@aotui/runtime 1.0.0 → 1.0.2

package/dist/cli/catalog-resolver.d.ts

@@ -0,0 +1,41 @@
+import { type CatalogData } from './default-catalog.js';
+import type { CatalogConfig, CatalogTrustKeyConfig } from '../engine/app/config.js';
+export interface CatalogSignature {
+    keyId: string;
+    algorithm?: 'ed25519';
+    value: string;
+}
+export interface RemoteCatalogEnvelope {
+    catalog: CatalogData;
+    signature?: CatalogSignature;
+}
+export interface TrustedCatalogKey {
+    keyId: string;
+    algorithm: 'ed25519';
+    publicKey: string;
+}
+export interface CatalogResolverOptions {
+    remoteUrl?: string;
+    cachePath?: string;
+    requireSignature?: boolean;
+    trustedKeys?: TrustedCatalogKey[];
+    fetchImpl?: typeof fetch;
+}
+export interface ResolvedCatalog {
+    source: 'remote' | 'cache' | 'builtin';
+    catalog: CatalogData;
+    remoteUrl?: string;
+    cachedAt?: string;
+    signatureVerified: boolean;
+    warnings: string[];
+}
+export declare function resolveCatalogOptionsFromConfig(config?: CatalogConfig): CatalogResolverOptions;
+export declare function resolveCatalog(options?: CatalogResolverOptions): Promise<ResolvedCatalog>;
+export declare function fetchRemoteCatalog(remoteUrl: string, options?: CatalogResolverOptions): Promise<{
+    catalog: CatalogData;
+    signature?: CatalogSignature;
+    signatureVerified: boolean;
+    warnings: string[];
+}>;
+export declare function verifyCatalogSignature(catalog: CatalogData, signature: CatalogSignature, key: TrustedCatalogKey | CatalogTrustKeyConfig): boolean;
+export declare function stableStringify(value: unknown): string;

