@amoree-code/ocean 0.0.0-stage → 1.2.0

package/node_modules/@ocean/loop/dist/tasks/verify-task.js

@@ -0,0 +1,234 @@
+import { execFile as execFileCallback } from "node:child_process";
+import { statSync } from "node:fs";
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+import { isWorkspaceProject, projectOfTasksRoot, repoRoot, resolveWithin, workspaceTasksRoot, } from "@ocean/core/shared/paths.js";
+import { expandHome, hasControlCharacters, projectVerify, readProjectManifest, } from "@ocean/core/shared/project-resolution.js";
+const execFile = promisify(execFileCallback);
+// Only commands whose first token is on this list are ever executed by the
+// verifier — including every link of a `&&`/`||`/`;`/`|` chain, since each
+// link runs as its own command. A task's `## Verification` section is prose
+// with inline-backtick spans and fenced code blocks, so the allowlist keeps
+// the verifier from running an arbitrary span that merely looks like a
+// command. Command substitution and redirection (`` ` ``, `$(`, `>`, `<`) are
+// rejected outright: they let an allowlisted first token smuggle an
+// unrelated command in (e.g. `` bash -c "rm -rf $HOME" ``).
+const COMMAND_ALLOWLIST = new Set([
+    "pnpm",
+    "npm",
+    "npx",
+    "yarn",
+    "node",
+    "tsc",
+    "ocean",
+    "make",
+    "bash",
+    "sh",
+    "pytest",
+    "jest",
+    "vitest",
+    "biome",
+]);
+const defaultRunner = async (command, cwd) => {
+    try {
+        await execFile("bash", ["-lc", command], { cwd, timeout: 600_000 });
+        return { exitCode: 0 };
+    }
+    catch (error) {
+        const failure = error;
+        const code = typeof failure.code === "number"
+            ? failure.code
+            : Number(failure.code) || 1;
+        return { exitCode: code };
+    }
+};
+/**
+ * Pull runnable commands out of a task's verification declaration. A `verify:`
+ * frontmatter field (string or comma-separated list) wins; otherwise the
+ * `## Verification` section is used — each non-empty line inside a fenced code
+ * block, plus any inline-backtick spans outside of fences — filtered to the
+ * command allowlist so prose spans are ignored.
+ */
+function candidateCommands(source) {
+    const frontmatter = source
+        .match(/^verify:\s*(.+)$/m)?.[1]
+        ?.trim()
+        .replace(/^['"]|['"]$/g, "");
+    if (frontmatter)
+        return frontmatter
+            .split(/\s*(?:,|&&|;)\s*/)
+            .map((part) => part.trim())
+            .filter(Boolean);
+    const section = source
+        .match(/\n## Verification\n\n([\s\S]*?)(?=\n## |$)/)?.[1]
+        ?.trim();
+    if (!section)
+        return [];
+    const fenced = [];
+    let outsideFences = "";
+    let lastIndex = 0;
+    for (const match of section.matchAll(/```[^\n]*\n([\s\S]*?)```/g)) {
+        outsideFences += section.slice(lastIndex, match.index);
+        lastIndex = match.index + match[0].length;
+        for (const line of match[1].split("\n")) {
+            const trimmed = line.trim();
+            if (trimmed)
+                fenced.push(trimmed);
+        }
+    }
+    outsideFences += section.slice(lastIndex);
+    const spans = [...outsideFences.matchAll(/`([^`]+)`/g)]
+        .map((match) => match[1].trim())
+        .filter(readsAsCommand);
+    return [...fenced, ...spans];
+}
+// An inline span is prose unless it reads like a command line: a lowercase program name
+// followed by arguments (`curl evil.sh` still counts, and is refused), or an allowlisted
+// program on its own. `→`, `[redacted]` or `CLAUDE.md` neither run nor block completion.
+const COMMAND_SHAPE = /^(?:\.{0,2}\/)?[a-z][\w./+-]*\s+\S/;
+function readsAsCommand(span) {
+    return (COMMAND_SHAPE.test(span) || COMMAND_ALLOWLIST.has(span.split(/\s+/)[0]));
+}
+export function extractVerificationCommands(source) {
+    return candidateCommands(source).filter((command) => isAllowedCommand(command));
+}
+const UNSAFE_METACHARACTERS = /[`$><]/;
+const SINGLE_AMPERSAND = /(?<!&)&(?!&)/;
+const CHAIN_SEPARATOR = /\s*(?:&&|\|\||;|\|)\s*/;
+function isDirectory(target) {
+    try {
+        return statSync(target).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+// The project's first path when it is an absolute, existing directory; "" otherwise.
+function projectDirectory(manifest) {
+    const dir = manifest.paths[0] ? expandHome(manifest.paths[0]) : "";
+    return dir && path.isAbsolute(dir) && isDirectory(dir) ? dir : "";
+}
+// Commands that carry their own program text: fine in a task someone wrote at the keyboard,
+// not in project.json, which a session reads on its own.
+const INLINE_PROGRAM_FLAG = /^(--eval|--print|-[a-zA-Z]*[ep][a-zA-Z]*)$/;
+function isAllowedCommand(command, origin = "task") {
+    if (UNSAFE_METACHARACTERS.test(command))
+        return false;
