@agentxm/workspace-lint 0.28.4-bootstrap.0

package/dist/src/catalog/workspace/lockfile-valid.js

@@ -0,0 +1,63 @@
+/** Reports whether accepted external-resolution state is readable and present when required. */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import { isWorkspaceSourceLocator } from "@agentxm/extension-model/unstable/sources/workspace";
+import { lockfileDisplayPath } from "./display-paths.js";
+const RULE_ID = "workspace/lockfile-valid";
+const isExternalSource = (source) => !isWorkspaceSourceLocator(source);
+const finding = (message, path) => ({
+    kind: "advisory",
+    ruleId: RULE_ID,
+    severity: "error",
+    message,
+    location: { file: path },
+});
+export const lockfileValidRule = {
+    id: RULE_ID,
+    description: "Accepted external-resolution state is current, readable, and present when required.",
+    kind: "advisory",
+    severity: "error",
+    check: (context) => Effect.gen(function* () {
+        const lockfileResult = yield* Effect.result(context.workspace.state.lockfile);
+        const lockfilePath = lockfileDisplayPath(context.subject.scope);
+        if (Result.isFailure(lockfileResult)) {
+            if (lockfileResult.failure._tag === "LockfileDecodeError") {
+                return lockfileResult.failure.issues.map((issue) => finding(`The accepted external-resolution lockfile does not match the current schema: ${issue}`, lockfilePath));
+            }
+            return [
+                finding(`The accepted external-resolution lockfile is unreadable: ${lockfileResult.failure._tag}`, lockfilePath),
+            ];
+        }
+        if (Option.isSome(lockfileResult.success))
+            return [];
+        if (context.health !== undefined) {
+            const graph = yield* Effect.result(context.health.desiredState);
+            if (Result.isSuccess(graph) &&
+                graph.success.nodes.some((node) => node.source !== undefined && isExternalSource(node.source))) {
+                return [
+                    finding("Accepted external-resolution state is missing for desired external content.", lockfilePath),
+                ];
+            }
+            return [];
+        }
+        const settings = yield* Effect.result(context.workspace.state.settings);
+        if (Result.isFailure(settings) || Option.isNone(settings.success))
+            return [];
+        const declarations = [
+            ...Object.values(settings.success.value.skills ?? {}),
+            ...Object.values(settings.success.value.packs ?? {}),
+            ...Object.values(settings.success.value.subagents ?? {}),
+            ...Object.values(settings.success.value.mcpServers ?? {}),
+            ...Object.values(settings.success.value.rules ?? {}),
+            ...Object.values(settings.success.value.hooks ?? {}),
+            ...Object.values(settings.success.value.knowledge ?? {}),
+        ];
+        return declarations.some((entry) => entry.source !== undefined && isExternalSource(entry.source))
+            ? [
+                finding("Accepted external-resolution state is missing for desired external content.", lockfilePath),
+            ]
+            : [];
+    }),
+};
+//# sourceMappingURL=lockfile-valid.js.map

package/dist/src/catalog/workspace/managed-file-unowned.d.ts

@@ -0,0 +1,4 @@
+import type { WorkspaceRuleContext } from "../../workspace-context.js";
+import type { AdvisoryRule } from "@agentxm/registry-protocol/unstable/lint/rule";
+export declare const managedFileUnownedRule: AdvisoryRule<WorkspaceRuleContext>;
+//# sourceMappingURL=managed-file-unowned.d.ts.map

