@agentxm/extension-lifecycle 0.28.7-preview.1788522540.63ba4b89a → 0.28.8

package/dist/src/configured-entry-resolution.d.ts

@@ -20,15 +20,16 @@ import type { SubagentExtensionRef } from "@agentxm/extension-model/unstable/ext
 import type { VersionRange } from "@agentxm/extension-model/unstable/version-constraints";
 import { WorkspaceMutations } from "@agentxm/workspace-state";
 import { ExtensionLifecycleFailed } from "./errors.js";
+import { ReleaseAgePosture } from "./release-age-posture.js";
 import { LifecycleFailureAdapter } from "./failure-adapter.js";
 import type { AcceptedCanonicalRefError } from "@agentxm/workspace-state";
 import type { ConfiguredRegistryResolution } from "@agentxm/workspace-state";
-export declare const makeConfiguredReleaseAgeEvaluation: (mode: "enforce" | "ignore") => Effect.Effect<{
+export declare const makeConfiguredReleaseAgeEvaluation: () => Effect.Effect<{
     minimumReleaseAge: import("effect/Duration").Duration;
     evaluatedAt: DateTime.Utc;
-    mode: "enforce" | "ignore";
+    mode: import("./release-age-posture.js").ReleaseAgePostureValue;
     exclude: readonly import("@agentxm/extension-model/unstable/extensions/release-age").ScopedReleaseAgeExcludePattern[];
-}, ExtensionLifecycleFailed | import("@agentxm/workspace-state").WorkspaceSettingsReadFailure, WorkspaceMutations>;
+}, ExtensionLifecycleFailed | import("@agentxm/workspace-state").WorkspaceSettingsReadFailure, ReleaseAgePosture | WorkspaceMutations>;
 export declare const resolveConfiguredRegistryEntry: (name: string, source: string, expectedType: ExtensionType, releaseAgeEvaluation: ReleaseAgeEvaluation) => Effect.Effect<Option.Option<ConfiguredRegistryResolution>, ExtensionLifecycleFailed | SourceResolutionFailure | AcceptedCanonicalRefError, LifecycleFailureAdapter | SourceHostProviders | WorkspaceCatalog | WorkspaceMutations | FileSystem.FileSystem | HttpClient.HttpClient | Path.Path | Scope.Scope>;
 export declare const resolveConfiguredSkill: (name: string, source: string, releaseAgeEvaluation: ReleaseAgeEvaluation) => Effect.Effect<{
     ref: import("@agentxm/extension-model/unstable/extensions/refs/skill").RegistrySkillRef;

package/dist/src/configured-entry-resolution.js

@@ -7,10 +7,12 @@ import { resolveSource, SourceHostProviders, WorkspaceCatalog } from "@agentxm/e
 import { isWorkspaceSourceLocator } from "@agentxm/extension-model/unstable/sources/workspace";
 import { WorkspaceMutations } from "@agentxm/workspace-state";
 import { ExtensionLifecycleFailed } from "./errors.js";
+import { ReleaseAgePosture } from "./release-age-posture.js";
 import { LifecycleFailureAdapter } from "./failure-adapter.js";
 import { acceptedResolutionRef } from "@agentxm/workspace-state";
 import { resolveWorkspaceExtensionRef } from "@agentxm/workspace-state";
-export const makeConfiguredReleaseAgeEvaluation = (mode) => Effect.gen(function* () {
+export const makeConfiguredReleaseAgeEvaluation = () => Effect.gen(function* () {
+    const mode = yield* ReleaseAgePosture;
     const ws = yield* WorkspaceMutations;
     const configured = yield* ws.getMinimumReleaseAge();
     const minimumReleaseAge = parseMinimumReleaseAge(configured);
@@ -61,6 +63,9 @@ const configuredRegistryResolution = (resolution) => Effect.gen(function* () {
             category: "conflict",
             title: "Release held by minimum release age",
             detail: `${resolution.target}@${resolution.candidate.version} is held by the minimum release age until ${resolution.candidate.eligibleAt}`,
+            // Both routes are reachable from wherever the operator is standing:
+            // the exemption is declared once, the flag lasts one run.
+            recover: `Declare ${resolution.target} in minimumReleaseAgeExclude, or rerun this command with --ignore-release-age to take it for this run only.`,
         });
     }
     const holdbacks = resolution.kind === "exempted" || resolution.newerHeld === undefined

