@agentxm/registry-protocol 0.28.4-bootstrap.0

package/dist/src/unstable/lint/publish.d.ts

@@ -0,0 +1,49 @@
+/**
+ * Registry-publish lint surface.
+ *
+ * This entry point intentionally exports only the primitives the registry
+ * publish gate needs. It avoids the full lint barrel because that surface also
+ * constructs workspace-settings schemas and workspace catalogs for `axm lint`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { HookRuleContext, KnowledgeRuleContext, McpServerRuleContext, PackRuleContext, RuleRuleContext, SkillRuleContext, SubagentRuleContext } from "./context.js";
+import type { LintRule } from "./rule.js";
+export { composePath } from "./compose-path.js";
+export { evaluateContexts, type Evaluated } from "./evaluate.js";
+export type { LintConfig } from "./config.js";
+export type { FileAccessError, HookContent, HookFileAccessor, HookRuleContext, KnowledgeContent, KnowledgeFileAccessor, KnowledgeRuleContext, RuleContent, RuleFileAccessor, RuleRuleContext, McpServerContent, McpServerFileAccessor, McpServerRuleContext, PackContent, PackFileAccessor, PackRuleContext, SkillContent, SkillFileAccessor, SkillRuleContext, SubagentContent, SubagentFileAccessor, SubagentRuleContext, } from "./context.js";
+export type { LintFinding, LintRule } from "./rule.js";
+export { makeVftPackFileAccessor, type PackVFTNode } from "./catalog/pack-accessor/vft.js";
+export { makeVftSkillFileAccessor, makeVftSkillFileAccessorScoped, type VFTNode, } from "./catalog/skill-accessor/vft.js";
+/**
+ * Ordered publish-safe `pack/*` rule catalog.
+ *
+ * This intentionally avoids `./catalog/pack.js`, whose module-load rule-id
+ * registration imports the workspace lint config schema.
+ */
+export declare const packRules: ReadonlyArray<LintRule<PackRuleContext>>;
+/**
+ * Ordered publish-safe `skill/*` rule catalog.
+ *
+ * This intentionally avoids `./catalog/skill.js`, whose module-load rule-id
+ * registration imports the workspace lint config schema.
+ */
+export declare const skillRules: ReadonlyArray<LintRule<SkillRuleContext>>;
+export declare const subagentRules: ReadonlyArray<LintRule<SubagentRuleContext>>;
+export declare const mcpServerRules: ReadonlyArray<LintRule<McpServerRuleContext>>;
+/**
+ * Ordered publish-safe `hook//*` rule catalog.
+ *
+ * Identical to `catalog/hook.ts`: `hook/matcher-raw-portability` used to be
+ * omitted here, which meant `axm publish` and `axm lint` disagreed about the
+ * same `hook.json`. It is a pure-manifest advisory at `warning` severity, and
+ * the publish gate fails only on `error` findings, so running it at publish
+ * time surfaces the portability advice to the author without gating the
+ * publish.
+ */
+export declare const hookRules: ReadonlyArray<LintRule<HookRuleContext>>;
+export declare const ruleRules: ReadonlyArray<LintRule<RuleRuleContext>>;
+export declare const knowledgeRules: ReadonlyArray<LintRule<KnowledgeRuleContext>>;
+//# sourceMappingURL=publish.d.ts.map

