@agentxm/workspace-lint 0.28.4-bootstrap.0

package/dist/src/catalog/workspace-read-model/manifest-json.js

@@ -0,0 +1,27 @@
+/**
+ * Manifest JSON reader for workspace lint projections.
+ *
+ * Reads through the already-rooted per-extension file accessor, parses loose
+ * JSON, and returns the raw parsed value. It intentionally does not decode
+ * against a manifest schema because unknown keys must remain visible to the
+ * `*-keys-recognized` rules.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { makeManifestJsonParseFailure } from "@agentxm/registry-protocol/unstable/lint/catalog/shared/manifest-json";
+const decoder = new TextDecoder();
+export const readManifestJson = (accessor, filename) => Effect.gen(function* () {
+    const exists = yield* accessor.exists(filename);
+    if (!exists) {
+        return undefined;
+    }
+    const bytes = yield* accessor.readBytes(filename).pipe(Effect.catch(() => Effect.void));
+    if (bytes === undefined) {
+        return undefined;
+    }
+    const raw = decoder.decode(bytes);
+    return yield* Schema.decodeUnknownEffect(Schema.fromJsonString(Schema.Unknown))(raw).pipe(Effect.catch(() => Effect.succeed(makeManifestJsonParseFailure(filename))));
+});
+//# sourceMappingURL=manifest-json.js.map

package/dist/src/catalog/workspace.d.ts

@@ -0,0 +1,58 @@
+/**
+ * `workspace/*` rule catalog — the v1 rule set.
+ *
+ * Per the lint design, `axm lint` (locally only —
+ * never publish) runs exactly these rules against each workspace read model.
+ * Rules are grouped by classification invariant — foundation first, then
+ * one group per invariant that install-family rules enforce:
+ *
+ * | ID                                      | Severity | Autofix     |
+ * | --------------------------------------- | -------- | ----------- |
+ * | `workspace/initialized`                 | error    | —           |
+ * | `workspace/settings-schema-valid`       | error    | —           |
+ * | `workspace/settings-keys-recognized`    | error    | —           |
+ * | `workspace/lockfile-valid`              | error    | autofixing  |
+ * | `workspace/desired-state-reconcilable`  | error    | —           |
+ * | `workspace/agents-recognized`           | error    | —           |
+ * | `workspace/agents-detected-declared`    | warning  | —           |
+ * | `workspace/skills-declarations-valid`   | error    | —           |
+ * | `workspace/packs-declarations-valid`    | error    | —           |
+ * | `workspace/knowledge-state-valid`       | error    | —           |
+ * | `workspace/skills-lockfile-aligned`     | error    | autofixing  |
+ * | `workspace/skills-integrity-valid`      | error    | autofixing  |
+ * | `workspace/skills-artifacts-correct`    | error    | autofixing  |
+ * | `workspace/skills-managed`              | error    | —           |
+ * | `workspace/packs-dependencies-resolved` | error    | —           |
+ * | `workspace/recommended-packs-retained`  | warning  | —           |
+ *
+ * Autofix rides per-extension Operations only (§6). No `editFile`,
+ * `writeFile`, or `syncWorkspace()` reference — arms whose remediation can't
+ * be expressed in the operation vocabulary ship as `AdvisoryFinding` with a
+ * CLI suggestion instead.