package/dist/src/hooks/manager.js

@@ -29,7 +29,7 @@ import { stripFileProtocol } from "../internal/fs-helpers.js";
 import { makeWorkspaceRelativeSourcePath } from "@agentxm/extension-model/unstable/path-types";
 import { decodeRelativePathSync, makeWorkspaceRelativePath, } from "@agentxm/extension-model/unstable/path-types";
 import { decodeVersionSync } from "@agentxm/extension-model/unstable/version-constraints";
-import { makeConfiguredReleaseAgeEvaluation, resolveConfiguredHook, } from "../configured-entry-resolution.js";
+import { usableAcceptedCanonicalRef } from "@agentxm/workspace-state";
 import { coupleLifecycleDependencyFailure } from "../errors.js";
 import { LifecycleFailureAdapter } from "../failure-adapter.js";
 import { HOOK_FALLBACKS_REGION_OWNER, HookManager } from "@agentxm/extension-workspace";
@@ -711,11 +711,17 @@ export const HookManagerLive = Layer.effect(HookManager, Effect.gen(function* ()
             const configured = yield* ws.getConfiguredHookEntries();
             return Option.fromUndefinedOr(configured[target.name]?.source);
         }),
+        /**
+         * Every enabled entry's accepted canonical package, read from accepted
+         * resolution rather than re-resolved from source. Materialization
+         * realizes what the workspace already accepted; going back to the
+         * source would put an unrelated configured entry's release age between
+         * an operator and the extension they are authoring.
+         */
         listMaterializable: Effect.fn("HookManager.listMaterializable")(function* () {
             const configured = yield* ws.getConfiguredHookEntries();
-            const releaseAgeEvaluation = yield* provide(makeConfiguredReleaseAgeEvaluation("enforce")).pipe(Effect.mapError(coupleLifecycleDependencyFailure));
-            const refs = yield* Effect.scoped(Effect.forEach(enabledConfiguredEntries(configured), ([name, entry]) => provide(resolveConfiguredHook(name, entry.source, releaseAgeEvaluation)).pipe(Effect.mapError(coupleLifecycleDependencyFailure), Effect.map(({ ref }) => ref)), { concurrency: "unbounded" }));
-            return refs;
+            const refs = yield* Effect.forEach(enabledConfiguredEntries(configured), ([name]) => provide(usableAcceptedCanonicalRef({ workspace: ws, type: "hook", name }).pipe(Effect.map(Option.filter((ref) => ref.type === "hook")))), { concurrency: "unbounded" });
+            return refs.flatMap((ref) => (Option.isSome(ref) ? [ref.value] : []));
         }),
         materializeUninstall,
         materializeDeactivate,

package/dist/src/index.d.ts

@@ -9,9 +9,11 @@
  * @packageDocumentation
  */
 export { ExtensionLifecycleFailed } from "./errors.js";
+export { ReleaseAgePosture, type ReleaseAgePostureValue } from "./release-age-posture.js";
 export { LifecycleFailureAdapter, withAdaptedStepFailures, type LifecycleFailureAdapterService, } from "./failure-adapter.js";
 export { makeConfiguredReleaseAgeEvaluation, resolveConfiguredHook, resolveConfiguredKnowledge, resolveConfiguredMcpServer, resolveConfiguredPack, resolveConfiguredRegistryEntry, resolveConfiguredRule, resolveConfiguredSkill, resolveConfiguredSubagent, } from "./configured-entry-resolution.js";
 export { CONFIGURED_ENTRY_RESOLUTION_TIMEOUT, withConfiguredEntryResolutionTimeout, } from "./resolution-timeout.js";
+export { PUBLISHER_CHANGE_CONDITION_ID, classifyPublisherBindingTransition, publisherChangeRiskCondition, publisherTransitionWarning, registryBindingProposal, withPublisherTrust, withPublisherTrustConditions, type PublisherBindingTransition, } from "./publisher-binding.js";
 export { buildInstallCommandPlan, runInstallCommandWorkflow, type InstallExtensionCommandWorkflowActions, } from "./workflows/install-command/workflow.js";
 export { runUninstallCommandWorkflow, type UninstallExtensionCommandWorkflowActions, type UninstallWorkflowFlags, } from "./workflows/uninstall-command/workflow.js";
 export { materializeRegistryPackage, materializeRegistryPackageWithTreeIntegrity, type MaterializeRegistryPackageArgs, type RegistryPackageMaterializationMessages, } from "./registry-materialization.js";