package/dist/src/unstable/lint/publish.js

@@ -0,0 +1,86 @@
+/**
+ * Registry-publish lint surface.
+ *
+ * This entry point intentionally exports only the primitives the registry
+ * publish gate needs. It avoids the full lint barrel because that surface also
+ * constructs workspace-settings schemas and workspace catalogs for `axm lint`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import { manifestKeysRecognizedRule as packManifestKeysRecognizedRule } from "./catalog/pack/manifest-keys-recognized.js";
+import { manifestPresentRule as packManifestPresentRule } from "./catalog/pack/manifest-present.js";
+import { manifestSchemaValidRule as packManifestSchemaValidRule } from "./catalog/pack/manifest-schema-valid.js";
+import { subagentEnvelopeRules } from "./catalog/subagent/envelope.js";
+import { mcpServerEnvelopeRules } from "./catalog/mcp-server/envelope.js";
+import { hookEnvelopeRules } from "./catalog/hook/envelope.js";
+import { ruleEnvelopeRules } from "./catalog/rule/envelope.js";
+import { knowledgeEnvelopeRules } from "./catalog/knowledge/envelope.js";
+import { orderedEnvelopeRules } from "./catalog/shared/envelope-rules.js";
+import { entrypointExistsRule as hookEntrypointExistsRule } from "./catalog/hook/entrypoint-exists.js";
+import { matcherRawPortabilityRule as hookMatcherRawPortabilityRule } from "./catalog/hook/matcher-raw-portability.js";
+import { decisionPortabilityRule as hookDecisionPortabilityRule } from "./catalog/hook/decision-portability.js";
+import { frontmatterParseableRule as skillFrontmatterParseableRule } from "./catalog/skill/frontmatter-parseable.js";
+import { frontmatterStandardValidRule as skillFrontmatterStandardValidRule } from "./catalog/skill/frontmatter-standard-valid.js";
+import { manifestKeysRecognizedRule as skillManifestKeysRecognizedRule } from "./catalog/skill/manifest-keys-recognized.js";
+import { manifestPresentRule as skillManifestPresentRule } from "./catalog/skill/manifest-present.js";
+import { manifestSchemaValidRule as skillManifestSchemaValidRule } from "./catalog/skill/manifest-schema-valid.js";
+import { skillMdPresentRule } from "./catalog/skill/skill-md-present.js";
+import { recommendedPacksValidRule as skillRecommendedPacksValidRule } from "./catalog/skill/recommended-packs-valid.js";
+import { standaloneDeclarationValidRule as skillStandaloneDeclarationValidRule } from "./catalog/skill/standalone-declaration-valid.js";
+export { composePath } from "./compose-path.js";
+export { evaluateContexts } from "./evaluate.js";
+export { makeVftPackFileAccessor } from "./catalog/pack-accessor/vft.js";
+export { makeVftSkillFileAccessor, makeVftSkillFileAccessorScoped, } from "./catalog/skill-accessor/vft.js";
+/**
+ * Ordered publish-safe `pack/*` rule catalog.
+ *
+ * This intentionally avoids `./catalog/pack.js`, whose module-load rule-id
+ * registration imports the workspace lint config schema.
+ */
+export const packRules = [
+    packManifestPresentRule,
+    packManifestSchemaValidRule,
+    packManifestKeysRecognizedRule,
+];
+/**
+ * Ordered publish-safe `skill/*` rule catalog.
+ *
+ * This intentionally avoids `./catalog/skill.js`, whose module-load rule-id
+ * registration imports the workspace lint config schema.
+ */
+export const skillRules = [
+    skillMdPresentRule,
+    skillManifestPresentRule,
+    skillFrontmatterParseableRule,
+    skillFrontmatterStandardValidRule,
+    skillManifestSchemaValidRule,
+    skillManifestKeysRecognizedRule,
+    skillStandaloneDeclarationValidRule,
+    skillRecommendedPacksValidRule,
+];
+export const subagentRules = orderedEnvelopeRules(subagentEnvelopeRules);
+export const mcpServerRules = orderedEnvelopeRules(mcpServerEnvelopeRules);
+/**
+ * Ordered publish-safe `hook//*` rule catalog.
+ *
+ * Identical to `catalog/hook.ts`: `hook/matcher-raw-portability` used to be
+ * omitted here, which meant `axm publish` and `axm lint` disagreed about the
+ * same `hook.json`. It is a pure-manifest advisory at `warning` severity, and
+ * the publish gate fails only on `error` findings, so running it at publish
+ * time surfaces the portability advice to the author without gating the
+ * publish.
+ */
+export const hookRules = [
+    hookEnvelopeRules.manifestPresent,
+    hookEnvelopeRules.manifestSchemaValid,
+    hookEnvelopeRules.manifestKeysRecognized,
+    hookDecisionPortabilityRule,
+    hookMatcherRawPortabilityRule,
+    hookEntrypointExistsRule,
+    hookEnvelopeRules.standaloneDeclarationValid,
+    hookEnvelopeRules.recommendedPacksValid,
+];
+export const ruleRules = orderedEnvelopeRules(ruleEnvelopeRules);
+export const knowledgeRules = orderedEnvelopeRules(knowledgeEnvelopeRules);
+//# sourceMappingURL=publish.js.map