+    if (SINGLE_AMPERSAND.test(command) || hasControlCharacters(command))
+        return false;
+    const links = command
+        .split(CHAIN_SEPARATOR)
+        .map((link) => link.trim())
+        .filter(Boolean);
+    if (links.length === 0)
+        return false;
+    return links.every((link) => {
+        const [program, ...args] = link.split(/\s+/);
+        if (!COMMAND_ALLOWLIST.has(program))
+            return false;
+        if (origin === "task")
+            return true;
+        if (program === "bash" || program === "sh")
+            return false;
+        return !(program === "node" && args.some((a) => INLINE_PROGRAM_FLAG.test(a)));
+    });
+}
+/**
+ * Independently verify a task by running the commands it declares. A task is
+ * only verified when it declares at least one runnable check and every check
+ * exits zero — the loop and `completeTask` never trust a self-reported
+ * `state: done` on its own.
+ */
+export async function verifyTask(id, root = workspaceTasksRoot(), options = {}) {
+    const taskFile = resolveWithin(root, id, "task.md");
+    const source = await readFile(taskFile, "utf8");
+    const candidates = candidateCommands(source);
+    const taskCommands = candidates.filter((command) => isAllowedCommand(command));
+    const fail = (reason, from) => ({
+        id,
+        passed: false,
+        reason,
+        checks: [],
+        source: from,
+    });
+    const noCommands = () => fail("no runnable verification commands declared; cannot self-certify done", "task");
+    // Commands were declared but none may run: that is a failure, never a reason to fall back.
+    if (candidates.length > 0 && taskCommands.length === 0)
+        return fail(`declared verification commands are not allowed: ${candidates.join(", ")}`, "task");
+    let commands = taskCommands;
+    let cwd = options.cwd ?? repoRoot();
+    let from = "task";
+    const project = projectOfTasksRoot(root);
+    // Another project's task checks its own repo: `pnpm lint` in the engine would prove nothing.
+    if (candidates.length > 0 &&
+        options.cwd === undefined &&
+        project &&
+        !isWorkspaceProject(project)) {
+        let manifest = null;
+        try {
+            manifest = await readProjectManifest(project);
+        }
+        catch {
+            // Unreadable manifest: reported below as a missing path.
+        }
+        const dir = manifest ? projectDirectory(manifest) : "";
+        if (!dir)
+            return fail(`task verify for ${project} needs the project's first path to be an absolute, existing directory`, "task");
+        cwd = dir;
+    }
+    if (candidates.length === 0) {
+        let manifest = null;
+        let verify = [];
+        try {
+            manifest = project ? await readProjectManifest(project) : null;
+            verify = manifest ? projectVerify(manifest) : [];
+        }
+        catch (error) {
+            return fail(`project verify is unreadable: ${error instanceof Error ? error.message : String(error)}`, "project");
+        }
+        if (!manifest || !verify.length)
+            return noCommands();
+        from = "project";
+        const rejected = verify.find((command) => !isAllowedCommand(command, "project"));
+        if (rejected)
+            return fail(`project verify command is not allowed: ${rejected}`, from);
+        // The caller's cwd (a worktree, say) wins; otherwise the project's first path.
+        if (options.cwd === undefined) {
+            const dir = projectDirectory(manifest);
+            if (!dir)
+                return fail(`project verify needs the project's first path to be an absolute, existing directory: ${manifest.paths[0] ? expandHome(manifest.paths[0]) : "(none)"}`, from);
+            cwd = dir;
+        }
+        commands = verify;
+    }
+    const run = options.run ?? defaultRunner;
+    const checks = [];
+    for (const command of commands) {
+        const { exitCode } = await run(command, cwd);
+        checks.push({ command, exitCode, ok: exitCode === 0 });
+    }
+    const passed = checks.every((check) => check.ok);
+    return {
+        id,
+        passed,
+        reason: passed
+            ? "all verification checks passed"
+            : `verification failed: ${checks
+                .filter((check) => !check.ok)
+                .map((check) => check.command)
+                .join(", ")}`,
+        checks,
+        source: from,
+    };
+}
+// What a task declares, and which of it the allowlist refuses: a dry readiness check that runs
+// nothing (T-291).
+export function declaredVerificationCommands(source) {
+    const declared = candidateCommands(source);
+    return {
+        declared,
+        refused: declared.filter((command) => !isAllowedCommand(command)),
+    };
+}
+//# sourceMappingURL=verify-task.js.map

