }
+        }
+        const absolute = path.resolve(normalizedRoot, normalized);
+        if (absolute !== normalizedRoot && !absolute.startsWith(`${normalizedRoot}${path.sep}`)) {
+            return { kind: "escape" };
+        }
+        return { kind: "ok", absolute };
+    };
+    const makeAccessError = (p, reason, message) => ({
+        _tag: "FileAccessError",
+        path: p,
+        reason,
+        message,
+    });
+    return {
+        exists: (p) => {
+            const resolved = resolveWithinRoot(p);
+            if (resolved.kind !== "ok") {
+                return Effect.succeed(false);
+            }
+            return fs.exists(resolved.absolute).pipe(Effect.catch(() => Effect.succeed(false)));
+        },
+        readBytes: (p) => {
+            const resolved = resolveWithinRoot(p);
+            if (resolved.kind === "escape") {
+                return Effect.fail(makeAccessError(p, "path-escape", `path escapes the accessor root: ${p}`));
+            }
+            return fs
+                .readFile(resolved.absolute)
+                .pipe(Effect.mapError((cause) => makeAccessError(p, "read-error", `read failed at ${p}: ${String(cause)}`)));
+        },
+    };
+};
+//# sourceMappingURL=platform.js.map

package/dist/src/lint/catalog/pack-accessor/vft.d.ts

@@ -0,0 +1,60 @@
+/**
+ * VFT-backed `PackFileAccessor` for publish callers.
+ *
+ * A Virtual File Tree (VFT) is an in-memory representation of an extracted
+ * archive — the registry publish pipeline extracts an upload into a VFT, then
+ * passes that tree into Phase 4 decode/lint. The VFT's schema and bounds
+ * (max size, file count, path depth) are owned by the registry extract phase
+ * (Phase 4 concern); this accessor treats the tree as a read-only
+ * `path -> Uint8Array` map and enforces its own rooted-read + no-`..`-escape
+ * invariants at the rule boundary.
+ *
+ * Bounds enforcement here:
+ *
+ * - Paths are normalized to posix, `./` prefixes are stripped.
+ * - Empty path resolves to the accessor root itself.
+ * - Any path containing a `..` segment raises `FileAccessError {
+ *   reason: "path-escape" }` from `readBytes` and resolves to `false` from
+ *   `exists`.
+ * - Absolute paths (starting with `/` or a Windows drive letter) are
+ *   treated as escape attempts.
+ *
+ * Mirrors the skill VFT accessor (`../skill-accessor/vft.ts`). The VFTNode
+ * interface is intentionally the same so a publish caller can extract a
+ * single archive once and pass the same tree to either accessor factory.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { PackFileAccessor } from "../../context.js";
+/**
+ * Minimal shape of a Virtual File Tree consumed by the accessor.
+ *
+ * Shape-compatible with `../skill-accessor/vft.ts#VFTNode`; kept as a local
+ * declaration to avoid a cross-subfolder import and to document what this
+ * accessor uses.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface PackVFTNode {
+    /**
+     * Whether the given posix path points to a file within the tree.
+     */
+    readonly hasFile: (posixPath: string) => boolean;
+    /**
+     * Return the bytes for the given posix path, or `undefined` when the path
+     * does not resolve to a file (missing, directory, or outside the tree).
+     */
+    readonly getFile: (posixPath: string) => Uint8Array | undefined;
+}
+/**
+ * Build a VFT-backed `PackFileAccessor` rooted at the tree's root.
+ *
+ * Callers that root the pack at a sub-path of the archive should pre-strip
+ * that sub-path before constructing the tree — the accessor enforces no
+ * `..` escape above the root it was given.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const makeVftPackFileAccessor: (tree: PackVFTNode) => PackFileAccessor;
+//# sourceMappingURL=vft.d.ts.map

