axiom extensions

axiom extensions builds sandboxed executable extensions from Rust, TypeScript or Python source, signs and resolves their packages, reviews the authority they request, and verifies or runs them for a target host. This page covers all 19 subcommands in Axiom CLI 0.149.1.

All axiom extensions commands run locally without Cloud login. verify, test, inspect, permissions, graph and run work offline.

Diagram source

flowchart LR
  SRC[Extension source] --> SB[source-build]
  SRC --> SR[source-release]
  DRAFT[Package draft] --> B[build]
  B --> SG[sign]
  SG --> RS[resolve]
  SR --> WF[AxiomExtensions.toml]
  RS --> WF
  WF --> V[verify]
  WF --> P[permissions and diff]
  V --> T[test]
  T --> RUN[run]

There are two paths to a release workflow. source-release compiles one registered source module, signs it with local keys and writes the workflow file in one step. The manual path builds a package from a draft, signs it, and resolves it into the package lock that your workflow file references. Either way, verify and test check the workflow offline, permissions and diff review authority, and run emits the exact descriptor a target host receives.

axiom extensions

axiom extensions <COMMAND>

Shared inputs

Third-party packages used inside extension source are managed separately with axiom dependencies.

Author and inspect source

axiom extensions prepare-ide

Generate editor helpers for one extension so the editor can check calls into it. No guest compiler, extractor, runtime or package script runs. Helpers and a receipt bound to input digests are written under .axiom/extensions/ide/<alias>/.

axiom extensions prepare-ide [OPTIONS] <ALIAS>

axiom extensions rust-inspect

Show how a Rust source extension lowers: its macros, generated bindings, SDK interface and hidden build workspace.

axiom extensions rust-inspect [OPTIONS] <ALIAS>

axiom extensions rust-inspect pricing

axiom extensions typescript-inspect

Show the generated TypeScript declarations, bridge entry, SDK interface and dependencies of a TypeScript source extension.

axiom extensions typescript-inspect [OPTIONS] <ALIAS>

axiom extensions python-inspect

Show the generated Python stubs, ahead-of-time lowering, source map, SDK interface and dependencies of a Python source extension.

axiom extensions python-inspect [OPTIONS] <ALIAS>

axiom extensions migrate-rust

Move a legacy low-level Rust extension onto the explicit raw compatibility surface while preserving behavior. Without --out, --write or --check it is a dry run that prints the planned changes.

axiom extensions migrate-rust [OPTIONS] <ALIAS>

--out, --write and --check are mutually exclusive.

axiom extensions migrate-rust pricing
axiom extensions migrate-rust pricing --check

Interfaces

axiom extensions interface

Emit the canonical, language-neutral SDK interface of one authored extension: exports, requested imports, types and language mappings. Add an authority lock and target to see the surface that target actually receives.

axiom extensions interface [OPTIONS] <ALIAS>

axiom extensions interface-diff

Compare two SDK interface artifacts semantically. Each change is classified as compatible, authority-increase or breaking.

axiom extensions interface-diff [OPTIONS] <BEFORE> <AFTER>

Build, sign and resolve

axiom extensions source-build

Compile one registered Rust, TypeScript or Python source module into verified WASM. It needs the language toolchain and the matching Axiom extension SDK installed in the extension project; see Build an extension.

axiom extensions source-build [OPTIONS] <ALIAS>

The build result prints as JSON.

axiom extensions source-build pricing --target web

axiom extensions source-release

Build and sign one registered source module into a local release workflow that ordinary axiom run commands consume. The grant covers exactly the authority the module requests for its declared targets.

axiom extensions source-release [OPTIONS] --application <APPLICATION> <ALIAS>

Release files go to <out>/release/<alias>/. Locally generated owner-only signing keys go to <out>/keys/<alias>/; keep them out of source control. An extension with dependencies needs those modules released separately first.

axiom extensions source-release checkout --deps AxiomDeps.toml --application example.checkout

axiom extensions build

Validate an extension package draft (a JSON package envelope with extension contents) and write its canonical encoding. It prints the output path and SHA-256 digest.

axiom extensions build --out <OUT> <SOURCE>

axiom extensions build pricing.draft.json --out pricing.axiom

axiom extensions sign

Sign a canonical package and write a detached axiom-package-proof/v1 document with the artifact digest, signature and public key.

axiom extensions sign --key <KEY> --out <OUT> <ARTIFACT>

axiom extensions sign pricing.axiom --key pricing.key --out pricing.proof.json

axiom extensions resolve

Resolve local extension packages from the dependency manifest into the committed package lock.

axiom extensions resolve [OPTIONS]

axiom extensions resolve

Verify and review authority

axiom extensions verify

Verify every signed package, authority input, lock, target policy and provenance record in the workflow, offline. Run it in CI before release.

axiom extensions verify [OPTIONS]

axiom extensions verify --manifest AxiomExtensions.toml

axiom extensions inspect

Explain one extension's identity, provenance and authority as JSON.

axiom extensions inspect [OPTIONS] <ALIAS>

axiom extensions permissions

Show the authority an extension requests, what the application grants, and what each target effectively allows, with dependency paths and whether the grant is development-only.

axiom extensions permissions [OPTIONS] <ALIAS>

axiom extensions permissions pricing --manifest AxiomExtensions.toml

axiom extensions graph

Show extension dependencies and their transitive origins as JSON.

axiom extensions graph [OPTIONS]

axiom extensions diff

Diff two canonical authority locks. The report always prints; the command exits non-zero when authority increases unless you approve the increase explicitly.

axiom extensions diff [OPTIONS] <BEFORE> <AFTER>

axiom extensions diff before.authority.lock.json after.authority.lock.json

Test and run

axiom extensions test

Run deterministic, offline release conformance checks: the same verification as verify, plus a failure for any extension without an executable target or effective authority.

axiom extensions test [OPTIONS]

axiom extensions run

Verify one extension and print the exact descriptor handed to the selected target host (axiom-extension-run-handoff/v1) without running guest code. With --export, execute one verified export in the server reference host instead.

axiom extensions run [OPTIONS] <ALIAS>

axiom extensions run pricing --target web
axiom extensions run pricing --export quote --input '{"sku":"A1"}'

Frontend exports run inside the application with axiom run <app>.acore --target android|ios|web.

Related pages

• Build an extension
• Extension reference
• Extension dependencies
• Contract, package and security commands