package/dist/src/catalog/workspace/managed-file-unowned.js

@@ -0,0 +1,25 @@
+import * as Effect from "effect/Effect";
+import { EMPTY_LINT_FINDINGS } from "./helpers/empty.js";
+const RULE_ID = "workspace/managed-file-unowned";
+const relativeToRoot = (root, file) => {
+    const prefix = `${root}/`;
+    return file.startsWith(prefix) ? file.slice(prefix.length) : file;
+};
+export const managedFileUnownedRule = {
+    id: RULE_ID,
+    description: "Agent-directory artifacts have a resolvable AXM ownership proof.",
+    kind: "advisory",
+    severity: "warning",
+    check: (context) => context.ownership === undefined
+        ? Effect.succeed(EMPTY_LINT_FINDINGS)
+        : context.ownership.pipe(Effect.map((issues) => issues
+            .filter((issue) => issue.kind === "managed-file-unowned")
+            .map((issue) => ({
+            kind: "advisory",
+            ruleId: RULE_ID,
+            severity: "warning",
+            message: issue.detail,
+            location: { file: relativeToRoot(context.subject.root, issue.path) },
+        })))),
+};
+//# sourceMappingURL=managed-file-unowned.js.map

package/dist/src/catalog/workspace/mcps-agent-drift.d.ts

@@ -0,0 +1,4 @@
+import type { WorkspaceRuleContext } from "../../workspace-context.js";
+import type { AdvisoryRule } from "@agentxm/registry-protocol/unstable/lint/rule";
+export declare const mcpServerAgentDriftRule: AdvisoryRule<WorkspaceRuleContext>;
+//# sourceMappingURL=mcps-agent-drift.d.ts.map