package/node_modules/@ocean/loop/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@ocean/loop",
+  "version": "1.2.0",
+  "license": "MIT",
+  "type": "module",
+  "exports": {
+    "./*.js": {
+      "import": "./dist/*.js"
+    }
+  }
+}

package/node_modules/@ocean/market/dist/adapters/mcp-adapter.js

@@ -0,0 +1,64 @@
+import { mkdir, rm, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { expectRecord } from "./owned-directory.js";
+function records(value, field) {
+    if (value === undefined)
+        return undefined;
+    if (!Array.isArray(value))
+        throw new Error(`server.json ${field} must be an array`);
+    return value.map((item, index) => expectRecord(item, `server.json ${field}[${index}]`));
+}
+// One file per installed server; client wiring reads this directory.
+export function mcpServerFile(serversRoot, capabilityName) {
+    return path.join(serversRoot, `${capabilityName.replace(/[^a-z0-9._-]/g, "__")}.json`);
+}
+export function createMcpAdapter(serversRoot) {
+    return {
+        kind: "mcp",
+        parseSpec(spec) {
+            const record = expectRecord(spec, "server.json");
+            if (typeof record.name !== "string" || !record.name)
+                throw new Error("server.json name is required");
+            const packages = records(record.packages, "packages");
+            const remotes = records(record.remotes, "remotes");
+            if (!packages?.length && !remotes?.length)
+                throw new Error("server.json must declare at least one package or remote");
+            for (const item of packages ?? [])
+                if (typeof item.registryType !== "string" ||
+                    typeof item.identifier !== "string")
+                    throw new Error("server.json packages need registryType and identifier");
+            for (const item of remotes ?? [])
+                if (typeof item.url !== "string" || !item.url.startsWith("https://"))
+                    throw new Error("server.json remotes need an https url");
+            return record;
+        },
+        async install({ manifest, spec }) {
+            await mkdir(serversRoot(), { recursive: true });
+            await writeFile(mcpServerFile(serversRoot(), manifest.name), `${JSON.stringify({ capability: manifest.name, version: manifest.version, permissions: manifest.permissions, server: spec }, null, 2)}\n`);
+        },
+        // Every `description` in server.json: the server's and its packages'.
+        async inspect({ spec }) {
+            const texts = [];
+            const walk = (value, at) => {
+                if (Array.isArray(value))
+                    value.forEach((item, index) => {
+                        walk(item, `${at}[${index}]`);
+                    });
+                else if (value && typeof value === "object")
+                    for (const [key, item] of Object.entries(value)) {
+                        const where = at ? `${at}.${key}` : key;
+                        if (key === "description" && typeof item === "string")
+                            texts.push({ source: `server.json ${where}`, text: item });
+                        else
+                            walk(item, where);
+                    }
+            };
+            walk(spec, "");
+            return texts;
+        },
+        async uninstall({ manifest }) {
+            await rm(mcpServerFile(serversRoot(), manifest.name), { force: true });
+        },
+    };
+}
+//# sourceMappingURL=mcp-adapter.js.map

