@codai/axiom-mcp 1.0.24 → 2.1.0

package/dist/index.js

@@ -0,0 +1,1294 @@
+import { createRequire } from "node:module";
+import { ApplyResultSchema, AxiomError, CheckReportSchema, DigestRefSchema, ErrorCodeSchema, JournalPhaseSchema, JournalSchema, ManifestBodySchema, ManifestBundleSchema, PlanSchema, ProfileSchema, RepoSnapshotSchema, TrustStateSchema, TrustStoreSchema, compareUtf8, isValidRelPath } from "@codai/axiom-schema";
+import { z } from "zod";
+import { createReadStream, realpath } from "node:fs";
+import { access, chmod, constants, lstat, mkdir, opendir, readFile, readdir, realpath as realpath$1, rename, stat, writeFile } from "node:fs/promises";
+import * as path from "node:path";
+import { promisify } from "node:util";
+import { TRUST_FILE_DEFAULT, TRUST_STATE_FILE, loadProfile, runChecks, verifyBundleSignatures } from "@codai/axiom-checks";
+import { McpServer, ResourceTemplate } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { webEmitter } from "@codai/axiom-emitters-web";
+import { compilePlan, createEmitterRegistry, diffManifests, verifyBundle } from "@codai/axiom-plan";
+import { appliedPath, apply, rollback } from "@codai/axiom-apply";
+import { canonicalDigestRef } from "@codai/axiom-canon";
+import { createHash } from "node:crypto";
+//#region src/jsonschema.ts
+const SCHEMA_KINDS = [
+	"Plan",
+	"Manifest",
+	"ManifestBundle",
+	"CheckReport",
+	"ApplyResult",
+	"Profile",
+	"Journal",
+	"RepoSnapshot"
+];
+const BY_KIND = {
+	Plan: PlanSchema,
+	Manifest: ManifestBodySchema,
+	ManifestBundle: ManifestBundleSchema,
+	CheckReport: CheckReportSchema,
+	ApplyResult: ApplyResultSchema,
+	Profile: ProfileSchema,
+	Journal: JournalSchema,
+	RepoSnapshot: RepoSnapshotSchema
+};
+function isSchemaKind(v) {
+	return typeof v === "string" && SCHEMA_KINDS.includes(v);
+}
+/** Draft 2020-12 JSON Schema, byte-identical to `packages/schema/schemas/<kind>.schema.json`. */
+function jsonSchemaFor(kind) {
+	const json = z.toJSONSchema(BY_KIND[kind], {
+		target: "draft-2020-12",
+		io: "input",
+		unrepresentable: "any"
+	});
+	return {
+		$id: `https://axiom.dev/schemas/v2/${kind}.schema.json`,
+		title: kind,
+		...json
+	};
+}
+/** Compact JSON Schema for tool input/output (spec/tools.json). */
+function toolJsonSchema(schema) {
+	return z.toJSONSchema(schema, {
+		target: "draft-2020-12",
+		io: "input",
+		unrepresentable: "any"
+	});
+}
+//#endregion
+//#region src/log.ts
+/**
+* stderr-only JSON-lines logger. stdout belongs to the MCP transport; nothing in
+* this package may write there except the transport itself (and CLI verbs).
+*/
+const LOG_LEVELS = [
+	"error",
+	"warn",
+	"info",
+	"debug"
+];
+function isLogLevel(v) {
+	return typeof v === "string" && LOG_LEVELS.includes(v);
+}
+const RANK = {
+	error: 0,
+	warn: 1,
+	info: 2,
+	debug: 3
+};
+function createLogger(opts = {}) {
+	const level = opts.level ?? "warn";
+	const write = opts.write ?? ((line) => void process.stderr.write(line));
+	const now = opts.now ?? (() => (/* @__PURE__ */ new Date()).toISOString());
+	const emit = (lvl, msg, fields) => {
+		if (RANK[lvl] > RANK[level]) return;
+		write(`${JSON.stringify({
+			level: lvl,
+			ts: now(),
+			msg,
+			...fields
+		})}\n`);
+	};
+	return {
+		level,
+		error: (m, f) => emit("error", m, f),
+		warn: (m, f) => emit("warn", m, f),
+		info: (m, f) => emit("info", m, f),
+		debug: (m, f) => emit("debug", m, f)
+	};
+}
+const silentLogger = createLogger({ write: () => {} });
+//#endregion
+//#region src/roots.ts
+const realpathNative = promisify(realpath.native);
+const IS_WIN32 = process.platform === "win32";
+async function realDir(p, code) {
+	let real;
+	try {
+		real = await realpathNative(p);
+	} catch (cause) {
+		throw new AxiomError(code, `root does not exist: ${p}`, {
+			cause,
+			details: { root: p }
+		});
+	}
+	if (IS_WIN32 && real.startsWith("\\\\?\\")) real = real.slice(4);
+	if (!(await stat(real)).isDirectory()) throw new AxiomError(code, `root is not a directory: ${p}`, { details: { root: p } });
+	return real;
+}
+function norm(p) {
+	const n = path.normalize(p).replace(/[\\/]+$/, "");
+	return IS_WIN32 ? n.toLowerCase() : n;
+}
+/** True iff `child` equals `parent` or lies inside it (case-insensitive on win32). */
+function isSameOrInside(parent, child) {
+	const p = norm(parent);
+	const c = norm(child);
+	if (p === c) return true;
+	return c.startsWith(p.endsWith(path.sep) ? p : p + path.sep);
+}
+/** Build the policy from `--root <abs>` arguments. Each must exist and be a directory. */
+async function createRootsPolicy(rootArgs) {
+	const roots = /* @__PURE__ */ new Set();
+	for (const r of rootArgs) {
+		if (!path.isAbsolute(r)) throw new AxiomError("ERR_ROOT_NOT_DIR", `--root must be absolute: ${r}`, { details: { root: r } });
+		roots.add(await realDir(r, "ERR_ROOT_NOT_DIR"));
+	}
+	return Object.freeze({ roots: Object.freeze(roots) });
+}
+/**
+* Resolve a tool's `root` argument against the allowlist. No env fallback, no cwd:
+* none requested + one root → that root; none + many → ERR_ROOT_REQUIRED;
+* requested → realpath, must equal or be inside an allowlisted root → else ERR_ROOT_NOT_ALLOWED.