package/dist/src/catalog/workspace/mcps-agent-drift.js

@@ -0,0 +1,139 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import { CONFIGURABLE_AGENTS_BY_ID, } from "@agentxm/extension-model/unstable/agent-capabilities";
+import { isAxmManagedMcpEntry } from "@agentxm/workspace-state";
+import { diffAgentEntry, inferInlineRemoteTransport, projectExpectedEntry, resolveSharedMcpTarget, planMcpTargetGroups, } from "@agentxm/extension-workspace";
+const RULE_ID = "workspace/mcps-agent-drift";
+const relativeToRoot = (root, file) => {
+    if (file === root)
+        return "";
+    const prefix = root.endsWith("/") ? root : `${root}/`;
+    return file.startsWith(prefix) ? file.slice(prefix.length) : file;
+};
+const hasMcpConfig = (capability) => capability.axm.writer !== null && "transports" in capability.native;
+const isCapabilityAgentId = (agentId) => agentId in CONFIGURABLE_AGENTS_BY_ID;
+const isInlineEntry = (entry) => entry.command !== undefined || entry.url !== undefined;
+const configuredEntry = (row) => row.installationOrigin._tag === "direct" ? row.installationOrigin.declared.entry : undefined;
+const managedConfigActuals = (actuals) => actuals.filter((actual) => (actual.origin._tag === "agent-mcp-config" ||
+    actual.origin._tag === "workspace-mcp-config") &&
+    actual.config !== null &&
+    isAxmManagedMcpEntry(actual.config));
+const configuredAgentIds = (context) => Effect.gen(function* () {
+    const settings = yield* Effect.result(context.workspace.state.settings);
+    if (Result.isFailure(settings) || Option.isNone(settings.success)) {
+        return new Set();
+    }
+    return new Set(settings.success.value.agents ?? []);
+});
+const findingFor = (args) => {
+    const finding = {
+        kind: "advisory",
+        ruleId: RULE_ID,
+        severity: "warning",
+        message: `MCP server '${args.name}' has drifted ${args.actual.origin._tag === "agent-mcp-config" ? `agent config for ${args.actual.origin.agentId}` : `shared config for ${args.consumers.join(", ")}`} ` +
+            `(${args.fields.join(", ")}).`,
+    };
+    return args.actual.configFile === null
+        ? finding
+        : { ...finding, location: { file: relativeToRoot(args.root, args.actual.configFile) } };
+};
+const configFileMatchesTarget = (configFile, targetPath) => configFile === targetPath ||
+    configFile.endsWith(`/${targetPath}`) ||
+    (targetPath.startsWith("~/") && configFile.endsWith(`/${targetPath.slice(2)}`));
+const checkActual = (args) => {
+    if (args.actual.config === null || args.actual.configFile === null)
+        return undefined;
+    const groups = planMcpTargetGroups({
+        configuredAgentIds: [...args.configuredAgents],
+        entry: args.entry,
+        scope: args.row.key.scope,
+    });
+    const agentId = args.actual.origin._tag === "agent-mcp-config" ? args.actual.origin.agentId : undefined;
+    const group = groups.find((candidate) => {
+        const [first] = candidate.members;
+        if (first === undefined)
+            return false;
+        if (!configFileMatchesTarget(args.actual.configFile ?? "", first.target.path))
+            return false;
+        return agentId !== undefined
+            ? candidate.members.some((member) => member.agentId === agentId)
+            : first.target.attribution === "shared";
+    });
+    if (group === undefined)
+        return undefined;
+    const projectionMember = agentId !== undefined
+        ? group.members.find((member) => member.agentId === agentId)
+        : group.members[0];
+    if (projectionMember === undefined || !isCapabilityAgentId(projectionMember.agentId)) {
+        return undefined;
+    }
+    const capability = CONFIGURABLE_AGENTS_BY_ID[projectionMember.agentId].capabilities["mcp-server"];
+    if (!hasMcpConfig(capability))
+        return undefined;
+    const inference = args.entry.url === undefined ? undefined : inferInlineRemoteTransport(args.entry.url);
+    const transport = args.entry.command !== undefined
+        ? "stdio"
+        : inference?._tag === "supported"
+            ? inference.transport
+            : undefined;
+    if (transport === undefined)
+        return undefined;
+    const resolution = resolveSharedMcpTarget({ members: group.members, transport });
+    if (resolution._tag === "conflict")
+        return undefined;
+    const config = resolution.config;
+    const projected = projectExpectedEntry({
+        serverName: args.row.key.name,
+        entry: args.entry,
+        stdio: config.stdio,
+        remote: config.remote,
+        activationField: config.activationField,
+        envExpansion: capability.native.mcpEnvExpansion,
+    });
+    if (projected._tag !== "projected")
+        return undefined;
+    const drift = diffAgentEntry(projected, args.actual.config);
+    return drift._tag === "drift"
+        ? {
+            row: args.row,
+            actual: args.actual,
+            fields: drift.fields,
+            consumers: group.members.map((member) => member.agentId),
+        }
+        : undefined;
+};
+const driftedAgentConfigs = (rows, configuredAgents) => rows.flatMap((row) => {
+    const entry = configuredEntry(row);
+    if (entry === undefined || !isInlineEntry(entry))
+        return [];
+    return managedConfigActuals(row.actual).flatMap((actual) => {
+        if (actual.origin._tag === "agent-mcp-config" &&
+            !configuredAgents.has(actual.origin.agentId)) {
+            return [];
+        }
+        const drift = checkActual({ row, entry, actual, configuredAgents });
+        return drift === undefined ? [] : [drift];
+    });
+});
+const findingsForRows = (rows, configuredAgents, root) => driftedAgentConfigs(rows, configuredAgents).map((drift) => findingFor({
+    name: drift.row.key.name,
+    actual: drift.actual,
+    fields: drift.fields,
+    consumers: drift.consumers,
+    root,
+}));
+export const mcpServerAgentDriftRule = {
+    id: RULE_ID,
+    description: "Managed MCP server agent configs match AXM settings.",
+    kind: "advisory",
+    severity: "warning",
+    check: (context) => Effect.gen(function* () {
+        const rows = yield* Effect.result(context.workspace.mcpServers.installed);
+        if (Result.isFailure(rows))
+            return [];
+        const agents = yield* configuredAgentIds(context);
+        return findingsForRows(rows.success, agents, context.subject.root);
+    }),
+};
+//# sourceMappingURL=mcps-agent-drift.js.map