package/node_modules/@ocean/market/dist/adapters/owned-directory.js

@@ -0,0 +1,89 @@
+import { randomUUID } from "node:crypto";
+import { cp, mkdir, readdir, readFile, rename, rm, stat, writeFile, } from "node:fs/promises";
+import path from "node:path";
+import { resolveWithin } from "@ocean/core/shared/paths.js";
+// A directory the marketplace installed carries this marker. Anything without it — a core
+// skill, something the owner made by hand — is never overwritten or removed by an adapter.
+const MARKER = ".ocean-capability.json";
+const directoryName = /^[A-Za-z0-9][A-Za-z0-9._-]{0,99}$/;
+export function expectDirectoryName(value, field) {
+    if (typeof value !== "string" ||
+        !directoryName.test(value) ||
+        value.includes(".."))
+        throw new Error(`${field} must be a plain directory name`);
+    return value;
+}
+export function expectRecord(value, what) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error(`${what} must be an object`);
+    return value;
+}
+async function markerOwner(directory) {
+    try {
+        return JSON.parse(await readFile(path.join(directory, MARKER), "utf8")).name;
+    }
+    catch {
+        return undefined;
+    }
+}
+async function exists(file) {
+    try {
+        await stat(file);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function installOwnedDirectory(root, name, contentDir, owner) {
+    await mkdir(root, { recursive: true });
+    const target = resolveWithin(root, name);
+    if (await exists(target)) {
+        const current = await markerOwner(target);
+        if (current !== owner.name)
+            throw new Error(`${target} already exists and is ${current ? `owned by ${current}` : "not managed by the marketplace"}; refusing to overwrite it`);
+    }
+    const staging = resolveWithin(root, `.${name}.${randomUUID()}.staging`);
+    try {
+        await cp(contentDir, staging, {
+            recursive: true,
+            errorOnExist: true,
+            force: false,
+        });
+        await writeFile(path.join(staging, MARKER), `${JSON.stringify(owner)}\n`);
+        await rm(target, { recursive: true, force: true });
+        await rename(staging, target);
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+    return target;
+}
+// Missing is fine (already gone); owned by someone else is refused.
+export async function removeOwnedDirectory(root, name, owner) {
+    const target = resolveWithin(root, name);
+    if (!(await exists(target)))
+        return;
+    const current = await markerOwner(target);
+    if (current !== owner)
+        throw new Error(`${target} is ${current ? `owned by ${current}` : "not managed by the marketplace"}; refusing to remove it`);
+    await rm(target, { recursive: true, force: true });
+}
+// Every markdown file in a payload: what a model reads from a skill or a plugin.
+export async function markdownTexts(contentDir) {
+    const texts = [];
+    for (const entry of await readdir(contentDir, {
+        recursive: true,
+        withFileTypes: true,
+    })) {
+        if (!entry.isFile() || !entry.name.toLowerCase().endsWith(".md"))
+            continue;
+        const full = path.join(entry.parentPath, entry.name);
+        texts.push({
+            source: path.relative(contentDir, full),
+            text: await readFile(full, "utf8"),
+        });
+    }
+    return texts;
+}
+//# sourceMappingURL=owned-directory.js.map

package/node_modules/@ocean/market/dist/adapters/plugin-adapter.js

@@ -0,0 +1,39 @@
+import { stat } from "node:fs/promises";
+import { resolveWithin } from "@ocean/core/shared/paths.js";
+import { expectDirectoryName, expectRecord, installOwnedDirectory, markdownTexts, removeOwnedDirectory, } from "./owned-directory.js";
+export function createPluginAdapter(pluginsRoot) {
+    return {
+        kind: "plugin",
+        parseSpec(spec) {
+            const record = expectRecord(spec, "plugin spec");
+            const entry = record.entry ?? ".claude-plugin/plugin.json";
+            if (typeof entry !== "string" ||
+                !entry ||
+                entry.startsWith("/") ||
+                entry.split(/[\\/]/).includes(".."))
+                throw new Error("plugin spec.entry must be a relative path inside the payload");
+            return {
+                directory: expectDirectoryName(record.directory, "plugin spec.directory"),
+                entry,
+            };
+        },
+        async install({ manifest, spec, contentDir }) {
+            try {
+                if (!(await stat(resolveWithin(contentDir, spec.entry))).isFile())
+                    throw new Error();
+            }
+            catch {
+                throw new Error(`${manifest.name}: payload has no ${spec.entry}`);
+            }
+            await installOwnedDirectory(pluginsRoot(), spec.directory, contentDir, {
+                name: manifest.name,
+                version: manifest.version,
+            });
+        },
+        inspect: ({ contentDir }) => markdownTexts(contentDir),
+        async uninstall({ manifest, spec }) {
+            await removeOwnedDirectory(pluginsRoot(), spec.directory, manifest.name);
+        },
+    };
+}
+//# sourceMappingURL=plugin-adapter.js.map