package/dist/cli/catalog-resolver.js

@@ -0,0 +1,186 @@
+import { createPublicKey, verify } from 'crypto';
+import os from 'os';
+import path from 'path';
+import { promises as fs } from 'fs';
+import { DEFAULT_APP_CATALOG } from './default-catalog.js';
+import { isCatalogData } from './catalog.js';
+export function resolveCatalogOptionsFromConfig(config) {
+    return {
+        remoteUrl: config?.url ?? process.env.AOTUI_APP_CATALOG_URL,
+        cachePath: config?.cachePath,
+        requireSignature: config?.requireSignature ?? false,
+        trustedKeys: (config?.trustedKeys ?? []).map((key) => ({
+            keyId: key.keyId,
+            algorithm: key.algorithm ?? 'ed25519',
+            publicKey: key.publicKey
+        }))
+    };
+}
+export async function resolveCatalog(options = {}) {
+    const remoteUrl = options.remoteUrl?.trim();
+    const cachePath = options.cachePath ?? getDefaultCatalogCachePath();
+    const warnings = [];
+    if (remoteUrl) {
+        try {
+            const remote = await fetchRemoteCatalog(remoteUrl, options);
+            await writeCatalogCache(cachePath, {
+                remoteUrl,
+                cachedAt: new Date().toISOString(),
+                signatureVerified: remote.signatureVerified,
+                catalog: remote.catalog,
+                signature: remote.signature
+            });
+            return {
+                source: 'remote',
+                catalog: remote.catalog,
+                remoteUrl,
+                cachedAt: new Date().toISOString(),
+                signatureVerified: remote.signatureVerified,
+                warnings: remote.warnings
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            warnings.push(`Remote catalog unavailable: ${message}`);
+            const cached = await readCatalogCache(cachePath);
+            if (cached) {
+                return {
+                    source: 'cache',
+                    catalog: cached.catalog,
+                    remoteUrl: cached.remoteUrl,
+                    cachedAt: cached.cachedAt,
+                    signatureVerified: cached.signatureVerified,
+                    warnings
+                };
+            }
+        }
+    }
+    return {
+        source: 'builtin',
+        catalog: DEFAULT_APP_CATALOG,
+        signatureVerified: false,
+        warnings
+    };
+}
+export async function fetchRemoteCatalog(remoteUrl, options = {}) {
+    const fetchImpl = options.fetchImpl ?? globalThis.fetch;
+    if (!fetchImpl) {
+        throw new Error('Fetch API is not available in this runtime');
+    }
+    const response = await fetchImpl(remoteUrl, {
+        headers: {
+            accept: 'application/json'
+        }
+    });
+    if (!response.ok) {
+        throw new Error(`HTTP ${response.status} ${response.statusText}`.trim());
+    }
+    const json = await response.json();
+    const envelope = normalizeEnvelope(json);
+    const trustedKeys = options.trustedKeys ?? [];
+    const requireSignature = options.requireSignature ?? false;
+    const warnings = [];
+    let signatureVerified = false;
+    if (envelope.signature) {
+        if (envelope.signature.algorithm && envelope.signature.algorithm !== 'ed25519') {
+            throw new Error(`Unsupported catalog signature algorithm: ${envelope.signature.algorithm}`);
+        }
+        const key = trustedKeys.find((item) => item.keyId === envelope.signature?.keyId);
+        if (!key) {
+            if (requireSignature || trustedKeys.length > 0) {
+                throw new Error(`Missing trusted key for catalog signature: ${envelope.signature.keyId}`);
+            }
+            warnings.push(`Catalog signature present but key "${envelope.signature.keyId}" is not configured as trusted.`);
+        }
+        else {
+            const verified = verifyCatalogSignature(envelope.catalog, envelope.signature, key);
+            if (!verified) {
+                throw new Error(`Catalog signature verification failed for key "${envelope.signature.keyId}"`);
+            }
+            signatureVerified = true;
+        }
+    }
+    else if (requireSignature || trustedKeys.length > 0) {
+        throw new Error('Remote catalog is unsigned, but signature verification is required');
+    }
+    return {
+        catalog: envelope.catalog,
+        signature: envelope.signature,
+        signatureVerified,
+        warnings
+    };
+}
+export function verifyCatalogSignature(catalog, signature, key) {
+    const normalizedAlgorithm = key.algorithm ?? 'ed25519';
+    if (normalizedAlgorithm !== 'ed25519') {
+        throw new Error(`Unsupported trusted key algorithm: ${normalizedAlgorithm}`);
+    }
+    const publicKey = createPublicKey(key.publicKey);
+    const payload = Buffer.from(stableStringify(catalog), 'utf-8');
+    const signatureBytes = Buffer.from(signature.value, 'base64');
+    return verify(null, payload, publicKey, signatureBytes);
+}
+export function stableStringify(value) {
+    if (Array.isArray(value)) {
+        return `[${value.map((item) => stableStringify(item)).join(',')}]`;
+    }
+    if (value && typeof value === 'object') {
+        const entries = Object.entries(value)
+            .filter(([, entryValue]) => entryValue !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right));
+        return `{${entries.map(([key, entryValue]) => `${JSON.stringify(key)}:${stableStringify(entryValue)}`).join(',')}}`;
+    }
+    return JSON.stringify(value);
+}
+function normalizeEnvelope(value) {
+    if (isCatalogData(value)) {
+        return { catalog: value };
+    }
+    if (typeof value !== 'object' || value === null) {
+        throw new Error('Catalog response is not a valid JSON object');
+    }
+    const envelope = value;
+    if (!isCatalogData(envelope.catalog)) {
+        throw new Error('Catalog response does not include a valid "catalog" payload');
+    }
+    if (envelope.signature !== undefined) {
+        if (typeof envelope.signature !== 'object' || envelope.signature === null) {
+            throw new Error('Catalog signature must be an object');
+        }
+        const signature = envelope.signature;
+        if (typeof signature.keyId !== 'string' || typeof signature.value !== 'string') {
+            throw new Error('Catalog signature is missing keyId or value');
+        }
+        if (signature.algorithm !== undefined && signature.algorithm !== 'ed25519') {
+            throw new Error(`Unsupported catalog signature algorithm: ${signature.algorithm}`);
+        }
+    }
+    return envelope;
+}
+function getDefaultCatalogCachePath() {
+    return path.join(os.homedir(), '.agentina', 'cache', 'app-catalog.json');
+}
+async function readCatalogCache(cachePath) {
+    try {
+        const content = await fs.readFile(cachePath, 'utf-8');
+        const cached = JSON.parse(content);
+        if (!isCatalogData(cached.catalog)) {
+            return null;
+        }
+        if (typeof cached.remoteUrl !== 'string' || typeof cached.cachedAt !== 'string' || typeof cached.signatureVerified !== 'boolean') {
+            return null;
+        }
+        return cached;
+    }
+    catch (error) {
+        if (error?.code === 'ENOENT') {
+            return null;
+        }
+        throw error;
+    }
+}
+async function writeCatalogCache(cachePath, record) {
+    await fs.mkdir(path.dirname(cachePath), { recursive: true });
+    await fs.writeFile(cachePath, JSON.stringify(record, null, 2), 'utf-8');
+}
+//# sourceMappingURL=catalog-resolver.js.map