package/dist/src/index.js

@@ -9,9 +9,11 @@
  * @packageDocumentation
  */
 export { ExtensionLifecycleFailed } from "./errors.js";
+export { ReleaseAgePosture } from "./release-age-posture.js";
 export { LifecycleFailureAdapter, withAdaptedStepFailures, } from "./failure-adapter.js";
 export { makeConfiguredReleaseAgeEvaluation, resolveConfiguredHook, resolveConfiguredKnowledge, resolveConfiguredMcpServer, resolveConfiguredPack, resolveConfiguredRegistryEntry, resolveConfiguredRule, resolveConfiguredSkill, resolveConfiguredSubagent, } from "./configured-entry-resolution.js";
 export { CONFIGURED_ENTRY_RESOLUTION_TIMEOUT, withConfiguredEntryResolutionTimeout, } from "./resolution-timeout.js";
+export { PUBLISHER_CHANGE_CONDITION_ID, classifyPublisherBindingTransition, publisherChangeRiskCondition, publisherTransitionWarning, registryBindingProposal, withPublisherTrust, withPublisherTrustConditions, } from "./publisher-binding.js";
 export { buildInstallCommandPlan, runInstallCommandWorkflow, } from "./workflows/install-command/workflow.js";
 export { runUninstallCommandWorkflow, } from "./workflows/uninstall-command/workflow.js";
 export { materializeRegistryPackage, materializeRegistryPackageWithTreeIntegrity, } from "./registry-materialization.js";

package/dist/src/knowledge/manager.js

@@ -26,7 +26,7 @@ import { makeWorkspaceRelativeSourcePath } from "@agentxm/extension-model/unstab
 import { recordFootprint } from "@agentxm/workspace-state";
 import { makeWorkspaceRelativePath } from "@agentxm/extension-model/unstable/path-types";
 import { decodeVersionSync } from "@agentxm/extension-model/unstable/version-constraints";
-import { makeConfiguredReleaseAgeEvaluation, resolveConfiguredKnowledge, } from "../configured-entry-resolution.js";
+import { usableAcceptedCanonicalRef } from "@agentxm/workspace-state";
 import { getKnowledgeLockEntries } from "@agentxm/workspace-state";
 import { KnowledgeManager, } from "@agentxm/extension-workspace";
 import { WorkspaceMutations } from "@agentxm/workspace-state";
@@ -667,10 +667,21 @@ export const KnowledgeManagerLive = Layer.effect(KnowledgeManager, Effect.gen(fu
         getConfiguredSource: ({ target }) => ws
             .getConfiguredKnowledgeEntries()
             .pipe(Effect.map((entries) => Option.fromUndefinedOr(entries[target.name]?.source))),
+        /**
+         * Every enabled entry's accepted canonical package, read from accepted
+         * resolution rather than re-resolved from source. Materialization
+         * realizes what the workspace already accepted; going back to the
+         * source would put an unrelated configured entry's release age between
+         * an operator and the extension they are authoring.
+         */
         listMaterializable: () => Effect.gen(function* () {
             const nodes = yield* activeKnowledgeNodes();
-            const releaseAgeEvaluation = yield* provide(makeConfiguredReleaseAgeEvaluation("enforce")).pipe(Effect.mapError(coupleLifecycleDependencyFailure));
-            return yield* Effect.scoped(Effect.forEach(nodes, (node) => provide(resolveConfiguredKnowledge(node.name, node.source, releaseAgeEvaluation)).pipe(Effect.mapError(coupleLifecycleDependencyFailure), Effect.map(({ ref }) => ref)), { concurrency: "unbounded" }));
+            const refs = yield* Effect.forEach(nodes, (node) => provide(usableAcceptedCanonicalRef({
+                workspace: ws,
+                type: "knowledge",
+                name: node.name,
+            }).pipe(Effect.map(Option.filter((ref) => ref.type === "knowledge")))), { concurrency: "unbounded" });
+            return refs.flatMap((ref) => (Option.isSome(ref) ? [ref.value] : []));
         }),
         materializeUninstall,
         materializeDeactivate,