+*/
+async function resolveRoot(policy, requested) {
+	if (requested === void 0 || requested === "") {
+		if (policy.roots.size === 1) {
+			const only = [...policy.roots][0];
+			return {
+				rootReal: only,
+				effectiveRoot: only
+			};
+		}
+		throw new AxiomError("ERR_ROOT_REQUIRED", policy.roots.size === 0 ? "server has no allowlisted roots (start with --root <dir>)" : "root is required when more than one root is allowlisted", { details: { roots: [...policy.roots] } });
+	}
+	if (!path.isAbsolute(requested)) throw new AxiomError("ERR_ROOT_NOT_ALLOWED", `root must be absolute: ${requested}`, { details: { root: requested } });
+	const real = await realDir(requested, "ERR_ROOT_NOT_ALLOWED");
+	for (const allowed of policy.roots) if (isSameOrInside(allowed, real)) return {
+		rootReal: real,
+		effectiveRoot: allowed
+	};
+	throw new AxiomError("ERR_ROOT_NOT_ALLOWED", `root is outside the allowlist: ${requested}`, { details: {
+		root: requested,
+		real,
+		roots: [...policy.roots]
+	} });
+}
+//#endregion
+//#region src/emitters.ts
+/** Template emitters available to `axiom_plan_compile` / `axiom compile` (D-13: optional sugar). */
+const EMITTERS = createEmitterRegistry([webEmitter]);
+/** Flat, sorted `emitter@version: template — description` rows for the CLI and the resource. */
+function emitterCatalogue(registry = EMITTERS) {
+	const rows = [];
+	for (const id of registry.list()) {
+		const e = registry.get(id);
+		if (e === void 0) continue;
+		for (const template of Object.keys(e.templates).sort()) rows.push({
+			emitter: e.id,
+			version: e.version,
+			template,
+			description: e.templates[template]?.description ?? ""
+		});
+	}
+	return rows;
+}
+//#endregion
+//#region src/store.ts
+/** `<root>/.axiom/manifests/<hex>.json` and `<root>/.axiom/reports/<hex>.json`. */
+function manifestsDir(root) {
+	return path.join(root, ".axiom", "manifests");
+}
+function reportsDir(root) {
+	return path.join(root, ".axiom", "reports");
+}
+function hexOf(ref) {
+	return ref.slice(7);
+}
+function toDigestRef(shaOrRef) {
+	const ref = shaOrRef.startsWith("sha256:") ? shaOrRef : `sha256:${shaOrRef}`;
+	const parsed = DigestRefSchema.safeParse(ref);
+	if (!parsed.success) throw new AxiomError("ERR_NOT_FOUND", `not a sha256 digest: ${shaOrRef}`);
+	return parsed.data;
+}
+async function writeJsonAtomic$1(file, value) {
+	await mkdir(path.dirname(file), { recursive: true });
+	const tmp = `${file}.tmp-${process.pid}`;
+	await writeFile(tmp, JSON.stringify(value), "utf8");
+	await rename(tmp, file);
+}
+async function readJsonOrUndefined$1(file) {
+	try {
+		return JSON.parse(await readFile(file, "utf8"));
+	} catch (err) {
+		if (err.code === "ENOENT") return void 0;
+		throw err;
+	}
+}
+async function saveManifest(root, bundle) {
+	const file = path.join(manifestsDir(root), `${hexOf(bundle.manifestDigest)}.json`);
+	await writeJsonAtomic$1(file, bundle);
+	return file;
+}
+async function saveReport(root, report) {
+	const file = path.join(reportsDir(root), `${hexOf(report.manifestDigest)}.json`);
+	await writeJsonAtomic$1(file, report);
+	return file;
+}
+/** Search every root (allowlisted + seen) for a stored bundle. */
+async function loadManifest(roots, ref) {
+	for (const root of roots) {
+		const raw = await readJsonOrUndefined$1(path.join(manifestsDir(root), `${hexOf(ref)}.json`));
+		if (raw !== void 0) return ManifestBundleSchema.parse(raw);
+	}
+}
+async function loadReport(roots, ref) {
+	for (const root of roots) {
+		const raw = await readJsonOrUndefined$1(path.join(reportsDir(root), `${hexOf(ref)}.json`));
+		if (raw !== void 0) return CheckReportSchema.parse(raw);
+	}
+}
+async function loadApplied(roots, ref) {
+	for (const root of roots) {
+		const raw = await readJsonOrUndefined$1(appliedPath(root, ref));
+		if (raw !== void 0) return ApplyResultSchema.parse(raw);
+	}
+}
+async function listStored(roots, sub) {
+	const out = [];
+	for (const root of roots) {
+		let names;
+		try {
+			names = await readdir(path.join(root, ".axiom", sub));
+		} catch {
+			continue;
+		}
+		for (const n of names) {
+			const m = /^([0-9a-f]{64})\.json$/.exec(n);
+			if (m?.[1] !== void 0) out.push({
+				root,
+				sha: m[1]
+			});
+		}
+	}
+	return out;
+}
+//#endregion
+//#region src/keys.ts
+/**
+* Key material and trust-store I/O for the CLI/MCP layer (D-16).
+*
+* Private keys are read ONLY from `AXIOM_SIGNING_KEY` (base64 PKCS#8 or raw seed) or
+* `--key-file <path>`; they are never written to stdout and never stored under a root.
+*/
+function trustFilePath(root, rel = TRUST_FILE_DEFAULT) {
+	return path.join(root, ...rel.split("/"));
+}
+function trustStatePath(root) {
+	return path.join(root, ...TRUST_STATE_FILE.split("/"));
+}
+async function writeJsonAtomic(file, value, mode) {
+	await mkdir(path.dirname(file), { recursive: true });
+	const tmp = `${file}.tmp-${process.pid}`;
+	await writeFile(tmp, `${JSON.stringify(value, null, 2)}\n`, {
+		encoding: "utf8",
+		mode
+	});
+	if (mode !== void 0) await chmod(tmp, mode).catch(() => void 0);
+	await rename(tmp, file);
+}
+async function readJsonOrUndefined(file) {
+	try {
+		return JSON.parse(await readFile(file, "utf8"));
+	} catch (err) {
+		if (err.code === "ENOENT") return void 0;
+		throw err;
+	}
+}
+/** Verify a bundle's detached signatures against the root's trust store; `undefined` when no store. */
+async function verifyBundleAgainstRoot(root, bundle, rel = TRUST_FILE_DEFAULT) {
+	const store = await loadTrustStore(root, rel);
+	if (store === void 0) return void 0;
+	const v = verifyBundleSignatures(bundle, store, bundle.manifest.counter);
+	return {
+		trustFile: rel,
+		keyids: v.keyids,
+		findings: v.findings.map((f) => ({
+			id: f.id,
+			message: f.message
+		})),
+		ok: v.keyids.length > 0 && v.findings.length === 0
+	};
+}
+async function loadTrustStore(root, rel = TRUST_FILE_DEFAULT) {
+	const raw = await readJsonOrUndefined(trustFilePath(root, rel));
+	if (raw === void 0) return void 0;
+	const parsed = TrustStoreSchema.safeParse(raw);
+	if (!parsed.success) throw new AxiomError("ERR_INVALID_PROFILE", `trust store ${rel} is invalid`, { details: { issues: parsed.error.issues.slice(0, 10).map((i) => i.message) } });
+	return parsed.data;
+}
+async function loadTrustState(root) {
+	const raw = await readJsonOrUndefined(trustStatePath(root));
+	if (raw === void 0) return void 0;
+	const parsed = TrustStateSchema.safeParse(raw);
+	if (!parsed.success) throw new AxiomError("ERR_JOURNAL_CORRUPT", `${TRUST_STATE_FILE} is invalid`);
+	return parsed.data;
+}
+/**
+* Advance `lastCounter` to `bundle.manifest.counter` after a successful apply.