package/node_modules/@ocean/market/dist/adapters/skill-adapter.js

@@ -0,0 +1,32 @@
+import { stat } from "node:fs/promises";
+import path from "node:path";
+import { skillHubRoot } from "../skills/skill-hub.js";
+import { expectDirectoryName, expectRecord, installOwnedDirectory, markdownTexts, removeOwnedDirectory, } from "./owned-directory.js";
+export function createSkillAdapter(hubRoot = skillHubRoot) {
+    return {
+        kind: "skill",
+        parseSpec(spec) {
+            const record = expectRecord(spec, "skill spec");
+            return {
+                directory: expectDirectoryName(record.directory, "skill spec.directory"),
+            };
+        },
+        async install({ manifest, spec, contentDir }) {
+            try {
+                await stat(path.join(contentDir, "SKILL.md"));
+            }
+            catch {
+                throw new Error(`${manifest.name}: payload has no SKILL.md at its root`);
+            }
+            await installOwnedDirectory(hubRoot(), spec.directory, contentDir, {
+                name: manifest.name,
+                version: manifest.version,
+            });
+        },
+        inspect: ({ contentDir }) => markdownTexts(contentDir),
+        async uninstall({ manifest, spec }) {
+            await removeOwnedDirectory(hubRoot(), spec.directory, manifest.name);
+        },
+    };
+}
+//# sourceMappingURL=skill-adapter.js.map

package/node_modules/@ocean/market/dist/capability/adapter.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=adapter.js.map

package/node_modules/@ocean/market/dist/capability/catalog.js

@@ -0,0 +1,63 @@
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+import { marketplaceIndexSchema, } from "@ocean/core/domain/capabilities/capability-manifest.js";
+import { compareSemver } from "./registry.js";
+export class LocalIndexSource {
+    id;
+    #indexFile;
+    constructor(indexFile) {
+        this.#indexFile = path.resolve(indexFile);
+        this.id = `file:${this.#indexFile}`;
+    }
+    async list() {
+        let raw;
+        try {
+            raw = JSON.parse(await readFile(this.#indexFile, "utf8"));
+        }
+        catch (error) {
+            throw new Error(`Cannot read marketplace index ${this.#indexFile}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        const parsed = marketplaceIndexSchema.safeParse(raw);
+        if (!parsed.success)
+            throw new Error(`Invalid marketplace index ${this.#indexFile}: ${parsed.error.issues
+                .map((issue) => `${issue.path.map(String).join(".")}: ${issue.message}`)
+                .join("; ")}`);
+        const baseDir = path.dirname(this.#indexFile);
+        return parsed.data.capabilities.map((manifest) => ({
+            manifest,
+            sourceId: this.id,
+            baseDir,
+        }));
+    }
+}
+export class CapabilityCatalog {
+    #sources;
+    constructor(sources) {
+        this.#sources = sources;
+    }
+    // Earlier sources win when two offer the same name@version.
+    async list() {
+        const seen = new Set();
+        const entries = [];
+        for (const source of this.#sources)
+            for (const entry of await source.list()) {
+                const key = `${entry.manifest.name}@${entry.manifest.version}`;
+                if (seen.has(key))
+                    continue;
+                seen.add(key);
+                entries.push(entry);
+            }
+        return entries;
+    }
+    // An exact version when given, otherwise the newest non-prerelease (a prerelease only when
+    // nothing else exists).
+    async find(name, version) {
+        const candidates = (await this.list()).filter((entry) => entry.manifest.name === name);
+        if (version)
+            return candidates.find((entry) => entry.manifest.version === version);
+        const stable = candidates.filter((entry) => !entry.manifest.version.split("+")[0].includes("-"));
+        const pool = stable.length ? stable : candidates;
+        return pool.sort((a, b) => compareSemver(b.manifest.version, a.manifest.version))[0];
+    }
+}
+//# sourceMappingURL=catalog.js.map