package/dist/src/unstable/lint/rule.d.ts

@@ -0,0 +1,98 @@
+/**
+ * Lint rule and finding primitives.
+ *
+ * Library-style discriminated unions for the lint engine. Rules are plain
+ * values generic over a caller-built `RuleContext` — no Layer wiring and no
+ * ambient service bag. Findings are produced by `rule.check`; rules do not
+ * carry mutation or workflow guidance.
+ *
+ * Rule ids follow `<namespace>/<subject>-<predicate>` with lowercase letters,
+ * digits, and hyphens; ids leak into settings files, CI logs, and agent
+ * transcripts, so they are public API stable under a deprecation-alias policy
+ * per the `lint-engine` design doc.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type * as Effect from "effect/Effect";
+/**
+ * Platform-canonical finding severity.
+ *
+ * WorkspaceMutations `lint.rules` overrides can raise or lower the severity at
+ * evaluation time; the catalog pins the platform default.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export type Severity = "error" | "warning" | "info";
+/**
+ * Accessor-relative location of a finding.
+ *
+ * `file` is posix and relative to the rule context's accessor root (skill or
+ * pack manifest directory for per-extension rules, workspace root for workspace
+ * rules). Rules MUST NOT embed absolute paths, `displayRoot`-qualified paths,
+ * or source coordinates in `message`; the display path is composed from
+ * `context.displayRoot` and `location.file` at format time via `composePath`.
+ *
+ * `file: ""` targets the context root itself (e.g., a missing `SKILL.md` on a
+ * skill context).
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface FindingLocation {
+    readonly file: string;
+    readonly line?: number;
+    readonly column?: number;
+    readonly byteOffset?: number;
+    readonly byteLength?: number;
+}
+/**
+ * Fields common to all lint findings.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface FindingBase {
+    readonly ruleId: string;
+    readonly severity: Severity;
+    readonly message: string;
+    readonly location?: FindingLocation;
+}
+/**
+ * Intrinsic fact produced by a lint rule.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface AdvisoryFinding extends FindingBase {
+    readonly kind: "advisory";
+}
+/**
+ * Discriminated union of lint findings on `kind`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export type LintFinding = AdvisoryFinding;
+/**
+ * Fields common to all lint rules.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface RuleBase {
+    readonly id: string;
+    readonly description: string;
+    readonly severity: Severity;
+}
+/**
+ * Rule that only surfaces findings; never autofixes.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface AdvisoryRule<C> extends RuleBase {
+    readonly kind: "advisory";
+    readonly check: (context: C) => Effect.Effect<ReadonlyArray<AdvisoryFinding>>;
+}
+/**
+ * Discriminated union of lint rules over a caller-built rule-context type `C`.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export type LintRule<C> = AdvisoryRule<C>;
+//# sourceMappingURL=rule.d.ts.map

package/dist/src/unstable/lint/rule.js

@@ -0,0 +1,18 @@
+/**
+ * Lint rule and finding primitives.
+ *
+ * Library-style discriminated unions for the lint engine. Rules are plain
+ * values generic over a caller-built `RuleContext` — no Layer wiring and no
+ * ambient service bag. Findings are produced by `rule.check`; rules do not
+ * carry mutation or workflow guidance.
+ *
+ * Rule ids follow `<namespace>/<subject>-<predicate>` with lowercase letters,
+ * digits, and hyphens; ids leak into settings files, CI logs, and agent
+ * transcripts, so they are public API stable under a deprecation-alias policy
+ * per the `lint-engine` design doc.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+export {};
+//# sourceMappingURL=rule.js.map

package/dist/src/unstable/publish/archive-guardrails.d.ts

@@ -0,0 +1,39 @@
+import * as Effect from "effect/Effect";
+declare const ArchiveGuardrailError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ArchiveGuardrailError";
+} & Readonly<A>;
+export declare class ArchiveGuardrailError extends ArchiveGuardrailError_base<{
+    readonly code: "path_traversal" | "absolute_path" | "duplicate_entry" | "symlink_entry" | "unsupported_compression" | "malformed_archive" | "decompression_limit_exceeded" | "compression_ratio_exceeded" | "entry_count_exceeded" | "forbidden_entry";
+    readonly message: string;
+    readonly entry?: string;
+}> {
+}
+export declare const ZIP_LOCAL_SIGNATURE = 67324752;
+export interface ZipEntry {
+    readonly fileName: string;
+    readonly compressedSize: number;
+    readonly uncompressedSize: number;
+    readonly compressionMethod: number;
+    readonly externalAttributes: number;
+    readonly localHeaderOffset: number;
+}
+export interface ArchiveGuardrailLimits {
+    readonly maxEntries?: number;
+    readonly maxDecompressedBytes?: number;
+    readonly maxCompressionRatio?: number;
+}
+export declare const parseZipCentralDirectory: (buf: Uint8Array) => Effect.Effect<readonly ZipEntry[], ArchiveGuardrailError>;
+/**
+ * Reject archives carrying build or secret leftovers: any `node_modules` or
+ * `.git` path segment, and `.env` / `.env.*` files. Kept out of
+ * {@link validateArchive} on purpose — that function is the registry ingest
+ * contract, and archives accepted by earlier clients must keep ingesting.
+ *
+ * `.env*` matches the basename exactly (`.env`) or by dotted prefix
+ * (`.env.local`, `.env.production`, and also `.env.example`), so sibling names
+ * like `.envrc` and `environment.md` are unaffected.
+ */
+export declare const checkForbiddenSourceEntries: (entries: readonly ZipEntry[]) => Effect.Effect<void, ArchiveGuardrailError>;
+export declare const validateArchive: (archiveBytes: Uint8Array, limits?: ArchiveGuardrailLimits) => Effect.Effect<readonly ZipEntry[], ArchiveGuardrailError>;
+export {};
+//# sourceMappingURL=archive-guardrails.d.ts.map