+ *
+ * Rule ids are **registered with the lint config allowlist at module-load
+ * time**, so importing this catalog extends the set of accepted
+ * `axm.json` `lint.rules` keys.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { LintRule } from "@agentxm/registry-protocol/unstable/lint/rule";
+import type { WorkspaceRuleContext } from "../workspace-context.js";
+/**
+ * Ordered v1 `workspace/*` rule catalog. Declaration order is the evaluation
+ * order within a single `evaluateContexts` call (deterministic ordering is
+ * test-observable; see `evaluate.ts`). The catalog groups foundation rules
+ * first, then install-family rules by classification invariant: declaration
+ * validity, lockfile alignment, integrity, artifact correctness, the
+ * unmanaged-class-empty check, pack dependency resolution, and implicit
+ * retention.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const repositoryWorkspaceRules: ReadonlyArray<LintRule<WorkspaceRuleContext>>;
+/** Rules whose evidence exists only in the live managed workspace. */
+export declare const liveOnlyWorkspaceRules: ReadonlyArray<LintRule<WorkspaceRuleContext>>;
+/** Complete workspace-view catalog, retained as the public catalog surface. */
+export declare const workspaceRules: ReadonlyArray<LintRule<WorkspaceRuleContext>>;
+//# sourceMappingURL=workspace.d.ts.map

package/dist/src/catalog/workspace.js

@@ -0,0 +1,164 @@
+/**
+ * `workspace/*` rule catalog — the v1 rule set.
+ *
+ * Per the lint design, `axm lint` (locally only —
+ * never publish) runs exactly these rules against each workspace read model.
+ * Rules are grouped by classification invariant — foundation first, then
+ * one group per invariant that install-family rules enforce:
+ *
+ * | ID                                      | Severity | Autofix     |
+ * | --------------------------------------- | -------- | ----------- |
+ * | `workspace/initialized`                 | error    | —           |
+ * | `workspace/settings-schema-valid`       | error    | —           |
+ * | `workspace/settings-keys-recognized`    | error    | —           |
+ * | `workspace/lockfile-valid`              | error    | autofixing  |
+ * | `workspace/desired-state-reconcilable`  | error    | —           |
+ * | `workspace/agents-recognized`           | error    | —           |
+ * | `workspace/agents-detected-declared`    | warning  | —           |
+ * | `workspace/skills-declarations-valid`   | error    | —           |
+ * | `workspace/packs-declarations-valid`    | error    | —           |
+ * | `workspace/knowledge-state-valid`       | error    | —           |
+ * | `workspace/skills-lockfile-aligned`     | error    | autofixing  |
+ * | `workspace/skills-integrity-valid`      | error    | autofixing  |
+ * | `workspace/skills-artifacts-correct`    | error    | autofixing  |
+ * | `workspace/skills-managed`              | error    | —           |
+ * | `workspace/packs-dependencies-resolved` | error    | —           |
+ * | `workspace/recommended-packs-retained`  | warning  | —           |
+ *
+ * Autofix rides per-extension Operations only (§6). No `editFile`,
+ * `writeFile`, or `syncWorkspace()` reference — arms whose remediation can't
+ * be expressed in the operation vocabulary ship as `AdvisoryFinding` with a
+ * CLI suggestion instead.
+ *
+ * Rule ids are **registered with the lint config allowlist at module-load
+ * time**, so importing this catalog extends the set of accepted
+ * `axm.json` `lint.rules` keys.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import { registerLintRuleIds } from "@agentxm/registry-protocol/unstable/lint/config";
+import { initializedRule } from "./workspace/initialized.js";
+import { settingsSchemaValidRule } from "./workspace/settings-schema-valid.js";
+import { settingsKeysRecognizedRule } from "./workspace/settings-keys-recognized.js";
+import { lockfileValidRule } from "./workspace/lockfile-valid.js";