package/dist/src/lint/catalog/pack-accessor/vft.js

@@ -0,0 +1,85 @@
+/**
+ * VFT-backed `PackFileAccessor` for publish callers.
+ *
+ * A Virtual File Tree (VFT) is an in-memory representation of an extracted
+ * archive — the registry publish pipeline extracts an upload into a VFT, then
+ * passes that tree into Phase 4 decode/lint. The VFT's schema and bounds
+ * (max size, file count, path depth) are owned by the registry extract phase
+ * (Phase 4 concern); this accessor treats the tree as a read-only
+ * `path -> Uint8Array` map and enforces its own rooted-read + no-`..`-escape
+ * invariants at the rule boundary.
+ *
+ * Bounds enforcement here:
+ *
+ * - Paths are normalized to posix, `./` prefixes are stripped.
+ * - Empty path resolves to the accessor root itself.
+ * - Any path containing a `..` segment raises `FileAccessError {
+ *   reason: "path-escape" }` from `readBytes` and resolves to `false` from
+ *   `exists`.
+ * - Absolute paths (starting with `/` or a Windows drive letter) are
+ *   treated as escape attempts.
+ *
+ * Mirrors the skill VFT accessor (`../skill-accessor/vft.ts`). The VFTNode
+ * interface is intentionally the same so a publish caller can extract a
+ * single archive once and pass the same tree to either accessor factory.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+/**
+ * Build a VFT-backed `PackFileAccessor` rooted at the tree's root.
+ *
+ * Callers that root the pack at a sub-path of the archive should pre-strip
+ * that sub-path before constructing the tree — the accessor enforces no
+ * `..` escape above the root it was given.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const makeVftPackFileAccessor = (tree) => {
+    return {
+        exists: (path) => {
+            const normalized = normalizeAndCheck(path);
+            if (normalized.kind !== "ok") {
+                return Effect.succeed(false);
+            }
+            return Effect.succeed(tree.hasFile(normalized.path));
+        },
+        readBytes: (path) => {
+            const normalized = normalizeAndCheck(path);
+            if (normalized.kind === "escape") {
+                return failFileAccess(path, "path-escape", `path escapes the accessor root: ${path}`);
+            }
+            const bytes = tree.getFile(normalized.path);
+            if (bytes === undefined) {
+                return failFileAccess(path, "read-error", `file not found at ${path}`);
+            }
+            return Effect.succeed(bytes);
+        },
+    };
+};
+const normalizeAndCheck = (path) => {
+    if (path === "" || path === "." || path === "./") {
+        return { kind: "ok", path: "" };
+    }
+    // Windows drive letters (`C:/`) and absolute posix paths both count as
+    // escape attempts at a pack-rooted accessor.
+    if (/^[a-z]:[\\/]/i.test(path) || path.startsWith("/") || path.startsWith("\\")) {
+        return { kind: "escape" };
+    }
+    const normalized = path.replace(/\\/g, "/").replace(/^\.\//, "");
+    const segments = normalized.split("/");
+    for (const segment of segments) {
+        if (segment === "..") {
+            return { kind: "escape" };
+        }
+    }
+    return { kind: "ok", path: normalized };
+};
+const failFileAccess = (path, reason, message) => Effect.fail({
+    _tag: "FileAccessError",
+    path,
+    reason,
+    message,
+});
+//# sourceMappingURL=vft.js.map

package/dist/src/lint/catalog/pack.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `pack/*` rule catalog — the v1 three-rule set.
+ *
+ * Per the lint design, registry publish and `axm lint`
+ * run exactly these rules against each pack context:
+ *
+ * | ID                              | Severity | Autofix |
+ * | ------------------------------- | -------- | ------- |
+ * | `pack/manifest-present`         | error    | —       |
+ * | `pack/manifest-schema-valid`    | error    | —       |
+ * | `pack/manifest-keys-recognized` | error    | —       |
+ *
+ * All three ship `kind: "advisory"`. Packs are registry-only at v1 (no
+ * non-native arm), so there is no applicability discriminator — every pack
+ * context runs every rule and the `check` body's early-return arms handle
+ * manifest-absent cases.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { LintRule } from "../rule.js";
+import type { PackRuleContext } from "../context.js";
+/**
+ * Ordered v1 `pack/*` rule catalog. Declaration order is the evaluation
+ * order within a single `evaluateContexts` call (deterministic ordering is
+ * test-observable; see `evaluate.ts`).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const packRules: ReadonlyArray<LintRule<PackRuleContext>>;
+//# sourceMappingURL=pack.d.ts.map

package/dist/src/lint/catalog/pack.js

@@ -0,0 +1,36 @@
+/**
+ * `pack/*` rule catalog — the v1 three-rule set.
+ *
+ * Per the lint design, registry publish and `axm lint`
+ * run exactly these rules against each pack context:
+ *
+ * | ID                              | Severity | Autofix |
+ * | ------------------------------- | -------- | ------- |
+ * | `pack/manifest-present`         | error    | —       |
+ * | `pack/manifest-schema-valid`    | error    | —       |
+ * | `pack/manifest-keys-recognized` | error    | —       |
+ *
+ * All three ship `kind: "advisory"`. Packs are registry-only at v1 (no
+ * non-native arm), so there is no applicability discriminator — every pack
+ * context runs every rule and the `check` body's early-return arms handle
+ * manifest-absent cases.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import { manifestPresentRule } from "./pack/manifest-present.js";
+import { manifestSchemaValidRule } from "./pack/manifest-schema-valid.js";
+import { manifestKeysRecognizedRule } from "./pack/manifest-keys-recognized.js";
+/**
+ * Ordered v1 `pack/*` rule catalog. Declaration order is the evaluation
+ * order within a single `evaluateContexts` call (deterministic ordering is
+ * test-observable; see `evaluate.ts`).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const packRules = [
+    manifestPresentRule,
+    manifestSchemaValidRule,
+    manifestKeysRecognizedRule,
+];
+//# sourceMappingURL=pack.js.map

package/dist/src/lint/catalog/rule/envelope.d.ts

@@ -0,0 +1,6 @@
+/**
+ * `rule/*` manifest envelope — see `../shared/envelope-rules.ts`.
+ */
+import type { RuleRuleContext } from "../../context.js";
+export declare const ruleEnvelopeRules: import("../shared/envelope-rules.js").ManifestEnvelopeRules<RuleRuleContext<import("../../context.js").RuleContent>>;
+//# sourceMappingURL=envelope.d.ts.map