package/dist/src/unstable/publish/archive-guardrails.js

@@ -0,0 +1,250 @@
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+export class ArchiveGuardrailError extends Data.TaggedError("ArchiveGuardrailError") {
+}
+const ZIP_EOCD_SIGNATURE = 0x06054b50;
+const ZIP_CDIR_SIGNATURE = 0x02014b50;
+export const ZIP_LOCAL_SIGNATURE = 0x04034b50;
+const COMPRESSION_STORE = 0;
+const COMPRESSION_DEFLATE = 8;
+const SUPPORTED_COMPRESSION = new Set([COMPRESSION_STORE, COMPRESSION_DEFLATE]);
+const S_IFLNK = 0xa000;
+const S_IFMT = 0xf000;
+const textDecoder = new TextDecoder();
+const DEFAULT_LIMITS = {
+    maxEntries: 10_000,
+    maxDecompressedBytes: 256 * 1024 * 1024,
+    maxCompressionRatio: 100,
+};
+const findEocdOffset = (buf) => Effect.gen(function* () {
+    const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+    const minOffset = Math.max(0, buf.length - 22 - 65535);
+    for (let i = buf.length - 22; i >= minOffset; i--) {
+        if (view.getUint32(i, true) === ZIP_EOCD_SIGNATURE) {
+            return i;
+        }
+    }
+    return yield* new ArchiveGuardrailError({
+        code: "malformed_archive",
+        message: "ZIP end-of-central-directory record not found.",
+    });
+});
+export const parseZipCentralDirectory = (buf) => Effect.gen(function* () {
+    if (buf.length < 22) {
+        return yield* new ArchiveGuardrailError({
+            code: "malformed_archive",
+            message: "Archive too small to be a valid ZIP file.",
+        });
+    }
+    const view = new DataView(buf.buffer, buf.byteOffset, buf.byteLength);
+    if (view.getUint32(0, true) !== ZIP_LOCAL_SIGNATURE) {
+        return yield* new ArchiveGuardrailError({
+            code: "malformed_archive",
+            message: "Archive does not start with a valid ZIP local file header signature.",
+        });
+    }
+    const eocdOffset = yield* findEocdOffset(buf);
+    const totalEntries = view.getUint16(eocdOffset + 10, true);
+    const cdirSize = view.getUint32(eocdOffset + 12, true);
+    const cdirOffset = view.getUint32(eocdOffset + 16, true);
+    if (cdirOffset + cdirSize > buf.length) {
+        return yield* new ArchiveGuardrailError({
+            code: "malformed_archive",
+            message: "Central directory offset and size exceed archive bounds.",
+        });
+    }
+    const entries = [];
+    let offset = cdirOffset;
+    for (let i = 0; i < totalEntries; i++) {
+        if (offset + 46 > buf.length) {
+            return yield* new ArchiveGuardrailError({
+                code: "malformed_archive",
+                message: `Central directory entry ${i} exceeds archive bounds.`,
+            });
+        }
+        const signature = view.getUint32(offset, true);
+        if (signature !== ZIP_CDIR_SIGNATURE) {
+            return yield* new ArchiveGuardrailError({
+                code: "malformed_archive",
+                message: `Invalid central directory entry signature at offset ${offset}.`,
+            });
+        }
+        const compressionMethod = view.getUint16(offset + 10, true);
+        const compressedSize = view.getUint32(offset + 20, true);
+        const uncompressedSize = view.getUint32(offset + 24, true);
+        const fileNameLength = view.getUint16(offset + 28, true);
+        const extraFieldLength = view.getUint16(offset + 30, true);
+        const fileCommentLength = view.getUint16(offset + 32, true);
+        const externalAttributes = view.getUint32(offset + 38, true);
+        const localHeaderOffset = view.getUint32(offset + 42, true);
+        const fileNameStart = offset + 46;
+        const fileNameEnd = fileNameStart + fileNameLength;
+        if (fileNameEnd > buf.length) {
+            return yield* new ArchiveGuardrailError({
+                code: "malformed_archive",
+                message: `File name for entry ${i} exceeds archive bounds.`,
+            });
+        }
+        const fileName = textDecoder.decode(buf.slice(fileNameStart, fileNameEnd));
+        entries.push({
+            fileName,
+            compressedSize,
+            uncompressedSize,
+            compressionMethod,
+            externalAttributes,
+            localHeaderOffset,
+        });
+        offset = fileNameEnd + extraFieldLength + fileCommentLength;
+    }
+    return entries;
+});
+const checkPathTraversal = (entries) => {
+    for (const entry of entries) {
+        const normalized = entry.fileName.replace(/\\/g, "/");
+        if (normalized.includes("../") || normalized.includes("/..") || normalized === "..") {
+            return Effect.fail(new ArchiveGuardrailError({
+                code: "path_traversal",
+                message: `Archive entry contains path traversal: "${entry.fileName}".`,
+                entry: entry.fileName,
+            }));
+        }
+    }
+    return Effect.void;
+};
+const checkAbsolutePaths = (entries) => {
+    for (const entry of entries) {
+        const normalized = entry.fileName.replace(/\\/g, "/");
+        if (normalized.startsWith("/") || /^[A-Za-z]:\//.test(normalized)) {
+            return Effect.fail(new ArchiveGuardrailError({
+                code: "absolute_path",
+                message: `Archive entry contains an absolute path: "${entry.fileName}".`,
+                entry: entry.fileName,
+            }));
+        }