+import { agentsRecognizedRule } from "./workspace/agents-recognized.js";
+import { agentsDetectedDeclaredRule } from "./workspace/agents-detected-declared.js";
+import { instructionsSourcePresentRule } from "./workspace/instructions-source-present.js";
+import { instructionsTargetCurrentRule } from "./workspace/instructions-target-current.js";
+import { instructionsTargetUnownedRule } from "./workspace/instructions-target-unowned.js";
+import { instructionsTargetStaleRule } from "./workspace/instructions-target-stale.js";
+import { projectionsCurrentRule } from "./workspace/projections-current.js";
+import { instructionsAgentSupportedRule } from "./workspace/instructions-agent-supported.js";
+import { instructionsGitignoreCurrentRule } from "./workspace/instructions-gitignore-current.js";
+import { skillsDeclarationsValidRule } from "./workspace/skills-declarations-valid.js";
+import { skillsLockfileAlignedRule } from "./workspace/skills-lockfile-aligned.js";
+import { skillsIntegrityValidRule } from "./workspace/skills-integrity-valid.js";
+import { skillsArtifactsCorrectRule } from "./workspace/skills-artifacts-correct.js";
+import { packsDeclarationsValidRule } from "./workspace/packs-declarations-valid.js";
+import { packsDependenciesResolvedRule } from "./workspace/packs-dependencies-resolved.js";
+import { configuredButNotInstalledRule } from "./workspace/configured-but-not-installed.js";
+import { mcpServerNoSecretLiteralRule } from "./workspace/mcps-no-secret-literal.js";
+import { mcpServerTransportExclusivityRule } from "./workspace/mcps-transport-exclusivity.js";
+import { mcpServerAgentDriftRule } from "./workspace/mcps-agent-drift.js";
+import { mcpServerSharedTargetCompatibleRule } from "./workspace/mcps-shared-target-compatible.js";
+import { mcpServerAgentOrphanedRule } from "./workspace/mcps-agent-orphaned.js";
+import { desiredStateReconcilableRule } from "./workspace/desired-state-reconcilable.js";
+import { knowledgeStateValidRule } from "./workspace/knowledge-state-valid.js";
+import { axmSkillCompatibleRule } from "./workspace/axm-skill-compatible.js";
+import { hookOwnershipAmbiguousRule } from "./workspace/hook-ownership-ambiguous.js";
+import { managedFileUnownedRule } from "./workspace/managed-file-unowned.js";
+import { sourceEndpointsAlignedRule } from "./workspace/source-endpoints-aligned.js";
+/**
+ * Ordered v1 `workspace/*` rule catalog. Declaration order is the evaluation
+ * order within a single `evaluateContexts` call (deterministic ordering is
+ * test-observable; see `evaluate.ts`). The catalog groups foundation rules
+ * first, then install-family rules by classification invariant: declaration
+ * validity, lockfile alignment, integrity, artifact correctness, the
+ * unmanaged-class-empty check, pack dependency resolution, and implicit
+ * retention.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const repositoryWorkspaceRules = [
+    // Foundation (classification-independent workspace well-formedness).
+    initializedRule,
+    settingsSchemaValidRule,
+    settingsKeysRecognizedRule,
+    lockfileValidRule,
+    sourceEndpointsAlignedRule,
+    desiredStateReconcilableRule,
+    axmSkillCompatibleRule,
+    agentsRecognizedRule,
+    instructionsSourcePresentRule,
+    instructionsAgentSupportedRule,
+    instructionsGitignoreCurrentRule,
+    // Declaration valid (configured).
+    skillsDeclarationsValidRule,
+    packsDeclarationsValidRule,
+    configuredButNotInstalledRule,
+    knowledgeStateValidRule,
+    mcpServerTransportExclusivityRule,
+    mcpServerNoSecretLiteralRule,
+    mcpServerSharedTargetCompatibleRule,
+    // Lockfile aligned (configured).
+    skillsLockfileAlignedRule,
+    // Integrity intact (configured + implicit).
+    skillsIntegrityValidRule,
+    // Artifacts correct (configured + implicit).
+    // Managed — unmanaged class must be empty.
+    // Pack dependencies resolved (configured packs).