+* Monotonic: never moves backwards; a no-op when the bundle has no counter.
+* Write-temp + rename so a crash leaves either the old or the new state.
+*/
+async function advanceTrustState(root, bundle) {
+	const counter = bundle.manifest.counter;
+	if (counter === void 0) return void 0;
+	const cur = await loadTrustState(root);
+	if (cur !== void 0 && cur.lastCounter >= counter) return cur;
+	const next = {
+		version: 1,
+		lastCounter: counter,
+		manifestDigest: bundle.manifestDigest
+	};
+	await writeJsonAtomic(trustStatePath(root), next);
+	return next;
+}
+/** Does the resolved profile (plus plan checks) enable antiRollback on requireSigned? */
+function profileWantsAntiRollback(checks) {
+	return checks.some((c) => c.predicate === "manifest.requireSigned" && typeof c.params === "object" && c.params !== null && c.params.antiRollback === true);
+}
+//#endregion
+//#region src/snapshot.ts
+/**
+* `axiom_repo_snapshot` — deterministic, content-addressed inventory of a root (S-304).
+*
+* Successor of the v1 reverse-IR, which guessed "service types" from directory names and
+* hashed nothing. A RepoSnapshot records what is actually there — relative path, size,
+* sha256, mode, kind — sorted by `compareUtf8`, with no timestamps and no absolute paths, so
+* the same tree yields the same `snapshotDigest` on every machine (invariant 1). Agents use
+* it to build Plans against real pre-image digests and to diff two states of a tree.
+*
+* Read-only: never follows symlinks, never leaves the root, never spawns a process.
+*/
+const SNAPSHOT_MAX_FILES_DEFAULT = 2e4;
+const SNAPSHOT_MAX_FILES_CAP = 5e4;
+const SNAPSHOT_MAX_BYTES_DEFAULT = 67108864;
+/** Never inventoried, whatever `.gitignore` says. */
+const ALWAYS_SKIP = /* @__PURE__ */ new Set([".git", ".axiom"]);
+function globToRegExp(glob) {
+	let re = "^";
+	for (let i = 0; i < glob.length; i++) {
+		const c = glob[i];
+		if (c === "*") {
+			if (glob[i + 1] === "*") {
+				i++;
+				if (glob[i + 1] === "/") {
+					i++;
+					re += "(?:.*/)?";
+				} else re += ".*";
+			} else re += "[^/]*";
+		} else if (c === "?") re += "[^/]";
+		else re += c.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+	}
+	return new RegExp(`${re}$`);
+}
+function matcherOf(globs, whenEmpty) {
+	if (globs === void 0 || globs.length === 0) return () => whenEmpty;
+	const res = globs.map(globToRegExp);
+	return (rel) => res.some((r) => r.test(rel));
+}
+/** A glob must itself be a contained relative path once wildcards are removed (`..` → rejected). */
+function validateGlob(g, label) {
+	const probe = g.replace(/\*+/g, "x").replace(/\?/g, "x").replace(/\/+$/, "");
+	if (probe.length === 0 || !isValidRelPath(probe)) throw new AxiomError("ERR_CONTAINMENT", `${label} glob must be a contained relative path: ${g}`, { details: { glob: g } });
+}
+/** Root `.gitignore` → matchers, same rough translation the repo facts use (negations dropped). */
+async function gitignoreMatcher(root) {
+	let text;
+	try {
+		text = await readFile(path.join(root, ".gitignore"), "utf8");
+	} catch {
+		return () => false;
+	}
+	const globs = [];
+	for (const raw of text.split(/\r?\n/)) {
+		const l = raw.trim();
+		if (l.length === 0 || l.startsWith("#") || l.startsWith("!")) continue;
+		let pat = l.startsWith("/") ? l.slice(1) : l.includes("/") ? l : `**/${l}`;
+		if (pat.endsWith("/")) pat = pat.slice(0, -1);
+		globs.push(pat, `${pat}/**`);
+	}
+	return matcherOf(globs, false);
+}
+function sha256File(abs) {
+	return new Promise((resolve, reject) => {
+		const h = createHash("sha256");
+		createReadStream(abs).on("data", (chunk) => h.update(chunk)).on("error", reject).on("end", () => resolve(h.digest("hex")));
+	});
+}
+function modeOf(mode) {
+	return process.platform !== "win32" && (mode & 64) !== 0 ? "0755" : "0644";
+}
+/**
+* Inventory `rootReal` (already realpath'd and authorised by the caller).
+* The walk visits entries in `compareUtf8` order of their relative path (directories keyed with
+* a trailing `/`), which is exactly the final sort order — so a truncated `files` is the first
+* N paths of the full sorted inventory, deterministically.