package/dist/src/catalog/workspace/mcps-agent-orphaned.d.ts

@@ -0,0 +1,4 @@
+import type { WorkspaceRuleContext } from "../../workspace-context.js";
+import type { AdvisoryRule } from "@agentxm/registry-protocol/unstable/lint/rule";
+export declare const mcpServerAgentOrphanedRule: AdvisoryRule<WorkspaceRuleContext>;
+//# sourceMappingURL=mcps-agent-orphaned.d.ts.map

package/dist/src/catalog/workspace/mcps-agent-orphaned.js

@@ -0,0 +1,64 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import { isAxmManagedMcpEntry } from "@agentxm/workspace-state";
+import { groupConfiguredMcpTargets } from "@agentxm/extension-workspace";
+const RULE_ID = "workspace/mcps-agent-orphaned";
+const isManagedConfigEntry = (row) => (row.actual.origin._tag === "agent-mcp-config" ||
+    row.actual.origin._tag === "workspace-mcp-config") &&
+    row.actual.config !== null &&
+    isAxmManagedMcpEntry(row.actual.config);
+const configuredAgentIds = (context) => Effect.gen(function* () {
+    const settings = yield* Effect.result(context.workspace.state.settings);
+    if (Result.isFailure(settings) || Option.isNone(settings.success)) {
+        return new Set();
+    }
+    return new Set(settings.success.value.agents ?? []);
+});
+const findingFor = (row) => {
+    const target = row.actual.origin._tag === "agent-mcp-config"
+        ? `agent config for ${row.actual.origin.agentId}`
+        : "shared config";
+    const finding = {
+        kind: "advisory",
+        ruleId: RULE_ID,
+        severity: "warning",
+        message: `MCP server '${row.key.name}' has an orphaned AXM-owned ${target}.`,
+    };
+    return row.actual.configFile === null
+        ? finding
+        : { ...finding, location: { file: row.actual.configFile } };
+};
+const orphanedRows = (rows) => rows.filter(isManagedConfigEntry);
+const configFileMatchesTarget = (configFile, targetPath) => configFile === targetPath ||
+    configFile.endsWith(`/${targetPath}`) ||
+    (targetPath.startsWith("~/") && configFile.endsWith(`/${targetPath.slice(2)}`));
+const isConfiguredAgentRow = (row, configuredAgents) => row.actual.origin._tag === "agent-mcp-config"
+    ? configuredAgents.has(row.actual.origin.agentId)
+    : row.actual.configFile !== null &&
+        groupConfiguredMcpTargets({
+            agentIds: [...configuredAgents],
+            scope: row.key.scope,
+        }).some((group) => {
+            const [first] = group.members;
+            return (first !== undefined &&
+                first.target.attribution === "shared" &&
+                configFileMatchesTarget(row.actual.configFile ?? "", first.target.path));
+        });
+const findingsForRows = (rows, configuredAgents) => orphanedRows(rows)
+    .filter((row) => isConfiguredAgentRow(row, configuredAgents))
+    .map(findingFor);
+export const mcpServerAgentOrphanedRule = {
+    id: RULE_ID,
+    description: "Managed MCP server agent configs are declared in AXM settings.",
+    kind: "advisory",
+    severity: "warning",
+    check: (context) => Effect.gen(function* () {
+        const rows = yield* Effect.result(context.workspace.mcpServers.unmanaged);
+        if (Result.isFailure(rows))
+            return [];
+        const agents = yield* configuredAgentIds(context);
+        return findingsForRows(rows.success, agents);
+    }),
+};
+//# sourceMappingURL=mcps-agent-orphaned.js.map

package/dist/src/catalog/workspace/mcps-no-secret-literal.d.ts

@@ -0,0 +1,4 @@
+import type { WorkspaceRuleContext } from "../../workspace-context.js";
+import type { AdvisoryRule } from "@agentxm/registry-protocol/unstable/lint/rule";
+export declare const mcpServerNoSecretLiteralRule: AdvisoryRule<WorkspaceRuleContext>;
+//# sourceMappingURL=mcps-no-secret-literal.d.ts.map