+    }
+    return Effect.void;
+};
+const checkDuplicateEntries = (entries) => {
+    const seen = new Set();
+    for (const entry of entries) {
+        const normalized = entry.fileName.toLowerCase();
+        if (seen.has(normalized)) {
+            return Effect.fail(new ArchiveGuardrailError({
+                code: "duplicate_entry",
+                message: `Archive contains duplicate entry: "${entry.fileName}".`,
+                entry: entry.fileName,
+            }));
+        }
+        seen.add(normalized);
+    }
+    return Effect.void;
+};
+const checkSymlinks = (entries) => {
+    for (const entry of entries) {
+        const unixMode = entry.externalAttributes >>> 16;
+        if ((unixMode & S_IFMT) === S_IFLNK) {
+            return Effect.fail(new ArchiveGuardrailError({
+                code: "symlink_entry",
+                message: `Archive contains symlink entry: "${entry.fileName}".`,
+                entry: entry.fileName,
+            }));
+        }
+    }
+    return Effect.void;
+};
+const checkCompressionMethods = (entries) => {
+    for (const entry of entries) {
+        if (!SUPPORTED_COMPRESSION.has(entry.compressionMethod)) {
+            return Effect.fail(new ArchiveGuardrailError({
+                code: "unsupported_compression",
+                message: `Archive entry uses unsupported compression method ${entry.compressionMethod}: "${entry.fileName}".`,
+                entry: entry.fileName,
+            }));
+        }
+    }
+    return Effect.void;
+};
+const checkEntryCount = (entries, limits) => entries.length > limits.maxEntries
+    ? Effect.fail(new ArchiveGuardrailError({
+        code: "entry_count_exceeded",
+        message: `Archive contains ${entries.length} entries, exceeding the maximum allowed ${limits.maxEntries}.`,
+    }))
+    : Effect.void;
+const checkDecompressedSize = (entries, limits) => {
+    let totalUncompressed = 0;
+    for (const entry of entries) {
+        totalUncompressed += entry.uncompressedSize;
+        if (totalUncompressed > limits.maxDecompressedBytes) {
+            return Effect.fail(new ArchiveGuardrailError({
+                code: "decompression_limit_exceeded",
+                message: `Archive decompressed size exceeds maximum allowed ${limits.maxDecompressedBytes} bytes.`,
+                entry: entry.fileName,
+            }));
+        }
+    }
+    return Effect.void;
+};
+const checkCompressionRatio = (entries, limits) => {
+    for (const entry of entries) {
+        if (entry.compressedSize === 0) {
+            if (entry.uncompressedSize > 0) {
+                return Effect.fail(new ArchiveGuardrailError({
+                    code: "compression_ratio_exceeded",
+                    message: `Archive entry "${entry.fileName}" exceeds maximum compression ratio.`,
+                    entry: entry.fileName,
+                }));
+            }
+            continue;
+        }
+        const ratio = entry.uncompressedSize / entry.compressedSize;
+        if (ratio > limits.maxCompressionRatio) {
+            return Effect.fail(new ArchiveGuardrailError({
+                code: "compression_ratio_exceeded",
+                message: `Archive entry "${entry.fileName}" exceeds maximum compression ratio ${limits.maxCompressionRatio}.`,
+                entry: entry.fileName,
+            }));
+        }
+    }
+    return Effect.void;
+};
+const FORBIDDEN_SEGMENTS = new Set(["node_modules", ".git"]);
+/**
+ * Reject archives carrying build or secret leftovers: any `node_modules` or
+ * `.git` path segment, and `.env` / `.env.*` files. Kept out of
+ * {@link validateArchive} on purpose — that function is the registry ingest
+ * contract, and archives accepted by earlier clients must keep ingesting.
+ *
+ * `.env*` matches the basename exactly (`.env`) or by dotted prefix
+ * (`.env.local`, `.env.production`, and also `.env.example`), so sibling names
+ * like `.envrc` and `environment.md` are unaffected.
+ */
+export const checkForbiddenSourceEntries = (entries) => {
+    for (const entry of entries) {
+        const segments = entry.fileName.replace(/\\/g, "/").split("/");
+        const basename = segments[segments.length - 1] ?? "";
+        if (segments.some((segment) => FORBIDDEN_SEGMENTS.has(segment)) ||
+            basename === ".env" ||
+            basename.startsWith(".env.")) {
+            return Effect.fail(new ArchiveGuardrailError({
+                code: "forbidden_entry",
+                message: `Archive contains a forbidden entry: "${entry.fileName}".`,
+                entry: entry.fileName,
+            }));
+        }
+    }
+    return Effect.void;
+};
+export const validateArchive = (archiveBytes, limits) => Effect.gen(function* () {
+    const appliedLimits = { ...DEFAULT_LIMITS, ...limits };
+    const entries = yield* parseZipCentralDirectory(archiveBytes);
+    yield* checkPathTraversal(entries);
+    yield* checkAbsolutePaths(entries);
+    yield* checkDuplicateEntries(entries);
+    yield* checkSymlinks(entries);
+    yield* checkCompressionMethods(entries);
+    yield* checkEntryCount(entries, appliedLimits);
+    yield* checkDecompressedSize(entries, appliedLimits);
+    yield* checkCompressionRatio(entries, appliedLimits);
+    return entries;
+});
+//# sourceMappingURL=archive-guardrails.js.map