+*/
+async function snapshotRoot(root, opts = {}) {
+	if (opts.followSymlinks === true) throw new AxiomError("ERR_UNSUPPORTED_OP", "followSymlinks is not supported (symlinks are recorded, never followed)");
+	const rootReal = await realpath$1(root);
+	const maxFiles = Math.min(opts.maxFiles ?? 2e4, SNAPSHOT_MAX_FILES_CAP);
+	const maxBytes = opts.maxBytes ?? 67108864;
+	if (maxFiles < 1 || maxBytes < 0) throw new AxiomError("ERR_INVALID_PLAN", "maxFiles must be ≥ 1 and maxBytes ≥ 0", { details: {
+		maxFiles,
+		maxBytes
+	} });
+	for (const g of opts.include ?? []) validateGlob(g, "include");
+	for (const g of opts.exclude ?? []) validateGlob(g, "exclude");
+	const include = matcherOf(opts.include, true);
+	const exclude = matcherOf(opts.exclude, false);
+	const ignored = opts.respectGitignore === false ? () => false : await gitignoreMatcher(rootReal);
+	const withDigest = opts.withContentDigest !== false;
+	const files = [];
+	let bytes = 0;
+	let truncated = false;
+	const visit = async (dirAbs, dirRel) => {
+		let entries;
+		try {
+			const dir = await opendir(dirAbs);
+			entries = [];
+			for await (const e of dir) entries.push(e);
+		} catch {
+			return;
+		}
+		const sortKey = (d) => d.isDirectory() ? `${d.name}/` : d.name;
+		entries.sort((a, b) => compareUtf8(sortKey(a), sortKey(b)));
+		for (const e of entries) {
+			if (truncated) return;
+			const rel = dirRel === "" ? e.name : `${dirRel}/${e.name}`;
+			if (!isValidRelPath(rel)) continue;
+			if (e.isDirectory()) {
+				if (ALWAYS_SKIP.has(e.name) || ignored(rel) || exclude(rel)) continue;
+				await visit(path.join(dirAbs, e.name), rel);
+				continue;
+			}
+			if (ignored(rel) || !include(rel) || exclude(rel)) continue;
+			const abs = path.join(dirAbs, e.name);
+			let entry;
+			if (e.isSymbolicLink()) entry = await symlinkEntry(rootReal, abs, rel, withDigest);
+			else if (e.isFile()) entry = await fileEntry(abs, rel, withDigest);
+			if (entry === void 0) continue;
+			if (files.length >= maxFiles || bytes + entry.bytes > maxBytes) {
+				truncated = true;
+				return;
+			}
+			files.push(entry);
+			bytes += entry.bytes;
+		}
+	};
+	await visit(rootReal, "");
+	files.sort((a, b) => compareUtf8(a.path, b.path));
+	const body = {
+		files,
+		truncated,
+		counts: {
+			files: files.length,
+			bytes
+		}
+	};
+	return {
+		apiVersion: "axiom.dev/v2",
+		kind: "RepoSnapshot",
+		root: { kind: "relative" },
+		snapshotDigest: canonicalDigestRef(body),
+		body
+	};
+}
+async function fileEntry(abs, rel, withDigest) {
+	let st;
+	try {
+		st = await lstat(abs);
+	} catch {
+		return;
+	}
+	if (!st.isFile()) return void 0;
+	const entry = {
+		path: rel,
+		bytes: st.size,
+		mode: modeOf(st.mode),
+		kind: "file"
+	};
+	if (withDigest) try {
+		entry.sha256 = await sha256File(abs);
+	} catch {
+		return;
+	}
+	return entry;
+}
+/**
+* A symlink is recorded as `kind: "symlink"`. Its target is hashed only when it resolves to a
+* regular file *inside* the root; anything else (outside, dangling, directory) gets
+* `bytes: 0` and no digest — the link is inventoried, its target is not disclosed.
+*/
+async function symlinkEntry(rootReal, abs, rel, withDigest) {
+	const entry = {
+		path: rel,
+		bytes: 0,
+		mode: "0644",
+		kind: "symlink"
+	};
+	let target;
+	try {
+		target = await realpath$1(abs);
+	} catch {
+		return entry;
+	}
+	if (!isSameOrInside(rootReal, target)) return entry;
+	let st;
+	try {
+		st = await lstat(target);
+	} catch {
+		return entry;
+	}
+	if (!st.isFile()) return entry;
+	entry.bytes = st.size;
+	entry.mode = modeOf(st.mode);
+	if (withDigest) try {
+		entry.sha256 = await sha256File(target);
+	} catch {
+		entry.bytes = 0;
+	}
+	return entry;
+}
+//#endregion
+//#region src/tools.ts
+/** Hard cap on any single `bundle`/`plan` argument, measured as UTF-8 JSON bytes (§(f) payload size). */
+const BUNDLE_BYTES_MAX = 4194304;
+/** Findings/errors echoed in the text summary. */
+const SUMMARY_LIST_MAX = 20;
+const READ = {
+	readOnlyHint: true,
+	destructiveHint: false,
+	idempotentHint: true,
+	openWorldHint: false
+};
+/** Writes only under `<root>/.axiom/` (CAS blobs, stored manifests) — never the working tree. */
+const ACT = {
+	readOnlyHint: false,
+	destructiveHint: false,
+	idempotentHint: true,
+	openWorldHint: false
+};
+const WRITE = {
+	readOnlyHint: false,
+	destructiveHint: true,
+	idempotentHint: true,
+	openWorldHint: false
+};
+function riskClassOf(a) {
+	if (a.readOnlyHint) return "READ";
+	return a.destructiveHint ? "SENSITIVE" : "ACT";
+}
+function defineTool(def) {
+	return {
+		...def,
+		riskClass: riskClassOf(def.annotations)
+	};
+}
+const LooseObject = z.record(z.string(), z.unknown());
+const RootArg = z.string().optional().describe("Absolute repository root; must equal or lie inside an allowlisted --root");
+const ProfileArg = z.string().optional().describe("Profile name (builtin default|strict|permissive, or <root>/.axiom/profiles/<name>.json)");
+/** Reject oversized payloads before any deeper parsing. */
+function guardPayloadSize(label, value) {
+	const bytes = Buffer.byteLength(JSON.stringify(value) ?? "", "utf8");
+	if (bytes > 4194304) throw new AxiomError("ERR_BUNDLE_TOO_LARGE", `${label} is ${bytes} bytes; max ${BUNDLE_BYTES_MAX}`, { details: {
+		bytes,
+		max: BUNDLE_BYTES_MAX
+	} });
+}
+function parseBundle(raw) {
+	guardPayloadSize("bundle", raw);
+	const parsed = ManifestBundleSchema.safeParse(raw);
+	if (!parsed.success) throw new AxiomError("ERR_INVALID_MANIFEST", "bundle does not match ManifestBundleSchema", { details: { issues: parsed.error.issues.slice(0, 20).map((i) => ({
+		path: i.path.map(String).join("."),
+		message: i.message
+	})) } });
+	return parsed.data;
+}
+async function profileFor(ctx, bundle, name, rootReal) {
+	const searchDirs = rootReal === void 0 ? [] : [path.join(rootReal, ".axiom", "profiles")];
+	const profileName = name ?? bundle.manifest.profile;
+	ctx.log.debug("profile", {
+		name: profileName,
+		searchDirs
+	});
+	return loadProfile(profileName, { searchDirs });
+}
+async function checkBundle(ctx, bundle, profileName, rootReal) {