package/dist/src/catalog/workspace/mcps-no-secret-literal.js

@@ -0,0 +1,67 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import { settingsDisplayPath } from "./display-paths.js";
+import { EMPTY_ADVISORY_FINDINGS } from "./helpers/empty.js";
+const RULE_ID = "workspace/mcps-no-secret-literal";
+const SECRET_KEY_RE = /(authorization|bearer|token|secret|password|api[-_]?key|access[-_]?key)/i;
+const TOKEN_VALUE_RE = /^(gh[pousr]_|sk-[A-Za-z0-9]|xox[baprs]-|eyJ[A-Za-z0-9_-]{20,}|[A-Za-z0-9_-]{32,})/;
+const ENV_REF_RE = /\$\{[A-Za-z_][A-Za-z0-9_]*\}/;
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const parseSettings = (bytes) => {
+    try {
+        const parsed = JSON.parse(bytes);
+        return isRecord(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const isSecretLiteral = (name, value) => {
+    if (value.trim().length === 0)
+        return false;
+    if (ENV_REF_RE.test(value))
+        return false;
+    return SECRET_KEY_RE.test(name) || TOKEN_VALUE_RE.test(value);
+};
+const findingFor = (serverName, field, settingsPath) => ({
+    kind: "advisory",
+    ruleId: RULE_ID,
+    severity: "warning",
+    message: `MCP server '${serverName}' stores a secret-looking literal in ${field}. ` +
+        "Use a `${VAR}` reference so axm.json does not contain the secret.",
+    location: { file: settingsPath },
+});
+const collectRecordFindings = (serverName, fieldPrefix, value, settingsPath) => {
+    if (!isRecord(value))
+        return [];
+    return Object.entries(value).flatMap(([key, item]) => typeof item === "string" && isSecretLiteral(key, item)
+        ? [findingFor(serverName, `${fieldPrefix}.${key}`, settingsPath)]
+        : []);
+};
+export const mcpServerNoSecretLiteralRule = {
+    id: RULE_ID,
+    description: "MCP server settings use env references instead of secret literals.",
+    kind: "advisory",
+    severity: "warning",
+    check: (context) => Effect.gen(function* () {
+        const raw = yield* Effect.result(context.workspace.state.raw("settings"));
+        if (Result.isFailure(raw) || Option.isNone(raw.success))
+            return EMPTY_ADVISORY_FINDINGS;
+        const settings = parseSettings(raw.success.value.bytes);
+        if (settings === undefined)
+            return EMPTY_ADVISORY_FINDINGS;
+        const mcpServers = settings["mcpServers"];
+        if (!isRecord(mcpServers))
+            return EMPTY_ADVISORY_FINDINGS;
+        return Object.entries(mcpServers).flatMap(([serverName, entry]) => {
+            if (!isRecord(entry))
+                return [];
+            return [
+                ...collectRecordFindings(serverName, "env", entry["env"], settingsDisplayPath(context.subject.scope)),
+                ...collectRecordFindings(serverName, "headers", entry["headers"], settingsDisplayPath(context.subject.scope)),
+            ];
+        });
+    }),
+};
+//# sourceMappingURL=mcps-no-secret-literal.js.map

package/dist/src/catalog/workspace/mcps-shared-target-compatible.d.ts

@@ -0,0 +1,4 @@
+import type { WorkspaceRuleContext } from "../../workspace-context.js";
+import type { AdvisoryRule } from "@agentxm/registry-protocol/unstable/lint/rule";
+export declare const mcpServerSharedTargetCompatibleRule: AdvisoryRule<WorkspaceRuleContext>;
+//# sourceMappingURL=mcps-shared-target-compatible.d.ts.map