+    packsDependenciesResolvedRule,
+];
+/** Rules whose evidence exists only in the live managed workspace. */
+export const liveOnlyWorkspaceRules = [
+    agentsDetectedDeclaredRule,
+    instructionsTargetCurrentRule,
+    instructionsTargetUnownedRule,
+    instructionsTargetStaleRule,
+    projectionsCurrentRule,
+    hookOwnershipAmbiguousRule,
+    managedFileUnownedRule,
+    skillsArtifactsCorrectRule,
+    mcpServerAgentDriftRule,
+    mcpServerAgentOrphanedRule,
+];
+/** Complete workspace-view catalog, retained as the public catalog surface. */
+export const workspaceRules = [
+    initializedRule,
+    settingsSchemaValidRule,
+    settingsKeysRecognizedRule,
+    lockfileValidRule,
+    sourceEndpointsAlignedRule,
+    desiredStateReconcilableRule,
+    axmSkillCompatibleRule,
+    agentsRecognizedRule,
+    agentsDetectedDeclaredRule,
+    instructionsSourcePresentRule,
+    instructionsTargetCurrentRule,
+    instructionsTargetUnownedRule,
+    instructionsTargetStaleRule,
+    instructionsAgentSupportedRule,
+    instructionsGitignoreCurrentRule,
+    projectionsCurrentRule,
+    hookOwnershipAmbiguousRule,
+    managedFileUnownedRule,
+    skillsDeclarationsValidRule,
+    packsDeclarationsValidRule,
+    configuredButNotInstalledRule,
+    knowledgeStateValidRule,
+    mcpServerTransportExclusivityRule,
+    mcpServerNoSecretLiteralRule,
+    mcpServerSharedTargetCompatibleRule,
+    mcpServerAgentDriftRule,
+    mcpServerAgentOrphanedRule,
+    skillsLockfileAlignedRule,
+    skillsIntegrityValidRule,
+    skillsArtifactsCorrectRule,
+    packsDependenciesResolvedRule,
+];
+// Register ids into the `LintConfig.rules` allowlist. Module-load side effect:
+// a consumer that imports this catalog (or the `catalog/index` barrel) enables
+// `axm.json` `lint.rules` to reference any of the above rule ids.
+registerLintRuleIds(workspaceRules.map((r) => r.id));
+//# sourceMappingURL=workspace.js.map

package/dist/src/catalog-contexts.d.ts

@@ -0,0 +1,106 @@
+/**
+ * The lint runner's catalog table — one entry per rule namespace, total by
+ * construction over `ExtensionType`.
+ *
+ * `axm lint` used to name its catalogs seven times over (an import list, a
+ * group union, an evaluation tuple, a rendering list, a drift-detection call
+ * sequence), and a catalog could be — and was — added to the barrel while
+ * being silently skipped by the runner: `hookRules` shipped evaluated by the
+ * publish gate but never by `axm lint`.
+ *
+ * Now every catalog is a key of {@link CatalogRuleContexts} and a row of
+ * {@link LINT_CATALOGS}. Because the table is checked against
+ * `Record<ExtensionType | "workspace", ...>`, adding an extension type to
+ * `EXTENSION_TYPE_TABLE` fails compile here until its catalog is decided, and
+ * deleting a key from `CatalogRuleContexts` fails compile at the row that
+ * indexes it.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import type { ExtensionType } from "@agentxm/extension-model/unstable/extensions/common";
+import type { HookRuleContext, KnowledgeRuleContext, McpServerRuleContext, PackRuleContext, RuleRuleContext, SkillRuleContext, SubagentRuleContext } from "@agentxm/registry-protocol/unstable/lint/context";
+import type { WorkspaceRuleContext } from "./workspace-context.js";
+import type { LintRule } from "@agentxm/registry-protocol/unstable/lint/rule";
+/**
+ * The contexts a full lint run evaluates, one array per catalog.
+ *
+ * `workspace` is the one pseudo-group: it is not an extension type, and it
+ * always carries exactly the single workspace context.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export interface CatalogRuleContexts {
+    readonly skill: ReadonlyArray<SkillRuleContext>;
+    readonly pack: ReadonlyArray<PackRuleContext>;
+    readonly subagent: ReadonlyArray<SubagentRuleContext>;
+    readonly "mcp-server": ReadonlyArray<McpServerRuleContext>;
+    readonly rule: ReadonlyArray<RuleRuleContext>;
+    readonly hook: ReadonlyArray<HookRuleContext>;
+    readonly knowledge: ReadonlyArray<KnowledgeRuleContext>;
+    readonly workspace: ReadonlyArray<WorkspaceRuleContext>;
+}
+/**
+ * A catalog key: every extension type, plus the `workspace` pseudo-group.