package/dist/cli/catalog-resolver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog-resolver.js","sourceRoot":"","sources":["../../src/cli/catalog-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,IAAI,CAAC;AACpC,OAAO,EAAE,mBAAmB,EAAoB,MAAM,sBAAsB,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AA6C7C,MAAM,UAAU,+BAA+B,CAAC,MAAsB;IAClE,OAAO;QACH,SAAS,EAAE,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB;QAC3D,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,gBAAgB,EAAE,MAAM,EAAE,gBAAgB,IAAI,KAAK;QACnD,WAAW,EAAE,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACnD,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,SAAS;YACrC,SAAS,EAAE,GAAG,CAAC,SAAS;SAC3B,CAAC,CAAC;KACN,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAkC,EAAE;IACrE,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,0BAA0B,EAAE,CAAC;IACpE,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,SAAS,EAAE,CAAC;QACZ,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAC5D,MAAM,iBAAiB,CAAC,SAAS,EAAE;gBAC/B,SAAS;gBACT,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAClC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;aAC9B,CAAC,CAAC;YAEH,OAAO;gBACH,MAAM,EAAE,QAAQ;gBAChB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,SAAS;gBACT,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;gBAClC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;gBAC3C,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC5B,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC,+BAA+B,OAAO,EAAE,CAAC,CAAC;YAExD,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,MAAM,EAAE,CAAC;gBACT,OAAO;oBACH,MAAM,EAAE,OAAO;oBACf,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;oBAC3C,QAAQ;iBACX,CAAC;YACN,CAAC;QACL,CAAC;IACL,CAAC;IAED,OAAO;QACH,MAAM,EAAE,SAAS;QACjB,OAAO,EAAE,mBAAmB;QAC5B,iBAAiB,EAAE,KAAK;QACxB,QAAQ;KACX,CAAC;AACN,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,SAAiB,EACjB,UAAkC,EAAE;IAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACxD,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE;QACxC,OAAO,EAAE;YACL,MAAM,EAAE,kBAAkB;SAC7B;KACJ,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC;IAC9C,MAAM,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,KAAK,CAAC;IAC3D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QACrB,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,IAAI,QAAQ,CAAC,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,4CAA4C,QAAQ,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QAChG,CAAC;QAED,MAAM,GAAG,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACjF,IAAI,CAAC,GAAG,EAAE,CAAC;YACP,IAAI,gBAAgB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,KAAK,CAAC,8CAA8C,QAAQ,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC,sCAAsC,QAAQ,CAAC,SAAS,CAAC,KAAK,iCAAiC,CAAC,CAAC;QACnH,CAAC;aAAM,CAAC;YACJ,MAAM,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACnF,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACZ,MAAM,IAAI,KAAK,CAAC,kDAAkD,QAAQ,CAAC,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC;YACnG,CAAC;YACD,iBAAiB,GAAG,IAAI,CAAC;QAC7B,CAAC;IACL,CAAC;SAAM,IAAI,gBAAgB,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;IAC1F,CAAC;IAED,OAAO;QACH,OAAO,EAAE,QAAQ,CAAC,OAAO;QACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,iBAAiB;QACjB,QAAQ;KACX,CAAC;AACN,CAAC;AAED,MAAM,UAAU,sBAAsB,CAClC,OAAoB,EACpB,SAA2B,EAC3B,GAA8C;IAE9C,MAAM,mBAAmB,GAAG,GAAG,CAAC,SAAS,IAAI,SAAS,CAAC;IACvD,IAAI,mBAAmB,KAAK,SAAS,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,sCAAsC,mBAAmB,EAAE,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC9D,OAAO,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAc;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACvE,CAAC;IAED,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC;aAC3D,MAAM,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC;aACpD,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1D,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACxH,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACrC,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,QAAQ,GAAG,KAAuC,CAAC;IACzD,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;YACxE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAsC,CAAC;QAClE,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,4CAA4C,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QACvF,CAAC;IACL,CAAC;IAED,OAAO,QAAiC,CAAC;AAC7C,CAAC;AAED,SAAS,0BAA0B;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC;AAC7E,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IAC7C,IAAI,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAwB,CAAC;QAC1D,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;YAC/H,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QAClB,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,IAAI,CAAC;QAChB,CAAC;QACD,MAAM,KAAK,CAAC;IAChB,CAAC;AACL,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAA2B;IAC3E,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AAC5E,CAAC"}