package/dist/src/catalog/workspace/mcps-shared-target-compatible.js

@@ -0,0 +1,58 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import { inferInlineRemoteTransport, resolveSharedMcpTarget, groupConfiguredMcpTargets, } from "@agentxm/extension-workspace";
+import { settingsDisplayPath } from "./display-paths.js";
+const RULE_ID = "workspace/mcps-shared-target-compatible";
+const transportFor = (entry) => {
+    if (entry.command !== undefined)
+        return "stdio";
+    if (entry.url === undefined)
+        return undefined;
+    const inference = inferInlineRemoteTransport(entry.url);
+    return inference._tag === "supported" ? inference.transport : undefined;
+};
+const findingFor = (serverName, path, reason, settingsPath) => ({
+    kind: "advisory",
+    ruleId: RULE_ID,
+    severity: "error",
+    message: "MCP server '" +
+        serverName +
+        "' projects a value that another configured agent rejects in shared target '" +
+        path +
+        "'. " +
+        reason +
+        " Update the configured agents or their MCP compatibility metadata before syncing.",
+    location: { file: settingsPath },
+});
+export const mcpServerSharedTargetCompatibleRule = {
+    id: RULE_ID,
+    description: "Configured agents accept the values projected into shared MCP config targets.",
+    kind: "advisory",
+    severity: "error",
+    check: (context) => Effect.gen(function* () {
+        const settings = yield* Effect.result(context.workspace.state.settings);
+        if (Result.isFailure(settings) || Option.isNone(settings.success))
+            return [];
+        const agentIds = settings.success.value.agents ?? [];
+        const entries = settings.success.value.mcpServers ?? {};
+        const groups = groupConfiguredMcpTargets({
+            agentIds,
+            scope: context.subject.scope,
+        }).filter((group) => group.members.length > 1);
+        return Object.entries(entries).flatMap(([serverName, entry]) => {
+            const transport = transportFor(entry);
+            if (transport === undefined)
+                return [];
+            return groups.flatMap((group) => {
+                const resolution = resolveSharedMcpTarget({ members: group.members, transport });
+                return resolution._tag === "conflict"
+                    ? [
+                        findingFor(serverName, resolution.path, resolution.reason, settingsDisplayPath(context.subject.scope)),
+                    ]
+                    : [];
+            });
+        });
+    }),
+};
+//# sourceMappingURL=mcps-shared-target-compatible.js.map

package/dist/src/catalog/workspace/mcps-transport-exclusivity.d.ts

@@ -0,0 +1,4 @@
+import type { WorkspaceRuleContext } from "../../workspace-context.js";
+import type { AdvisoryRule } from "@agentxm/registry-protocol/unstable/lint/rule";
+export declare const mcpServerTransportExclusivityRule: AdvisoryRule<WorkspaceRuleContext>;
+//# sourceMappingURL=mcps-transport-exclusivity.d.ts.map