package/dist/src/publisher-binding.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Publisher binding trust classification.
+ *
+ * A Registry resolution binds a publisher identity. When an operation
+ * proposes to replace an already accepted binding for the same configured
+ * extension with a different one, that transition is a trust decision a
+ * person makes at a prompt: no flag and no unattended mode can approve it.
+ * Every route that can replace an accepted binding — root and type update
+ * forms, reinstall and re-resolution, and pack closures — classifies the
+ * transition from the structured accepted and proposed identities here, so
+ * the same rule holds everywhere the transition can occur.
+ *
+ * A first acceptance is not a change, and an integrity mismatch while
+ * reacquiring the same accepted identity remains a hard failure elsewhere.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import type * as FileSystem from "effect/FileSystem";
+import * as Option from "effect/Option";
+import type * as Path from "effect/Path";
+import type { ExtensionRef } from "@agentxm/extension-model/unstable/extensions/refs/extension-ref";
+import type { ExtensionType } from "@agentxm/extension-model/unstable/extensions";
+import type { Plan, PlanRiskCondition, RegistryBindingProposal } from "@agentxm/workspace-operations";
+import { WorkspaceMutations } from "@agentxm/workspace-state";
+export interface PublisherBindingTransition {
+    readonly extensionType: ExtensionType;
+    /** The configured (local) name whose accepted resolution changes publisher. */
+    readonly target: string;
+    readonly owner: string;
+    readonly packageName: string;
+    /** The accepted publisher binding being replaced. */
+    readonly accepted: string;
+    /** The publisher binding the operation proposes to accept. */
+    readonly proposed: string;
+}
+export declare const PUBLISHER_CHANGE_CONDITION_ID = "publisher-ownership-change";
+/** The structured proposal an extension ref makes, when it is a Registry ref. */
+export declare const registryBindingProposal: (ref: ExtensionRef) => RegistryBindingProposal | undefined;
+/**
+ * Classify one proposed acceptance against the accepted resolution for the
+ * same configured target. Only a Registry binding replacing a different
+ * Registry binding is a publisher change.
+ */
+export declare const classifyPublisherBindingTransition: (args: {
+    readonly accepted: Option.Option<ExtensionRef>;
+    readonly proposed: RegistryBindingProposal;
+}) => Option.Option<PublisherBindingTransition>;
+/** The warning a step carries when its acceptance changes publisher. */
+export declare const publisherTransitionWarning: (transition: PublisherBindingTransition) => string;
+/**
+ * The interactive-only condition a plan carries when any of its steps
+ * replaces an accepted publisher binding.
+ */
+export declare const publisherChangeRiskCondition: (transitions: ReadonlyArray<PublisherBindingTransition>) => PlanRiskCondition | undefined;
+/** Append the publisher-change condition for the given transitions, if any. */
+export declare const withPublisherTrustConditions: <R, O>(plan: Plan<R, O>, transitions: ReadonlyArray<PublisherBindingTransition>) => Plan<R, O>;
+/**
+ * Classify every proposed Registry acceptance in a plan against the accepted
+ * resolutions of the workspace, marking each changing step and attaching the
+ * interactive-only condition. When an accepted resolution cannot be read the
+ * plan blocks rather than proceeding without the comparison.
+ */
+export declare const withPublisherTrust: <R, O>(plan: Plan<R, O>) => Effect.Effect<Plan<R, O>, never, WorkspaceMutations | FileSystem.FileSystem | Path.Path>;
+//# sourceMappingURL=publisher-binding.d.ts.map