+	const opts = {
+		bundle,
+		profile: await profileFor(ctx, bundle, profileName, rootReal),
+		checks: bundle.manifest.checks,
+		...ctx.guards
+	};
+	if (rootReal !== void 0) {
+		opts.root = rootReal;
+		opts.casDir = path.join(rootReal, ".axiom", "cas");
+	}
+	const report = await runChecks(opts);
+	if (rootReal !== void 0) {
+		await saveReport(rootReal, report);
+		ctx.seenRoots.add(rootReal);
+	}
+	return report;
+}
+/** Optional root: explicit → allowlist check; absent → the single root if there is one, else none. */
+async function optionalRoot(ctx, requested) {
+	if (requested !== void 0 && requested !== "") return (await resolveRoot(ctx.policy, requested)).rootReal;
+	if (ctx.policy.roots.size === 1) return (await resolveRoot(ctx.policy)).rootReal;
+}
+function countBy(items, key) {
+	const out = {};
+	for (const it of items) out[key(it)] = (out[key(it)] ?? 0) + 1;
+	return out;
+}
+const IssueSchema = z.object({
+	path: z.string(),
+	message: z.string(),
+	code: z.string().optional()
+});
+const PlanValidateOutput = z.object({
+	ok: z.boolean(),
+	planDigest: DigestRefSchema.optional(),
+	errors: z.array(IssueSchema)
+});
+const ManifestVerifyOutput = z.object({
+	ok: z.boolean(),
+	manifestDigest: DigestRefSchema.optional(),
+	canonical: z.boolean(),
+	signed: z.boolean(),
+	missing: z.array(z.string()),
+	errors: z.array(z.object({
+		code: ErrorCodeSchema,
+		message: z.string(),
+		path: z.string().optional()
+	})),
+	/** Present only when a root with `.axiom/trust/keys.json` was available (D-16). */
+	signatures: z.object({
+		trustFile: z.string(),
+		/** Trusted keyids whose signature verified over this manifest. */
+		keyids: z.array(z.string()),
+		findings: z.array(z.object({
+			id: z.string(),
+			message: z.string()
+		})),
+		ok: z.boolean()
+	}).optional()
+});
+const RollbackOutput = z.object({
+	manifestDigest: DigestRefSchema,
+	status: z.literal("rolled-back"),
+	phase: JournalPhaseSchema,
+	steps: z.int().nonnegative(),
+	root: z.string()
+});
+const ManifestDiffOutput = z.object({
+	added: z.array(z.string()),
+	removed: z.array(z.string()),
+	changed: z.array(z.object({
+		path: z.string(),
+		from: z.string().nullable(),
+		to: z.string().nullable()
+	}))
+});
+const RootsListOutput = z.object({ roots: z.array(z.object({
+	path: z.string(),
+	writable: z.boolean(),
+	hasGit: z.boolean()
+})) });
+const Pos = z.object({
+	line: z.int().positive(),
+	column: z.int().positive()
+});
+const AxmParseOutput = z.object({
+	plan: PlanSchema.optional(),
+	diagnostics: z.array(z.object({
+		severity: z.enum(["error", "warning"]),
+		code: ErrorCodeSchema,
+		message: z.string(),
+		range: z.object({
+			start: Pos,
+			end: Pos
+		})
+	}))
+});
+const BundleOrRef = z.union([DigestRefSchema, LooseObject]).describe("A ManifestBundle object, or `sha256:<hex>` of a bundle stored under <root>/.axiom/manifests");
+const TOOL_DEFS = [
+	defineTool({
+		name: "axiom_plan_validate",
+		title: "Validate a Plan",
+		description: "Validate a Plan against PlanSchema and, when all sources are inline, compute its planDigest. Read-only; touches no files.",
+		inputSchema: { plan: LooseObject.describe("Plan document (apiVersion axiom.dev/v2, kind Plan)") },
+		outputSchema: PlanValidateOutput,
+		annotations: READ,
+		async handler(_ctx, { plan }) {
+			guardPayloadSize("plan", plan);
+			const parsed = PlanSchema.safeParse(plan);
+			if (!parsed.success) return {
+				ok: false,
+				errors: parsed.error.issues.map((i) => {
+					const code = i.params?.code;
+					const out = {
+						path: i.path.map(String).join("."),
+						message: i.message
+					};
+					if (typeof code === "string") out.code = code;
+					return out;
+				})
+			};
+			try {
+				const { bundle } = await compilePlan(parsed.data, {
+					store: "inline",
+					emitters: EMITTERS
+				});
+				return {
+					ok: true,
+					planDigest: bundle.manifest.planDigest,
+					errors: []
+				};
+			} catch (err) {
+				if (err instanceof AxiomError && err.code === "ERR_BLOB_MISSING") return {
+					ok: true,
+					errors: []
+				};
+				throw err;
+			}
+		},
+		summarize: (o) => ({
+			ok: o.ok,
+			planDigest: o.planDigest,
+			errors: o.errors.slice(0, 20)
+		})
+	}),
+	defineTool({
+		name: "axiom_plan_compile",
+		title: "Compile a Plan into a ManifestBundle",
+		description: "Compile a Plan into a content-addressed ManifestBundle (sorted artifacts, sha256 digests, in-toto planDigest). `store: cas` writes blobs under <root>/.axiom/cas instead of inlining them. When a root is given the bundle is stored under <root>/.axiom/manifests/<hex>.json so later tools can reference it by digest. `template` sources are rendered by the built-in `web` emitter (see `axiom emitters`); its version is recorded in toolchain.emitters.",
+		inputSchema: {
+			plan: LooseObject.describe("Plan document"),
+			store: z.enum(["inline", "cas"]).optional().describe("Blob transport; default inline"),
+			root: RootArg
+		},
+		outputSchema: ManifestBundleSchema,
+		annotations: ACT,
+		async handler(ctx, { plan, store, root }) {
+			guardPayloadSize("plan", plan);
+			const rootReal = root !== void 0 || store === "cas" ? (await resolveRoot(ctx.policy, root)).rootReal : void 0;
+			const opts = {
+				store: store ?? "inline",
+				emitters: EMITTERS
+			};
+			if (rootReal !== void 0) opts.root = rootReal;
+			const { bundle } = await compilePlan(plan, opts);
+			if (rootReal !== void 0) {
+				await saveManifest(rootReal, bundle);
+				ctx.seenRoots.add(rootReal);
+			}
+			ctx.log.info("compiled", {
+				manifestDigest: bundle.manifestDigest,
+				artifacts: bundle.manifest.artifacts.length
+			});
+			return bundle;
+		},
+		summarize: (b) => ({
+			manifestDigest: b.manifestDigest,
+			planDigest: b.manifest.planDigest,
+			name: b.manifest.name,
+			profile: b.manifest.profile,
+			artifacts: b.manifest.artifacts.length,
+			blobs: Object.keys(b.blobs).length
+		})
+	}),
+	defineTool({
+		name: "axiom_manifest_verify",
+		title: "Verify a ManifestBundle",