package/node_modules/@ocean/market/dist/capability/content-digest.js

@@ -0,0 +1,40 @@
+import { createHash } from "node:crypto";
+import { lstat, readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+// The digest `integrity.sha256` pins. Every entry is framed with its type, path and byte length,
+// so no two different trees can produce the same byte stream (a file `a` holding `bX` and a file
+// `ab` holding `X` hash differently). Symlinks are refused: a verified payload must be closed.
+export async function contentDigest(root) {
+    const hash = createHash("sha256");
+    const info = await lstat(root);
+    if (info.isSymbolicLink())
+        throw new Error(`${root} is a symlink`);
+    if (info.isFile()) {
+        const bytes = await readFile(root);
+        hash.update(`file\0\0${bytes.length}\0`).update(bytes);
+        return hash.digest("hex");
+    }
+    async function walk(current, prefix) {
+        const entries = (await readdir(current, { withFileTypes: true })).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+        for (const entry of entries) {
+            const full = path.join(current, entry.name);
+            const relative = prefix ? `${prefix}/${entry.name}` : entry.name;
+            const entryInfo = await lstat(full);
+            if (entryInfo.isSymbolicLink())
+                throw new Error(`${relative} is a symlink inside the payload`);
+            if (entryInfo.isDirectory()) {
+                hash.update(`dir\0${relative}\0`);
+                await walk(full, relative);
+            }
+            else if (entryInfo.isFile()) {
+                const bytes = await readFile(full);
+                hash.update(`file\0${relative}\0${bytes.length}\0`).update(bytes);
+            }
+            else
+                throw new Error(`${relative} is not a regular file`);
+        }
+    }
+    await walk(root, "");
+    return hash.digest("hex");
+}
+//# sourceMappingURL=content-digest.js.map

package/node_modules/@ocean/market/dist/capability/registry.js

@@ -0,0 +1,81 @@
+import { capabilityManifestSchema, semverPattern, } from "@ocean/core/domain/capabilities/capability-manifest.js";
+export class CapabilityRegistry {
+    #adapters = new Map();
+    register(adapter) {
+        if (this.#adapters.has(adapter.kind))
+            throw new Error(`A capability adapter for kind "${adapter.kind}" is already registered`);
+        this.#adapters.set(adapter.kind, adapter);
+    }
+    kinds() {
+        return [...this.#adapters.keys()].sort();
+    }
+    adapterFor(kind) {
+        const adapter = this.#adapters.get(kind);
+        if (!adapter)
+            throw new Error(`No capability adapter for kind "${kind}" (registered: ${this.kinds().join(", ") || "none"})`);
+        return adapter;
+    }
+    // Validates the envelope, then the kind-specific spec through its adapter.
+    resolve(raw) {
+        const parsed = capabilityManifestSchema.safeParse(raw);
+        if (!parsed.success)
+            throw new Error(`Invalid capability manifest: ${parsed.error.issues.map(describeIssue).join("; ")}`);
+        const manifest = parsed.data;
+        const adapter = this.adapterFor(manifest.kind);
+        let spec;
+        try {
+            spec = adapter.parseSpec(manifest.spec);
+        }
+        catch (error) {
+            throw new Error(`Invalid ${manifest.kind} spec for ${manifest.name}@${manifest.version}: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        return { manifest, adapter, spec };
+    }
+}
+function describeIssue(issue) {
+    return issue.path.length
+        ? `${issue.path.map(String).join(".")}: ${issue.message}`
+        : issue.message;
+}
+// Semver precedence (semver.org §11), enough to pick the newest version of a capability.
+export function compareSemver(a, b) {
+    const parse = (value) => {
+        const match = semverPattern.exec(value);
+        if (!match)
+            throw new Error(`Not a semver version: ${value}`);
+        return {
+            core: [Number(match[1]), Number(match[2]), Number(match[3])],
+            pre: match[4]?.split(".") ?? [],
+        };
+    };
+    const left = parse(a);
+    const right = parse(b);
+    for (let index = 0; index < 3; index++) {
+        const delta = left.core[index] - right.core[index];
+        if (delta !== 0)
+            return Math.sign(delta);
+    }
+    if (!left.pre.length || !right.pre.length)
+        return Math.sign(right.pre.length - left.pre.length);
+    for (let index = 0; index < Math.max(left.pre.length, right.pre.length); index++) {
+        const x = left.pre[index];
+        const y = right.pre[index];
+        if (x === undefined)
+            return -1;
+        if (y === undefined)
+            return 1;
+        const xNumeric = /^\d+$/.test(x);
+        const yNumeric = /^\d+$/.test(y);
+        if (xNumeric && yNumeric) {
+            const delta = Number(x) - Number(y);
+            if (delta !== 0)
+                return Math.sign(delta);
+        }
+        else if (xNumeric !== yNumeric)
+            return xNumeric ? -1 : 1;
+        else if (x !== y)
+            return x < y ? -1 : 1;
+    }
+    return 0;
+}
+//# sourceMappingURL=registry.js.map