package/dist/src/publisher-binding.js

@@ -0,0 +1,151 @@
+/**
+ * Publisher binding trust classification.
+ *
+ * A Registry resolution binds a publisher identity. When an operation
+ * proposes to replace an already accepted binding for the same configured
+ * extension with a different one, that transition is a trust decision a
+ * person makes at a prompt: no flag and no unattended mode can approve it.
+ * Every route that can replace an accepted binding — root and type update
+ * forms, reinstall and re-resolution, and pack closures — classifies the
+ * transition from the structured accepted and proposed identities here, so
+ * the same rule holds everywhere the transition can occur.
+ *
+ * A first acceptance is not a change, and an integrity mismatch while
+ * reacquiring the same accepted identity remains a hard failure elsewhere.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import { toExtensionTypePlural } from "@agentxm/extension-model/unstable/extensions/common";
+import { acceptedResolutionRef, WorkspaceMutations } from "@agentxm/workspace-state";
+import { targetFromRef } from "@agentxm/extension-workspace";
+export const PUBLISHER_CHANGE_CONDITION_ID = "publisher-ownership-change";
+const ACCEPTED_RESOLUTION_UNREADABLE_ID = "accepted-resolution-unreadable";
+/** The structured proposal an extension ref makes, when it is a Registry ref. */
+export const registryBindingProposal = (ref) => ref.refType === "registry"
+    ? {
+        extensionType: ref.type,
+        target: targetFromRef(ref).name,
+        owner: ref.owner,
+        packageName: ref.name,
+        version: ref.version,
+        publisherBindingId: ref.publisherBindingId,
+    }
+    : undefined;
+/**
+ * Classify one proposed acceptance against the accepted resolution for the
+ * same configured target. Only a Registry binding replacing a different
+ * Registry binding is a publisher change.
+ */
+export const classifyPublisherBindingTransition = (args) => Option.flatMap(args.accepted, (accepted) => accepted.refType === "registry" &&
+    accepted.type === args.proposed.extensionType &&
+    accepted.publisherBindingId !== args.proposed.publisherBindingId
+    ? Option.some({
+        extensionType: args.proposed.extensionType,
+        target: args.proposed.target,
+        owner: args.proposed.owner,
+        packageName: args.proposed.packageName,
+        accepted: accepted.publisherBindingId,
+        proposed: args.proposed.publisherBindingId,
+    })
+    : Option.none());
+const describeTransition = (transition) => `${transition.owner}/${toExtensionTypePlural(transition.extensionType)}/${transition.packageName}`;
+/** The warning a step carries when its acceptance changes publisher. */
+export const publisherTransitionWarning = (transition) => `Publisher identity changed (${transition.accepted} → ${transition.proposed}); confirm only if you trust the current publisher`;
+/**
+ * The interactive-only condition a plan carries when any of its steps
+ * replaces an accepted publisher binding.
+ */
+export const publisherChangeRiskCondition = (transitions) => transitions.length === 0
+    ? undefined
+    : {
+        level: "confirmable",
+        consent: "interactive-only",
+        id: PUBLISHER_CHANGE_CONDITION_ID,
+        detail: `Publisher identity changed for ${transitions
+            .map(describeTransition)
+            .join(", ")}; confirm only if you trust the current publisher.`,
+    };
+/** Append the publisher-change condition for the given transitions, if any. */
+export const withPublisherTrustConditions = (plan, transitions) => {
+    const condition = publisherChangeRiskCondition(transitions);
+    return condition === undefined
+        ? plan
+        : { ...plan, riskConditions: [...(plan.riskConditions ?? []), condition] };
+};
+const stepWithTransitionWarning = (step, transition) => {
+    const warning = publisherTransitionWarning(transition);
+    switch (step.readiness) {
+        case "ready": {
+            const { message: _message, ...rest } = step;
+            return { ...rest, readiness: "warn", warnMessage: warning };
+        }
+        case "warn":
+            return { ...step, warnMessage: `${step.warnMessage}; ${warning}` };
+        case "error":
+            return step;
+    }
+};
+/**
+ * Classify every proposed Registry acceptance in a plan against the accepted
+ * resolutions of the workspace, marking each changing step and attaching the
+ * interactive-only condition. When an accepted resolution cannot be read the
+ * plan blocks rather than proceeding without the comparison.
+ */
+export const withPublisherTrust = (plan) => Effect.gen(function* () {
+    const workspace = yield* WorkspaceMutations;
+    const proposals = plan.jobs.flatMap((job) => job.steps.flatMap((step) => (step.registryBinding === undefined ? [] : [step])));
+    if (proposals.length === 0)
+        return plan;
+    const unreadable = [];
+    const transitionsByKey = new Map();
+    for (const step of proposals) {
+        const proposed = step.registryBinding;
+        if (proposed === undefined)
+            continue;
+        const accepted = yield* acceptedResolutionRef({
+            workspace,
+            type: proposed.extensionType,
+            name: proposed.target,
+        }).pipe(Effect.option);
+        if (Option.isNone(accepted)) {
+            unreadable.push(`${proposed.extensionType}:${proposed.target}`);
+            continue;
+        }
+        const transition = classifyPublisherBindingTransition({
+            accepted: accepted.value,
+            proposed,
+        });
+        if (Option.isSome(transition)) {
+            transitionsByKey.set(`${proposed.extensionType}:${proposed.target}`, transition.value);
+        }
+    }
+    const transitions = [...transitionsByKey.values()];
+    const marked = {
+        ...plan,
+        jobs: plan.jobs.map((job) => ({
+            ...job,
+            steps: job.steps.map((step) => {
+                const binding = step.registryBinding;
+                const transition = binding === undefined
+                    ? undefined
+                    : transitionsByKey.get(`${binding.extensionType}:${binding.target}`);
+                return transition === undefined ? step : stepWithTransitionWarning(step, transition);
+            }),
+        })),
+    };
+    const blocked = unreadable.length === 0
+        ? undefined
+        : {
+            level: "blocked",
+            id: ACCEPTED_RESOLUTION_UNREADABLE_ID,
+            detail: `The accepted resolution for ${unreadable.join(", ")} could not be read, so the proposed publisher binding cannot be checked.`,
+            errorCode: "conflict",
+        };
+    const withTrust = withPublisherTrustConditions(marked, transitions);
+    return blocked === undefined
+        ? withTrust
+        : { ...withTrust, riskConditions: [...(withTrust.riskConditions ?? []), blocked] };
+});
+//# sourceMappingURL=publisher-binding.js.map