package/dist/src/catalog/workspace/mcps-transport-exclusivity.js

@@ -0,0 +1,67 @@
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import { settingsDisplayPath } from "./display-paths.js";
+import { EMPTY_ADVISORY_FINDINGS } from "./helpers/empty.js";
+const RULE_ID = "workspace/mcps-transport-exclusivity";
+const isRecord = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+const hasOwnValue = (entry, key) => Object.hasOwn(entry, key) && entry[key] !== undefined;
+const parseSettings = (bytes) => {
+    try {
+        const parsed = JSON.parse(bytes);
+        return isRecord(parsed) ? parsed : undefined;
+    }
+    catch {
+        return undefined;
+    }
+};
+const transportError = (entry) => {
+    const transports = ["source", "command", "url"].filter((key) => hasOwnValue(entry, key));
+    if (transports.length !== 1) {
+        return "must include exactly one of source, command, or url";
+    }
+    if (hasOwnValue(entry, "source") &&
+        (hasOwnValue(entry, "args") || hasOwnValue(entry, "headers"))) {
+        return "source entries cannot include args or headers";
+    }
+    if (hasOwnValue(entry, "command") && hasOwnValue(entry, "headers")) {
+        return "command entries cannot include headers";
+    }
+    if (hasOwnValue(entry, "url") && hasOwnValue(entry, "args")) {
+        return "URL entries cannot include args";
+    }
+    return undefined;
+};
+const findingFor = (name, reason, settingsPath) => ({
+    kind: "advisory",
+    ruleId: RULE_ID,
+    severity: "warning",
+    message: `MCP server '${name}' ${reason}. Edit \`${settingsPath}\` so each MCP server uses one transport.`,
+    location: { file: settingsPath },
+});
+export const mcpServerTransportExclusivityRule = {
+    id: RULE_ID,
+    description: "MCP server settings entries use exactly one transport.",
+    kind: "advisory",
+    severity: "warning",
+    check: (context) => Effect.gen(function* () {
+        const raw = yield* Effect.result(context.workspace.state.raw("settings"));
+        if (Result.isFailure(raw) || Option.isNone(raw.success))
+            return EMPTY_ADVISORY_FINDINGS;
+        const settings = parseSettings(raw.success.value.bytes);
+        if (settings === undefined)
+            return EMPTY_ADVISORY_FINDINGS;
+        const mcpServers = settings["mcpServers"];
+        if (!isRecord(mcpServers))
+            return EMPTY_ADVISORY_FINDINGS;
+        return Object.entries(mcpServers).flatMap(([name, entry]) => {
+            if (!isRecord(entry))
+                return [];
+            const reason = transportError(entry);
+            return reason === undefined
+                ? []
+                : [findingFor(name, reason, settingsDisplayPath(context.subject.scope))];
+        });
+    }),
+};
+//# sourceMappingURL=mcps-transport-exclusivity.js.map

package/dist/src/catalog/workspace/packs-declarations-valid.d.ts

@@ -0,0 +1,19 @@
+/**
+ * `workspace/packs-declarations-valid` — declared packs name a resolvable,
+ * owner-qualified, unique source.
+ *
+ * Mirrors `workspace/skills-declarations-valid` against the packs map:
+ *
+ * 1. Source resolvability — pack source is not a bare name.
+ * 2. Owner qualification — registry-shaped pack sources carry `@owner/`.
+ * 3. Duplicate FQNs — two settings entries normalize to the same FQN.
+ *
+ * One finding per affected entity. Advisory.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { WorkspaceRuleContext } from "../../workspace-context.js";
+import type { AdvisoryRule } from "@agentxm/registry-protocol/unstable/lint/rule";
+export declare const packsDeclarationsValidRule: AdvisoryRule<WorkspaceRuleContext>;
+//# sourceMappingURL=packs-declarations-valid.d.ts.map