package/dist/cli/catalog.d.ts

@@ -0,0 +1,6 @@
+import { type CatalogAppEntry, type CatalogData } from './default-catalog.js';
+export interface CatalogSearchResult extends CatalogAppEntry {
+    score: number;
+}
+export declare function isCatalogData(value: unknown): value is CatalogData;
+export declare function searchCatalog(query: string | undefined, catalog?: CatalogData): CatalogSearchResult[];

package/dist/cli/catalog.js

@@ -0,0 +1,55 @@
+import { DEFAULT_APP_CATALOG } from './default-catalog.js';
+export function isCatalogData(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const candidate = value;
+    if (typeof candidate.version !== 'number' || typeof candidate.updatedAt !== 'string' || !Array.isArray(candidate.apps)) {
+        return false;
+    }
+    return candidate.apps.every((app) => (typeof app === 'object'
+        && app !== null
+        && typeof app.id === 'string'
+        && typeof app.name === 'string'
+        && typeof app.packageName === 'string'
+        && typeof app.description === 'string'
+        && typeof app.latestVersion === 'string'
+        && (app.keywords === undefined || Array.isArray(app.keywords))
+        && (app.homepage === undefined || typeof app.homepage === 'string')));
+}
+export function searchCatalog(query, catalog = DEFAULT_APP_CATALOG) {
+    const normalized = (query ?? '').trim().toLowerCase();
+    if (!normalized) {
+        return catalog.apps.map((app) => ({ ...app, score: 1 }));
+    }
+    const matches = catalog.apps
+        .map((app) => {
+        const haystacks = [
+            app.id,
+            app.name,
+            app.packageName,
+            app.description,
+            ...(app.keywords ?? [])
+        ].map((item) => item.toLowerCase());
+        const contains = haystacks.some((item) => item.includes(normalized));
+        if (!contains) {
+            return null;
+        }
+        let score = 10;
+        if (app.packageName.toLowerCase() === normalized)
+            score += 30;
+        if (app.id.toLowerCase() === normalized)
+            score += 20;
+        if (app.name.toLowerCase() === normalized)
+            score += 15;
+        if (app.packageName.toLowerCase().includes(normalized))
+            score += 8;
+        if ((app.keywords ?? []).some((k) => k.toLowerCase() === normalized))
+            score += 5;
+        return { ...app, score };
+    })
+        .filter((app) => app !== null)
+        .sort((a, b) => b.score - a.score || a.packageName.localeCompare(b.packageName));
+    return matches;
+}
+//# sourceMappingURL=catalog.js.map