package/dist/src/release-age-posture.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The minimum-release-age gate's posture for one invocation.
+ *
+ * A leaf cannot invent this value: `makeConfiguredReleaseAgeEvaluation` reads
+ * it from context, so every gated code path carries the requirement up to the
+ * command boundary that owns the operator's decision. A command is
+ * gate-blockable precisely when its execution requests this service, which is
+ * what the conformance specification reads instead of a hand-copied list.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as ServiceMap from "effect/Context";
+/**
+ * `"enforce"` withholds a candidate that has not reached the configured
+ * minimum release age; `"ignore"` takes it for this run only. Neither value
+ * changes settings, and a declared exemption outranks both.
+ */
+export type ReleaseAgePostureValue = "enforce" | "ignore";
+declare const ReleaseAgePosture_base: ServiceMap.ServiceClass<ReleaseAgePosture, "axm.sh/extension-lifecycle/ReleaseAgePosture", ReleaseAgePostureValue>;
+export declare class ReleaseAgePosture extends ReleaseAgePosture_base {
+}
+export {};
+//# sourceMappingURL=release-age-posture.d.ts.map

package/dist/src/release-age-posture.js

@@ -0,0 +1,15 @@
+/**
+ * The minimum-release-age gate's posture for one invocation.
+ *
+ * A leaf cannot invent this value: `makeConfiguredReleaseAgeEvaluation` reads
+ * it from context, so every gated code path carries the requirement up to the
+ * command boundary that owns the operator's decision. A command is
+ * gate-blockable precisely when its execution requests this service, which is
+ * what the conformance specification reads instead of a hand-copied list.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as ServiceMap from "effect/Context";
+export class ReleaseAgePosture extends ServiceMap.Service()("axm.sh/extension-lifecycle/ReleaseAgePosture") {
+}
+//# sourceMappingURL=release-age-posture.js.map