+ *
+ * Declared from `ExtensionType` rather than `keyof CatalogRuleContexts`, so
+ * the two must agree: a new extension type leaves `CatalogRuleContexts`
+ * missing a key, and a deleted `CatalogRuleContexts` key leaves
+ * {@link CatalogContext} indexing a key that no longer exists. Either way the
+ * build fails until the catalog is decided.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export type CatalogGroup = ExtensionType | "workspace";
+/** Filesystem identity evaluated by a lint run. */
+export type LintView = "workspace" | "git-index";
+/** The context type a given catalog's rules consume. */
+export type CatalogContext<K extends CatalogGroup> = CatalogRuleContexts[K][number];
+/**
+ * Every rule catalog, keyed by group.
+ *
+ * The annotation is the totality gate: the key set is `ExtensionType |
+ * "workspace"`, and each value is checked against the context type
+ * `CatalogRuleContexts` declares for that key.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const REPOSITORY_LINT_CATALOGS: {
+    readonly [K in CatalogGroup]: ReadonlyArray<LintRule<CatalogContext<K>>>;
+};
+/** Positive catalog of rules that require live operational state. */
+export declare const LIVE_ONLY_LINT_CATALOGS: {
+    workspace: readonly LintRule<WorkspaceRuleContext>[];
+};
+/** Select positive rule catalogs for a view without an exclusion list. */
+export declare const lintCatalogsForView: (view: LintView) => { readonly [K in CatalogGroup]: ReadonlyArray<LintRule<CatalogContext<K>>>; };
+/** Complete workspace catalog retained for callers that do not select a view. */
+export declare const LINT_CATALOGS: {
+    readonly skill: readonly LintRule<SkillRuleContext<import("@agentxm/registry-protocol/unstable/lint/context").SkillContent>>[];
+    readonly "mcp-server": readonly LintRule<McpServerRuleContext<import("@agentxm/registry-protocol/unstable/lint/context").McpServerContent>>[];
+    readonly subagent: readonly LintRule<SubagentRuleContext<import("@agentxm/registry-protocol/unstable/lint/context").SubagentContent>>[];
+    readonly rule: readonly LintRule<RuleRuleContext<import("@agentxm/registry-protocol/unstable/lint/context").RuleContent>>[];
+    readonly hook: readonly LintRule<HookRuleContext<import("@agentxm/registry-protocol/unstable/lint/context").HookContent>>[];
+    readonly knowledge: readonly LintRule<KnowledgeRuleContext<import("@agentxm/registry-protocol/unstable/lint/context").KnowledgeContent>>[];
+    readonly pack: readonly LintRule<PackRuleContext<import("@agentxm/registry-protocol/unstable/lint/context").PackContent>>[];
+    readonly workspace: readonly LintRule<WorkspaceRuleContext>[];
+};
+/**
+ * Catalog evaluation and rendering order.
+ *
+ * Findings render group-by-group in this order and the order is
+ * test-observable, so it is declared explicitly rather than derived from
+ * object key order. It matches `allCatalogRuleIds` in the catalog barrel;
+ * `workspace` stays last.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const CATALOG_GROUP_ORDER: readonly ["skill", "pack", "subagent", "mcp-server", "hook", "rule", "knowledge", "workspace"];
+/**
+ * An empty context record. Callers that evaluate only some catalogs spread
+ * this so adding a catalog does not silently skip them.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export declare const emptyCatalogRuleContexts: CatalogRuleContexts;
+//# sourceMappingURL=catalog-contexts.d.ts.map

package/dist/src/catalog-contexts.js

@@ -0,0 +1,95 @@
+/**
+ * The lint runner's catalog table — one entry per rule namespace, total by
+ * construction over `ExtensionType`.