package/dist/src/catalog/workspace/packs-declarations-valid.js

@@ -0,0 +1,110 @@
+/**
+ * `workspace/packs-declarations-valid` — declared packs name a resolvable,
+ * owner-qualified, unique source.
+ *
+ * Mirrors `workspace/skills-declarations-valid` against the packs map:
+ *
+ * 1. Source resolvability — pack source is not a bare name.
+ * 2. Owner qualification — registry-shaped pack sources carry `@owner/`.
+ * 3. Duplicate FQNs — two settings entries normalize to the same FQN.
+ *
+ * One finding per affected entity. Advisory.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import * as Effect from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Result from "effect/Result";
+import { settingsDisplayPath } from "./display-paths.js";
+import { EMPTY_ADVISORY_FINDINGS } from "./helpers/empty.js";
+import { categorizeEntry } from "./helpers/source-categorize.js";
+const RULE_ID = "workspace/packs-declarations-valid";
+const bareNameFinding = (entry, settingsPath) => ({
+    kind: "advisory",
+    ruleId: RULE_ID,
+    severity: "error",
+    message: `Pack '${entry.name}' uses ambiguous bare source '${entry.source}'.`,
+    location: { file: settingsPath },
+});
+const nonRegistryFinding = (entry, settingsPath) => ({
+    kind: "advisory",
+    ruleId: RULE_ID,
+    severity: "error",
+    message: `Pack '${entry.name}' source '${entry.source}' is not a supported Pack source reference.`,
+    location: { file: settingsPath },
+});
+const missingOwnerFinding = (entry, settingsPath) => ({
+    kind: "advisory",
+    ruleId: RULE_ID,
+    severity: "error",
+    message: `Pack '${entry.name}' source '${entry.source}' is missing its owner-qualified identity.`,
+    location: { file: settingsPath },
+});
+const duplicateFinding = (entry, duplicates, settingsPath) => ({
+    kind: "advisory",
+    ruleId: RULE_ID,
+    severity: "error",
+    message: `Pack '${entry.name}' duplicates the same Pack identity as: ${duplicates.join(", ")}.`,
+    location: { file: settingsPath },
+});
+export const packsDeclarationsValidRule = {
+    id: RULE_ID,
+    description: "Declared packs use unique, resolvable registry sources.",
+    kind: "advisory",
+    severity: "error",
+    check: (context) => Effect.gen(function* () {
+        const scoped = context.workspace;
+        const declaredResult = yield* Effect.result(scoped.packs.declared);
+        if (Result.isFailure(declaredResult) || Option.isNone(declaredResult.success)) {
+            return EMPTY_ADVISORY_FINDINGS;
+        }
+        const entries = declaredResult.success.value.map(({ name, entry }) => categorizeEntry(name, entry.source));
+        const byFqn = new Map();
+        for (const entry of entries) {
+            if ((entry.kind === "registry" || entry.kind === "workspace") &&
+                entry.registryFqn !== undefined) {
+                const group = byFqn.get(entry.registryFqn) ?? [];
+                group.push(entry);
+                byFqn.set(entry.registryFqn, group);
+            }
+        }
+        const findings = [];
+        const settingsPath = settingsDisplayPath(context.subject.scope);
+        for (const entry of entries) {
+            switch (entry.kind) {
+                case "bare":
+                    findings.push(bareNameFinding(entry, settingsPath));
+                    break;
+                case "non-registry":
+                    findings.push(nonRegistryFinding(entry, settingsPath));
+                    break;
+                case "registry-no-owner":
+                    findings.push(missingOwnerFinding(entry, settingsPath));
+                    break;
+                case "registry": {
+                    if (entry.registryFqn === undefined) {
+                        break;
+                    }
+                    const group = byFqn.get(entry.registryFqn) ?? [];
+                    if (group.length > 1) {
+                        findings.push(duplicateFinding(entry, group.map((g) => g.name).sort(), settingsPath));
+                    }
+                    break;
+                }
+                case "workspace": {
+                    if (entry.registryFqn === undefined) {
+                        break;
+                    }
+                    const group = byFqn.get(entry.registryFqn) ?? [];
+                    if (group.length > 1) {
+                        findings.push(duplicateFinding(entry, group.map((g) => g.name).sort(), settingsPath));
+                    }
+                    break;
+                }
+            }
+        }
+        return findings;
+    }),
+};
+//# sourceMappingURL=packs-declarations-valid.js.map

package/dist/src/catalog/workspace/packs-dependencies-resolved.d.ts

@@ -0,0 +1,5 @@
+import type { WorkspaceRuleContext } from "../../workspace-context.js";
+import type { AdvisoryRule } from "@agentxm/registry-protocol/unstable/lint/rule";
+/** Pack membership comes from the desired graph; lock rows only prove external resolution. */
+export declare const packsDependenciesResolvedRule: AdvisoryRule<WorkspaceRuleContext>;
+//# sourceMappingURL=packs-dependencies-resolved.d.ts.map