+		description: "Structural and content-address verification: schema, recomputed manifestDigest, every inline blob hashes to its key, attestation subject matches. When a root with .axiom/trust/keys.json is available, detached DSSE signatures are verified and the trusted keyids are reported under `signatures`. Never writes.",
+		inputSchema: {
+			bundle: LooseObject.describe("ManifestBundle"),
+			root: RootArg
+		},
+		outputSchema: ManifestVerifyOutput,
+		annotations: READ,
+		async handler(ctx, { bundle, root }) {
+			guardPayloadSize("bundle", bundle);
+			const r = verifyBundle(bundle);
+			const out = {
+				ok: r.ok,
+				canonical: r.canonical,
+				signed: r.signed,
+				missing: r.missing,
+				errors: r.errors
+			};
+			if (r.manifestDigest !== void 0) out.manifestDigest = r.manifestDigest;
+			if (r.ok) {
+				const rootReal = await optionalRoot(ctx, root);
+				if (rootReal !== void 0) {
+					const sig = await verifyBundleAgainstRoot(rootReal, parseBundle(bundle));
+					if (sig !== void 0) {
+						out.signatures = sig;
+						out.signed = sig.keyids.length > 0;
+						if (!sig.ok) out.ok = false;
+					}
+				}
+			}
+			return out;
+		},
+		summarize: (o) => ({
+			ok: o.ok,
+			manifestDigest: o.manifestDigest,
+			canonical: o.canonical,
+			signed: o.signed,
+			keyids: o.signatures?.keyids,
+			missing: o.missing.length,
+			errors: o.errors.slice(0, 20)
+		})
+	}),
+	defineTool({
+		name: "axiom_check",
+		title: "Run policy checks on a bundle",
+		description: "Evaluate the profile's predicates (plus the manifest's own checks) against the bundle. Repo facts are read from the root when one is available and the profile allows it. Verdict `error` means a provider could not run — never a silent pass.",
+		inputSchema: {
+			bundle: LooseObject.describe("ManifestBundle"),
+			profile: ProfileArg,
+			root: RootArg
+		},
+		outputSchema: CheckReportSchema,
+		annotations: READ,
+		async handler(ctx, { bundle, profile, root }) {
+			return checkBundle(ctx, parseBundle(bundle), profile, await optionalRoot(ctx, root));
+		},
+		summarize: summarizeReport
+	}),
+	defineTool({
+		name: "axiom_apply_dry_run",
+		title: "Dry-run apply (stage + diff, no writes to the tree)",
+		description: "Stage the bundle under <root>/.axiom/staging, run pre-apply checks and produce a unified diff against the current tree. Nothing outside .axiom/ is touched. Echo the returned manifestDigest as `confirmDigest` to axiom_apply.",
+		inputSchema: {
+			bundle: LooseObject.describe("ManifestBundle"),
+			root: RootArg,
+			profile: ProfileArg
+		},
+		outputSchema: ApplyResultSchema,
+		annotations: READ,
+		async handler(ctx, { bundle, root, profile }) {
+			const parsed = parseBundle(bundle);
+			const { rootReal } = await resolveRoot(ctx.policy, root);
+			return await apply({
+				bundle: parsed,
+				root: rootReal,
+				mode: "dry-run",
+				preChecks: () => checkBundle(ctx, parsed, profile, rootReal)
+			});
+		},
+		summarize: summarizeApply
+	}),
+	defineTool({
+		name: "axiom_apply",
+		title: "Apply a bundle to the filesystem (two-phase commit)",
+		description: "Transactionally write the bundle into the root: pre-image verification, staging, journal, atomic renames, scoped rollback on failure. Requires `confirmDigest === bundle.manifestDigest` (echo the digest you saw in dry-run). Idempotent: re-applying an applied digest is a no-op.",
+		inputSchema: {
+			bundle: LooseObject.describe("ManifestBundle"),
+			root: RootArg,
+			profile: ProfileArg,
+			confirmDigest: z.string().optional().describe("Must equal bundle.manifestDigest"),
+			mode: z.enum(["fs", "pr"]).optional().describe("fs (default) writes files; pr additionally creates a git branch and commits exactly the touched paths (no push, no PR creation)"),
+			branch: z.string().optional().describe("pr mode: branch name (default axiom/<name>/<digest12>)"),
+			commitMessage: z.string().optional().describe("pr mode: commit message (passed to git on stdin)")
+		},
+		outputSchema: ApplyResultSchema,
+		annotations: WRITE,
+		async handler(ctx, { bundle, root, profile, confirmDigest, mode, branch, commitMessage }) {
+			const parsed = parseBundle(bundle);
+			if (confirmDigest !== parsed.manifestDigest) throw new AxiomError("ERR_CONFIRM_DIGEST_MISMATCH", "confirmDigest must equal bundle.manifestDigest", { details: {
+				confirmDigest: confirmDigest ?? null,
+				manifestDigest: parsed.manifestDigest
+			} });
+			const { rootReal } = await resolveRoot(ctx.policy, root);
+			const profileDoc = await profileFor(ctx, parsed, profile, rootReal);
+			const result = await apply({
+				bundle: parsed,
+				root: rootReal,
+				mode: mode ?? "fs",
+				confirmDigest,
+				...branch === void 0 ? {} : { branch },
+				...commitMessage === void 0 ? {} : { commitMessage },
+				preChecks: () => checkBundle(ctx, parsed, profile, rootReal)
+			});
+			if (result.status === "applied" || result.status === "noop") {
+				await saveManifest(rootReal, parsed);
+				ctx.seenRoots.add(rootReal);
+			}
+			if (result.status === "applied" && profileWantsAntiRollback([...profileDoc.checks, ...parsed.manifest.checks])) await advanceTrustState(rootReal, parsed);
+			ctx.log.info("apply", {
+				manifestDigest: parsed.manifestDigest,
+				status: result.status,
+				root: rootReal
+			});
+			return result;
+		},
+		summarize: summarizeApply
+	}),
+	defineTool({
+		name: "axiom_rollback",
+		title: "Roll back an applied manifest",
+		description: "Replay the journal of a committed/committing manifest in reverse: restore backups, remove created files, drop the applied marker.",
+		inputSchema: {
+			root: RootArg,
+			manifestDigest: z.string().describe("`sha256:<hex>` (or bare hex) of the manifest to roll back")
+		},
+		outputSchema: RollbackOutput,
+		annotations: WRITE,
+		async handler(ctx, { root, manifestDigest }) {
+			const ref = toDigestRef(manifestDigest);
+			const { rootReal } = await resolveRoot(ctx.policy, root);
+			const journal = await rollback(rootReal, ref);
+			ctx.log.info("rollback", {
+				manifestDigest: ref,
+				root: rootReal,