package/dist/src/rules/manager.js

@@ -30,8 +30,7 @@ import { removeIfExists } from "@agentxm/workspace-state";
 import { makeWorkspaceRelativePath } from "@agentxm/extension-model/unstable/path-types";
 import { decodeVersionSync } from "@agentxm/extension-model/unstable/version-constraints";
 import { WorkspaceMutations } from "@agentxm/workspace-state";
-import { makeConfiguredReleaseAgeEvaluation, resolveConfiguredRule, } from "../configured-entry-resolution.js";
-import { coupleLifecycleDependencyFailure } from "../errors.js";
+import { usableAcceptedCanonicalRef } from "@agentxm/workspace-state";
 import { LifecycleFailureAdapter } from "../failure-adapter.js";
 import { isObservedInstalled } from "@agentxm/workspace-state";
 import { acceptedCanonicalObservation, prepareAcceptedCanonicalTransition, removableAcceptedCanonicalPath, } from "@agentxm/workspace-state";
@@ -423,11 +422,17 @@ export const RuleManagerLive = Layer.effect(RuleManager, Effect.gen(function* ()
             const configured = yield* ws.getConfiguredRuleEntries();
             return Option.fromUndefinedOr(configured[target.name]?.source);
         }),
+        /**
+         * Every enabled entry's accepted canonical package, read from accepted
+         * resolution rather than re-resolved from source. Materialization
+         * realizes what the workspace already accepted; going back to the
+         * source would put an unrelated configured entry's release age between
+         * an operator and the extension they are authoring.
+         */
         listMaterializable: Effect.fn("RuleManager.listMaterializable")(function* () {
             const configured = yield* ws.getConfiguredRuleEntries();
-            const releaseAgeEvaluation = yield* provide(makeConfiguredReleaseAgeEvaluation("enforce")).pipe(Effect.mapError(coupleLifecycleDependencyFailure));
-            const refs = yield* Effect.scoped(Effect.forEach(enabledConfiguredEntries(configured), ([name, entry]) => provide(resolveConfiguredRule(name, entry.source, releaseAgeEvaluation)).pipe(Effect.mapError(coupleLifecycleDependencyFailure), Effect.map(({ ref }) => ref)), { concurrency: "unbounded" }));
-            return refs;
+            const refs = yield* Effect.forEach(enabledConfiguredEntries(configured), ([name]) => provide(usableAcceptedCanonicalRef({ workspace: ws, type: "rule", name }).pipe(Effect.map(Option.filter((ref) => ref.type === "rule")))), { concurrency: "unbounded" });
+            return refs.flatMap((ref) => (Option.isSome(ref) ? [ref.value] : []));
         }),
         materializeUninstall,
         materializeDeactivate,

package/dist/src/workflows/install-command/workflow.d.ts

@@ -41,7 +41,7 @@ export interface InstallExtensionCommandWorkflowActions<Args, Parsed, Req, Ref,
 export declare const buildInstallCommandPlan: <Args, Parsed, Req, Ref, Intent, ParseError, ResolveError, TransformError = never, TransformRequirements = never>(args: Args, actions: InstallExtensionCommandWorkflowActions<Args, Parsed, Req, Ref, Intent, ParseError, ResolveError>, options?: {
     readonly transformIntent?: (intent: Intent) => Intent;
     readonly transformPlan?: (plan: Plan) => Effect.Effect<Plan, TransformError, TransformRequirements>;
-}) => Effect.Effect<Plan<never, never>, ParseError | ResolveError | TransformError, Scope.Scope | TransformRequirements>;
+}) => Effect.Effect<Plan<never, never>, ParseError | ResolveError | TransformError, import("@agentxm/workspace-state").WorkspaceMutations | import("effect/FileSystem").FileSystem | import("effect/Path").Path | Scope.Scope | TransformRequirements>;
 /**
  * Run the canonical install command workflow.
  *

package/dist/src/workflows/install-command/workflow.js

@@ -8,6 +8,7 @@
  */
 import * as Effect from "effect/Effect";
 import { observeUnit, previewOrApplyPlan, publishPhaseStarted, } from "@agentxm/workspace-operations";
+import { withPublisherTrust } from "../../publisher-binding.js";
 // -----------------------------------------------------------------------------
 // Install Command Workflow
 // -----------------------------------------------------------------------------
@@ -26,7 +27,11 @@ export const buildInstallCommandPlan = (args, actions, options) => Effect.gen(fu
     const finalizedIntent = yield* actions.finalizeIntent(parsed, refs);
     const intent = options?.transformIntent?.(finalizedIntent) ?? finalizedIntent;
     const plan = yield* actions.buildPlan(intent);
-    return options?.transformPlan === undefined ? plan : yield* options.transformPlan(plan);
+    const transformed = options?.transformPlan === undefined ? plan : yield* options.transformPlan(plan);
+    // Every acceptance the plan proposes is classified against the accepted
+    // resolution here, so root, type, reinstall, and closure routes share one
+    // publisher-trust rule.
+    return yield* withPublisherTrust(transformed);
 });
 /**
  * Run the canonical install command workflow.