+ *
+ * `axm lint` used to name its catalogs seven times over (an import list, a
+ * group union, an evaluation tuple, a rendering list, a drift-detection call
+ * sequence), and a catalog could be — and was — added to the barrel while
+ * being silently skipped by the runner: `hookRules` shipped evaluated by the
+ * publish gate but never by `axm lint`.
+ *
+ * Now every catalog is a key of {@link CatalogRuleContexts} and a row of
+ * {@link LINT_CATALOGS}. Because the table is checked against
+ * `Record<ExtensionType | "workspace", ...>`, adding an extension type to
+ * `EXTENSION_TYPE_TABLE` fails compile here until its catalog is decided, and
+ * deleting a key from `CatalogRuleContexts` fails compile at the row that
+ * indexes it.
+ *
+ * @experimental This API is unstable and may change without notice.
+ * @packageDocumentation
+ */
+import { hookRules } from "@agentxm/registry-protocol/unstable/lint/catalog/hook";
+import { knowledgeRules } from "@agentxm/registry-protocol/unstable/lint/catalog/knowledge";
+import { mcpServerRules } from "@agentxm/registry-protocol/unstable/lint/catalog/mcp-server";
+import { packRules } from "@agentxm/registry-protocol/unstable/lint/catalog/pack";
+import { ruleRules } from "@agentxm/registry-protocol/unstable/lint/catalog/rule";
+import { skillRules } from "@agentxm/registry-protocol/unstable/lint/catalog/skill";
+import { subagentRules } from "@agentxm/registry-protocol/unstable/lint/catalog/subagent";
+import { liveOnlyWorkspaceRules, repositoryWorkspaceRules, workspaceRules, } from "./catalog/index.js";
+/**
+ * Every rule catalog, keyed by group.
+ *
+ * The annotation is the totality gate: the key set is `ExtensionType |
+ * "workspace"`, and each value is checked against the context type
+ * `CatalogRuleContexts` declares for that key.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const REPOSITORY_LINT_CATALOGS = {
+    skill: skillRules,
+    pack: packRules,
+    subagent: subagentRules,
+    "mcp-server": mcpServerRules,
+    rule: ruleRules,
+    hook: hookRules,
+    knowledge: knowledgeRules,
+    workspace: repositoryWorkspaceRules,
+};
+/** Positive catalog of rules that require live operational state. */
+export const LIVE_ONLY_LINT_CATALOGS = {
+    workspace: liveOnlyWorkspaceRules,
+};
+/** Select positive rule catalogs for a view without an exclusion list. */
+export const lintCatalogsForView = (view) => ({
+    ...REPOSITORY_LINT_CATALOGS,
+    workspace: view === "workspace" ? workspaceRules : REPOSITORY_LINT_CATALOGS.workspace,
+});
+/** Complete workspace catalog retained for callers that do not select a view. */
+export const LINT_CATALOGS = lintCatalogsForView("workspace");
+/**
+ * Catalog evaluation and rendering order.
+ *
+ * Findings render group-by-group in this order and the order is
+ * test-observable, so it is declared explicitly rather than derived from
+ * object key order. It matches `allCatalogRuleIds` in the catalog barrel;
+ * `workspace` stays last.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const CATALOG_GROUP_ORDER = [
+    "skill",
+    "pack",
+    "subagent",
+    "mcp-server",
+    "hook",
+    "rule",
+    "knowledge",
+    "workspace",
+];
+/**
+ * An empty context record. Callers that evaluate only some catalogs spread
+ * this so adding a catalog does not silently skip them.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+export const emptyCatalogRuleContexts = {
+    skill: [],
+    pack: [],
+    subagent: [],
+    "mcp-server": [],
+    rule: [],
+    hook: [],
+    knowledge: [],
+    workspace: [],
+};
+//# sourceMappingURL=catalog-contexts.js.map