+				phase: journal.phase
+			});
+			return {
+				manifestDigest: ref,
+				status: "rolled-back",
+				phase: journal.phase,
+				steps: journal.steps.length,
+				root: rootReal
+			};
+		},
+		summarize: (o) => o
+	}),
+	defineTool({
+		name: "axiom_manifest_diff",
+		title: "Diff two manifests",
+		description: "Compare two manifests by artifact path and digest. Each side is a ManifestBundle or a `sha256:<hex>` reference to a bundle stored under an allowlisted root.",
+		inputSchema: {
+			a: BundleOrRef,
+			b: BundleOrRef
+		},
+		outputSchema: ManifestDiffOutput,
+		annotations: READ,
+		async handler(ctx, { a, b }) {
+			const [ba, bb] = await Promise.all([resolveBundleOrRef(ctx, a, "a"), resolveBundleOrRef(ctx, b, "b")]);
+			return diffManifests(ba.manifest, bb.manifest);
+		},
+		summarize: (d) => ({
+			added: d.added.length,
+			removed: d.removed.length,
+			changed: d.changed.length,
+			sample: {
+				added: d.added.slice(0, 20),
+				removed: d.removed.slice(0, 20),
+				changed: d.changed.slice(0, 20)
+			}
+		})
+	}),
+	defineTool({
+		name: "axiom_axm_parse",
+		title: "Parse .axm source into a Plan",
+		description: "Parse .axm v2 text into a Plan with 1-based {line, column} diagnostics; `plan` is present only when error-free. Read-only.",
+		inputSchema: { source: z.string().describe(".axm source text") },
+		outputSchema: AxmParseOutput,
+		annotations: READ,
+		async handler(_ctx, { source }) {
+			guardPayloadSize("source", source);
+			const { parseAxm } = await import("./axm-lazy-WdJHPy6W.js");
+			const r = parseAxm(source);
+			return r.plan === void 0 ? { diagnostics: r.diagnostics } : r;
+		},
+		summarize: (o) => ({
+			ok: o.plan !== void 0,
+			name: o.plan?.name,
+			diagnostics: o.diagnostics.slice(0, 20)
+		})
+	}),
+	defineTool({
+		name: "axiom_roots_list",
+		title: "List allowlisted roots",
+		description: "The frozen set of roots this server may read and write, as given by --root at startup.",
+		inputSchema: {},
+		outputSchema: RootsListOutput,
+		annotations: READ,
+		async handler(ctx) {
+			const roots = [];
+			for (const p of ctx.policy.roots) {
+				const [writable, hasGit] = await Promise.all([access(p, constants.W_OK).then(() => true, () => false), stat(path.join(p, ".git")).then(() => true, () => false)]);
+				roots.push({
+					path: p,
+					writable,
+					hasGit
+				});
+			}
+			return { roots };
+		},
+		summarize: (o) => o
+	}),
+	defineTool({
+		name: "axiom_repo_snapshot",
+		title: "Snapshot a root",
+		description: "Deterministic, content-addressed inventory of a root: every regular file (and symlink) as { path, bytes, sha256, mode, kind }, sorted by code point, with snapshotDigest = sha256(JCS(body)). No timestamps, no absolute paths — the same tree gives the same digest on every machine. Honours the root .gitignore, always skips .git/ and .axiom/, never follows symlinks, never leaves the root. Use it to build Plans against real pre-image digests, or diff two snapshots with `axiom snapshot-diff`.",
+		inputSchema: {
+			root: RootArg,
+			include: z.array(z.string().min(1)).optional().describe("Relative globs (*, **, ?) to keep; default everything"),
+			exclude: z.array(z.string().min(1)).optional().describe("Relative globs to drop"),
+			maxFiles: z.int().min(1).max(SNAPSHOT_MAX_FILES_CAP).default(SNAPSHOT_MAX_FILES_DEFAULT).describe(`Stop after this many files (cap ${SNAPSHOT_MAX_FILES_CAP}); sets truncated`),
+			maxBytes: z.int().nonnegative().default(SNAPSHOT_MAX_BYTES_DEFAULT).describe("Stop once the summed size would exceed this; sets truncated"),
+			followSymlinks: z.literal(false).default(false).describe("Always false; symlinks are recorded, never followed"),
+			respectGitignore: z.boolean().default(true),
+			withContentDigest: z.boolean().default(true).describe("false → sizes only, no sha256")
+		},
+		outputSchema: RepoSnapshotSchema,
+		annotations: READ,
+		async handler(ctx, input) {
+			const { rootReal } = await resolveRoot(ctx.policy, input.root);
+			const opts = {
+				maxFiles: input.maxFiles,
+				maxBytes: input.maxBytes,
+				respectGitignore: input.respectGitignore,
+				withContentDigest: input.withContentDigest
+			};
+			if (input.include !== void 0) opts.include = input.include;
+			if (input.exclude !== void 0) opts.exclude = input.exclude;
+			const snap = await snapshotRoot(rootReal, opts);
+			ctx.log.debug("snapshot", {
+				root: rootReal,
+				files: snap.body.counts.files
+			});
+			return snap;
+		},
+		summarize: (o) => ({
+			snapshotDigest: o.snapshotDigest,
+			counts: o.body.counts,
+			truncated: o.body.truncated,
+			paths: o.body.files.slice(0, 20).map((f) => f.path)
+		})
+	})
+];
+async function resolveBundleOrRef(ctx, v, label) {
+	if (typeof v === "string") {
+		const ref = toDigestRef(v);
+		const found = await loadManifest(/* @__PURE__ */ new Set([...ctx.policy.roots, ...ctx.seenRoots]), ref);
+		if (found === void 0) throw new AxiomError("ERR_NOT_FOUND", `${label}: no stored manifest for ${ref}`, { details: { ref } });
+		return found;
+	}
+	return parseBundle(v);
+}
+function summarizeReport(r) {
+	return {
+		manifestDigest: r.manifestDigest,
+		profile: r.profile,
+		verdict: r.verdict,
+		counts: countBy(r.findings, (f) => f.severity),
+		findings: r.findings.slice(0, 20).map((f) => ({
+			id: f.id,
+			severity: f.severity,
+			message: f.message,
+			path: f.path
+		})),
+		providers: r.providers,
+		durationMs: r.durationMs
+	};
+}
+function summarizeApply(r) {
+	return {
+		manifestDigest: r.manifestDigest,
+		mode: r.mode,
+		status: r.status,
+		root: r.root,
+		files: countBy(r.files, (f) => f.status),
+		diffBytes: r.diff === void 0 ? void 0 : Buffer.byteLength(r.diff, "utf8"),
+		journal: r.journal,
+		error: r.error,
+		sample: r.files.slice(0, 20).map((f) => ({
+			path: f.path,
+			op: f.op,
+			status: f.status
+		}))
+	};
+}
+function toolByName(name) {
+	return TOOL_DEFS.find((t) => t.name === name);
+}
+//#endregion
+//#region src/server.ts
+const pkg = createRequire(import.meta.url)("../package.json");
+const SERVER_NAME = "axiom";