package/dist/src/unstable/publish/filtered-package-validation.d.ts

@@ -0,0 +1,24 @@
+import * as Effect from "effect/Effect";
+import type { ExtensionType } from "@agentxm/extension-model/unstable/extensions";
+import type { ArchiveGuardrailError, ZipEntry } from "./archive-guardrails.js";
+import type { ResolvedManifest } from "./manifest-policy.js";
+declare const FilteredPackageError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "FilteredPackageError";
+} & Readonly<A>;
+/** A type-specific package invariant failed against the filtered archive. */
+export declare class FilteredPackageError extends FilteredPackageError_base<{
+    readonly code: "required_file_missing" | "content_invalid" | "reference_invalid";
+    readonly detail: string;
+    readonly path?: string;
+}> {
+}
+export interface ValidateFilteredPackageArgs {
+    readonly type: ExtensionType;
+    readonly entries: ReadonlyArray<ZipEntry>;
+    readonly manifest: ResolvedManifest;
+    readonly readEntry: (fileName: string) => Effect.Effect<Uint8Array, ArchiveGuardrailError | FilteredPackageError>;
+}
+/** Validate the complete type-specific package after Registry-only filtering. */
+export declare const validateFilteredPackage: (args: ValidateFilteredPackageArgs) => Effect.Effect<void, FilteredPackageError>;
+export {};
+//# sourceMappingURL=filtered-package-validation.d.ts.map