package/dist/cli/catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"catalog.js","sourceRoot":"","sources":["../../src/cli/catalog.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAA0C,MAAM,sBAAsB,CAAC;AAMnG,MAAM,UAAU,aAAa,CAAC,KAAc;IACxC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,MAAM,SAAS,GAAG,KAA6B,CAAC;IAChD,IAAI,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,IAAI,OAAO,SAAS,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrH,OAAO,KAAK,CAAC;IACjB,CAAC;IAED,OAAO,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CACjC,OAAO,GAAG,KAAK,QAAQ;WACpB,GAAG,KAAK,IAAI;WACZ,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;WAC1B,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;WAC5B,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;WACnC,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;WACnC,OAAO,GAAG,CAAC,aAAa,KAAK,QAAQ;WACrC,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;WAC3D,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CACtE,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAyB,EAAE,UAAuB,mBAAmB;IAC/F,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtD,IAAI,CAAC,UAAU,EAAE,CAAC;QACd,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI;SACvB,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACT,MAAM,SAAS,GAAG;YACd,GAAG,CAAC,EAAE;YACN,GAAG,CAAC,IAAI;YACR,GAAG,CAAC,WAAW;YACf,GAAG,CAAC,WAAW;YACf,GAAG,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;SAC1B,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAEpC,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,QAAQ,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,IAAI,KAAK,GAAG,EAAE,CAAC;QACf,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,KAAK,UAAU;YAAE,KAAK,IAAI,EAAE,CAAC;QAC9D,IAAI,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,KAAK,UAAU;YAAE,KAAK,IAAI,EAAE,CAAC;QACrD,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU;YAAE,KAAK,IAAI,EAAE,CAAC;QACvD,IAAI,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC;YAAE,KAAK,IAAI,CAAC,CAAC;QAEjF,OAAO,EAAE,GAAG,GAAG,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,GAAG,EAA8B,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC;SACzD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,WAAW,CAAC,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC;IAErF,OAAO,OAAO,CAAC;AACnB,CAAC"}

package/dist/cli/default-catalog.d.ts

@@ -0,0 +1,15 @@
+export interface CatalogAppEntry {
+    id: string;
+    name: string;
+    packageName: string;
+    description: string;
+    latestVersion: string;
+    keywords?: string[];
+    homepage?: string;
+}
+export interface CatalogData {
+    version: number;
+    updatedAt: string;
+    apps: CatalogAppEntry[];
+}
+export declare const DEFAULT_APP_CATALOG: CatalogData;

package/dist/cli/default-catalog.js

@@ -0,0 +1,39 @@
+export const DEFAULT_APP_CATALOG = {
+    version: 1,
+    updatedAt: '2026-03-06T00:00:00.000Z',
+    apps: [
+        {
+            id: 'system-terminal',
+            name: 'Terminal',
+            packageName: '@aotui/system-terminal',
+            description: 'Multi-terminal command execution app for agent workflows.',
+            latestVersion: '0.1.0',
+            keywords: ['terminal', 'shell', 'command', 'tools']
+        },
+        {
+            id: 'system-planning',
+            name: 'Planning App',
+            packageName: '@aotui/system-planning',
+            description: 'Create plans, phases, and todos for long-running tasks.',
+            latestVersion: '0.1.0',
+            keywords: ['planning', 'todo', 'project', 'task']
+        },
+        {
+            id: 'system-lite-browser',
+            name: 'Lite Browser',
+            packageName: '@aotui/system-lite-browser',
+            description: 'Lightweight browser with page extraction for agents.',
+            latestVersion: '0.1.0',
+            keywords: ['browser', 'web', 'search', 'crawl']
+        },
+        {
+            id: 'system-token-monitor',
+            name: 'Token Monitor',
+            packageName: '@aotui/system-token-monitor',
+            description: 'Observe token usage and budget in AOTUI sessions.',
+            latestVersion: '0.1.0',
+            keywords: ['token', 'monitor', 'budget', 'usage']
+        }
+    ]
+};
+//# sourceMappingURL=default-catalog.js.map