+const SERVER_VERSION = pkg.version;
+function toStructuredError(err) {
+	if (err instanceof AxiomError) return err.toJSON();
+	if (err instanceof z.ZodError) return {
+		code: "ERR_INVALID_PLAN",
+		message: "input does not match schema",
+		details: { issues: err.issues.slice(0, 20).map((i) => ({
+			path: i.path.join("."),
+			message: i.message
+		})) }
+	};
+	return {
+		code: "ERR_INTERNAL",
+		message: err instanceof Error ? err.message : String(err)
+	};
+}
+function errorResult(err) {
+	const structured = toStructuredError(err);
+	return {
+		isError: true,
+		content: [{
+			type: "text",
+			text: JSON.stringify(structured)
+		}],
+		structuredContent: structured
+	};
+}
+/** Wrap a tool handler: never throws; AxiomError → isError result with the closed code. */
+function wrapHandler(def, ctx) {
+	return async (input) => {
+		try {
+			const output = await def.handler(ctx, input);
+			const structured = def.outputSchema.parse(output);
+			return {
+				content: [{
+					type: "text",
+					text: JSON.stringify(def.summarize(structured))
+				}],
+				structuredContent: structured
+			};
+		} catch (err) {
+			ctx.log.warn("tool failed", {
+				tool: def.name,
+				error: toStructuredError(err)
+			});
+			return errorResult(err);
+		}
+	};
+}
+function json(uri, value) {
+	return { contents: [{
+		uri,
+		mimeType: "application/json",
+		text: JSON.stringify(value, null, 2)
+	}] };
+}
+function notFound(uri) {
+	throw new AxiomError("ERR_NOT_FOUND", `resource not found: ${uri}`);
+}
+function createServer(policy, opts = {}) {
+	const log = opts.log ?? silentLogger;
+	const ctx = {
+		policy,
+		log,
+		seenRoots: /* @__PURE__ */ new Set()
+	};
+	if (opts.guards !== void 0) ctx.guards = opts.guards;
+	const server = new McpServer({
+		name: SERVER_NAME,
+		version: SERVER_VERSION
+	}, { capabilities: {
+		tools: {},
+		resources: {}
+	} });
+	for (const def of opts.tools ?? TOOL_DEFS) server.registerTool(def.name, {
+		title: def.title,
+		description: def.description,
+		inputSchema: def.inputSchema,
+		outputSchema: def.outputSchema,
+		annotations: {
+			title: def.title,
+			...def.annotations
+		}
+	}, wrapHandler(def, ctx));
+	const allRoots = () => /* @__PURE__ */ new Set([...policy.roots, ...ctx.seenRoots]);
+	const listOf = (sub, scheme) => async () => {
+		return { resources: (await listStored(allRoots(), sub)).map((i) => ({
+			uri: `axiom://${scheme}/${i.sha}`,
+			name: i.sha,
+			mimeType: "application/json"
+		})) };
+	};
+	server.registerResource("manifest", new ResourceTemplate("axiom://manifest/{sha}", { list: listOf("manifests", "manifest") }), {
+		title: "Stored ManifestBundle",
+		mimeType: "application/json"
+	}, async (uri, { sha }) => {
+		const found = await loadManifest(allRoots(), toDigestRef(String(sha)));
+		return found === void 0 ? notFound(uri.href) : json(uri.href, found);
+	});
+	server.registerResource("report", new ResourceTemplate("axiom://report/{sha}", { list: listOf("reports", "report") }), {
+		title: "Last CheckReport for a manifest",
+		mimeType: "application/json"
+	}, async (uri, { sha }) => {
+		const found = await loadReport(allRoots(), toDigestRef(String(sha)));
+		return found === void 0 ? notFound(uri.href) : json(uri.href, found);
+	});
+	server.registerResource("applied", new ResourceTemplate("axiom://applied/{sha}", { list: listOf("applied", "applied") }), {
+		title: "ApplyResult of an applied manifest",
+		mimeType: "application/json"
+	}, async (uri, { sha }) => {
+		const found = await loadApplied(allRoots(), toDigestRef(String(sha)));
+		return found === void 0 ? notFound(uri.href) : json(uri.href, found);
+	});
+	server.registerResource("profile", new ResourceTemplate("axiom://profile/{name}", { list: async () => ({ resources: [
+		"default",
+		"strict",
+		"permissive"
+	].map((n) => ({
+		uri: `axiom://profile/${n}`,
+		name: n,
+		mimeType: "application/json"
+	})) }) }), {
+		title: "Resolved check profile",
+		mimeType: "application/json"
+	}, async (uri, { name }) => {
+		const searchDirs = [...policy.roots].map((r) => `${r}/.axiom/profiles`);
+		return json(uri.href, await loadProfile(String(name), { searchDirs }));
+	});
+	server.registerResource("schema", new ResourceTemplate("axiom://schema/{kind}", {
+		list: async () => ({ resources: SCHEMA_KINDS.map((k) => ({
+			uri: `axiom://schema/${k}`,
+			name: k,
+			mimeType: "application/schema+json"
+		})) }),
+		complete: { kind: (v) => SCHEMA_KINDS.filter((k) => k.toLowerCase().startsWith(v.toLowerCase())) }
+	}), {
+		title: "JSON Schema (draft 2020-12)",
+		mimeType: "application/schema+json"
+	}, async (uri, { kind }) => {
+		const k = String(kind);
+		if (!isSchemaKind(k)) notFound(uri.href);
+		return { contents: [{
+			uri: uri.href,
+			mimeType: "application/schema+json",
+			text: JSON.stringify(jsonSchemaFor(k), null, 2)
+		}] };
+	});
+	server.registerResource("emitters", "axiom://emitters", {
+		title: "Template emitters available to axiom_plan_compile",
+		mimeType: "application/json"
+	}, async (uri) => json(uri.href, emitterCatalogue()));
+	log.info("server created", {
+		name: SERVER_NAME,
+		version: SERVER_VERSION,
+		roots: [...policy.roots]
+	});
+	return server;
+}
+//#endregion
+//#region src/spec.ts
+function buildToolsSpec() {
+	return TOOL_DEFS.map((t) => ({
+		name: t.name,
+		description: t.description,
+		riskClass: t.riskClass,
+		annotations: t.annotations,
+		inputSchema: toolJsonSchema(z.object(t.inputSchema)),
+		outputSchema: toolJsonSchema(t.outputSchema)
+	}));
+}
+/** Stable text form (2-space JSON + trailing newline) used both by the generator and the parity test. */
+function renderToolsSpec() {
+	return `${JSON.stringify(buildToolsSpec(), null, 2)}\n`;
+}
+//#endregion
+export { BUNDLE_BYTES_MAX, LOG_LEVELS, SCHEMA_KINDS, SERVER_NAME, SERVER_VERSION, SUMMARY_LIST_MAX, TOOL_DEFS, buildToolsSpec, createLogger, createRootsPolicy, createServer, isLogLevel, isSameOrInside, isSchemaKind, jsonSchemaFor, renderToolsSpec, resolveRoot, riskClassOf, toStructuredError, toolByName };
+
+//# sourceMappingURL=index.js.map