package/package.json

@@ -1,64 +1,64 @@
 {
-  "name": "@agentxm/extension-lifecycle",
-  "version": "0.28.7-preview.1788522540.63ba4b89a",
-  "description": "AXM extension-lifecycle feature: install, update, uninstall, enable, and disable policy across root and type-specific command forms for the axm CLI. Unstable and unsupported — use the axm.sh CLI.",
-  "type": "module",
-  "license": "FSL-1.1-MIT",
-  "homepage": "https://axm.sh",
+  "author": "AgentXM <hello@agentxm.ai> (https://agentxm.ai)",
   "bugs": {
     "url": "https://github.com/agentxm/axm/issues"
   },
-  "author": "AgentXM <hello@agentxm.ai> (https://agentxm.ai)",
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/agentxm/axm.git",
-    "directory": "packages/extension-lifecycle"
+  "dependencies": {
+    "@agentxm/extension-model": "^0.28.8",
+    "@agentxm/extension-sources": "^0.28.8",
+    "@agentxm/extension-workspace": "^0.28.8",
+    "@agentxm/registry-client": "^0.28.8",
+    "@agentxm/registry-protocol": "^0.28.8",
+    "@agentxm/workspace-operations": "^0.28.8",
+    "@agentxm/workspace-state": "^0.28.8",
+    "effect": "4.0.0-rc.112",
+    "semver": "^7.8.5"
+  },
+  "description": "AXM extension-lifecycle feature: install, update, uninstall, enable, and disable policy across root and type-specific command forms for the axm CLI. Unstable and unsupported — use the axm.sh CLI.",
+  "devDependencies": {
+    "@effect/platform-node": "4.0.0-rc.112",
+    "@effect/vitest": "4.0.0-rc.112",
+    "@types/bun": "^1.3.14",
+    "@types/semver": "^7.7.1",
+    "@typescript/native": "npm:typescript@^7.0.2",
+    "typescript": "npm:@typescript/typescript6@^6.0.2",
+    "vitest": "^4.1.10",
+    "yaml": "^2.9.0"
+  },
+  "engines": {
+    "node": ">=22.19.0"
   },
-  "sideEffects": false,
   "exports": {
     ".": {
-      "types": "./dist/src/index.d.ts",
       "axm-source": "./src/index.ts",
-      "default": "./dist/src/index.js"
+      "default": "./dist/src/index.js",
+      "types": "./dist/src/index.d.ts"
     },
     "./live": {
-      "types": "./dist/src/live.d.ts",
       "axm-source": "./src/live.ts",
-      "default": "./dist/src/live.js"
+      "default": "./dist/src/live.js",
+      "types": "./dist/src/live.d.ts"
     }
   },
   "files": [
     "dist/src/",
     "!**/*.map"
   ],
-  "publishConfig": {
-    "access": "public"
-  },
-  "engines": {
-    "node": ">=22.19.0"
-  },
+  "homepage": "https://axm.sh",
+  "license": "FSL-1.1-MIT",
+  "name": "@agentxm/extension-lifecycle",
   "nx": {
     "includedScripts": []
   },
-  "dependencies": {
-    "effect": "4.0.0-rc.112",
-    "semver": "^7.8.5",
-    "@agentxm/extension-sources": "^0.28.7-preview.1788522540.63ba4b89a",
-    "@agentxm/extension-model": "^0.28.7-preview.1788522540.63ba4b89a",
-    "@agentxm/extension-workspace": "^0.28.7-preview.1788522540.63ba4b89a",
-    "@agentxm/workspace-operations": "^0.28.7-preview.1788522540.63ba4b89a",
-    "@agentxm/registry-client": "^0.28.7-preview.1788522540.63ba4b89a",
-    "@agentxm/registry-protocol": "^0.28.7-preview.1788522540.63ba4b89a",
-    "@agentxm/workspace-state": "^0.28.7-preview.1788522540.63ba4b89a"
+  "publishConfig": {
+    "access": "public"
   },
-  "devDependencies": {
-    "@effect/platform-node": "4.0.0-rc.112",
-    "@effect/vitest": "4.0.0-rc.112",
-    "@types/bun": "^1.3.14",
-    "@types/semver": "^7.5.8",
-    "@typescript/native": "npm:typescript@^7.0.2",
-    "typescript": "npm:@typescript/typescript6@^6.0.2",
-    "vitest": "^4.1.10",
-    "yaml": "^2.9.0"
-  }
-}
+  "repository": {
+    "directory": "packages/extension-lifecycle",
+    "type": "git",
+    "url": "https://github.com/agentxm/axm.git"
+  },
+  "sideEffects": false,
+  "type": "module",
+  "version": "0.28.8"
+}