package/dist/cli/default-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-catalog.js","sourceRoot":"","sources":["../../src/cli/default-catalog.ts"],"names":[],"mappings":"AAgBA,MAAM,CAAC,MAAM,mBAAmB,GAAgB;IAC5C,OAAO,EAAE,CAAC;IACV,SAAS,EAAE,0BAA0B;IACrC,IAAI,EAAE;QACF;YACI,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,UAAU;YAChB,WAAW,EAAE,wBAAwB;YACrC,WAAW,EAAE,2DAA2D;YACxE,aAAa,EAAE,OAAO;YACtB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC;SACtD;QACD;YACI,EAAE,EAAE,iBAAiB;YACrB,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,wBAAwB;YACrC,WAAW,EAAE,yDAAyD;YACtE,aAAa,EAAE,OAAO;YACtB,QAAQ,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC;SACpD;QACD;YACI,EAAE,EAAE,qBAAqB;YACzB,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,4BAA4B;YACzC,WAAW,EAAE,sDAAsD;YACnE,aAAa,EAAE,OAAO;YACtB,QAAQ,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAC;SAClD;QACD;YACI,EAAE,EAAE,sBAAsB;YAC1B,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,6BAA6B;YAC1C,WAAW,EAAE,mDAAmD;YAChE,aAAa,EAAE,OAAO;YACtB,QAAQ,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,CAAC;SACpD;KACJ;CACJ,CAAC"}

package/dist/cli/npm-installer.d.ts

@@ -0,0 +1,16 @@
+export interface NpmInstallOptions {
+    cacheRoot?: string;
+    forceReinstall?: boolean;
+    npmBinary?: string;
+    commandRunner?: (command: string, args: string[], cwd: string) => Promise<void>;
+}
+export interface NpmInstallResult {
+    packageName: string;
+    packageSpec: string;
+    requestedVersion: string | null;
+    resolvedVersion: string | null;
+    installRoot: string;
+    installedPath: string;
+    localSource: string;
+}
+export declare function installNpmPackage(packageInput: string, options?: NpmInstallOptions): Promise<NpmInstallResult>;

package/dist/cli/npm-installer.js

@@ -0,0 +1,88 @@
+import path from 'path';
+import os from 'os';
+import fs from 'fs';
+import fsp from 'fs/promises';
+import { execFile as nodeExecFile } from 'child_process';
+import { promisify } from 'util';
+import { parseNpmSpecifier } from './sources.js';
+const execFile = promisify(nodeExecFile);
+export async function installNpmPackage(packageInput, options) {
+    const parsed = parseNpmSpecifier(packageInput);
+    const cacheRoot = options?.cacheRoot ?? getDefaultAppCacheRoot();
+    const npmBinary = options?.npmBinary ?? 'npm';
+    const requestedVersion = parsed.version;
+    const versionSegment = sanitizeSegment(parsed.version ?? 'latest');
+    const packageSegment = sanitizePackageName(parsed.packageName);
+    const installRoot = path.join(cacheRoot, packageSegment, versionSegment);
+    await fsp.mkdir(installRoot, { recursive: true });
+    await ensureInstallWorkspace(installRoot);
+    const installedPath = path.join(installRoot, 'node_modules', parsed.packageName);
+    const alreadyInstalled = fs.existsSync(installedPath);
+    if (!alreadyInstalled || options?.forceReinstall) {
+        await runInstallCommand(npmBinary, ['install', '--no-save', '--omit=dev', '--ignore-scripts', parsed.packageSpec], installRoot, options?.commandRunner);
+    }
+    if (!fs.existsSync(installedPath)) {
+        throw new Error(`Package install succeeded but app path was not found: ${installedPath}`);
+    }
+    const resolvedVersion = await readPackageVersion(installedPath);
+    return {
+        packageName: parsed.packageName,
+        packageSpec: parsed.packageSpec,
+        requestedVersion,
+        resolvedVersion,
+        installRoot,
+        installedPath,
+        localSource: `local:${installedPath}`
+    };
+}
+function getDefaultAppCacheRoot() {
+    return path.join(os.homedir(), '.agentina', 'apps', 'npm');
+}
+async function ensureInstallWorkspace(workspaceRoot) {
+    const packageJsonPath = path.join(workspaceRoot, 'package.json');
+    if (fs.existsSync(packageJsonPath)) {
+        return;
+    }
+    await fsp.writeFile(packageJsonPath, JSON.stringify({
+        name: 'agentina-app-cache',
+        private: true
+    }, null, 2), 'utf-8');
+}
+async function runInstallCommand(command, args, cwd, commandRunner) {
+    if (commandRunner) {
+        await commandRunner(command, args, cwd);
+        return;
+    }
+    try {
+        await execFile(command, args, { cwd });
+    }
+    catch (error) {
+        const stderr = error?.stderr ? String(error.stderr).trim() : '';
+        const reason = stderr ? `: ${stderr}` : '';
+        throw new Error(`Failed to install npm package with "${command} ${args.join(' ')}"${reason}`);
+    }
+}
+async function readPackageVersion(installedPath) {
+    const packageJsonPath = path.join(installedPath, 'package.json');
+    if (!fs.existsSync(packageJsonPath)) {
+        return null;
+    }
+    try {
+        const raw = await fsp.readFile(packageJsonPath, 'utf-8');
+        const json = JSON.parse(raw);
+        return typeof json.version === 'string' ? json.version : null;
+    }
+    catch {
+        return null;
+    }
+}
+function sanitizePackageName(value) {
+    return value
+        .replace(/^@/, 'scope-')
+        .replace(/[\\/]/g, '__')
+        .replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+function sanitizeSegment(value) {
+    return value.replace(/[^a-zA-Z0-9._-]/g, '_');
+}
+//# sourceMappingURL=npm-installer.js.map

package/dist/cli/npm-installer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-installer.js","sourceRoot":"","sources":["../../src/cli/npm-installer.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,GAAG,MAAM,aAAa,CAAC;AAC9B,OAAO,EAAE,QAAQ,IAAI,YAAY,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEjD,MAAM,QAAQ,GAAG,SAAS,CAAC,YAAY,CAAC,CAAC;AAmBzC,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,YAAoB,EAAE,OAA2B;IACrF,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,sBAAsB,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,OAAO,EAAE,SAAS,IAAI,KAAK,CAAC;IAC9C,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC;IACxC,MAAM,cAAc,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,IAAI,QAAQ,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,cAAc,CAAC,CAAC;IAEzE,MAAM,GAAG,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,MAAM,sBAAsB,CAAC,WAAW,CAAC,CAAC;IAE1C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;IACjF,MAAM,gBAAgB,GAAG,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IAEtD,IAAI,CAAC,gBAAgB,IAAI,OAAO,EAAE,cAAc,EAAE,CAAC;QAC/C,MAAM,iBAAiB,CACnB,SAAS,EACT,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,CAAC,WAAW,CAAC,EAC9E,WAAW,EACX,OAAO,EAAE,aAAa,CACzB,CAAC;IACN,CAAC;IAED,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yDAAyD,aAAa,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,eAAe,GAAG,MAAM,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAEhE,OAAO;QACH,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB;QAChB,eAAe;QACf,WAAW;QACX,aAAa;QACb,WAAW,EAAE,SAAS,aAAa,EAAE;KACxC,CAAC;AACN,CAAC;AAED,SAAS,sBAAsB;IAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IACvD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACjE,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO;IACX,CAAC;IACD,MAAM,GAAG,CAAC,SAAS,CACf,eAAe,EACf,IAAI,CAAC,SAAS,CACV;QACI,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,IAAI;KAChB,EACD,IAAI,EACJ,CAAC,CACJ,EACD,OAAO,CACV,CAAC;AACN,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC5B,OAAe,EACf,IAAc,EACd,GAAW,EACX,aAA+E;IAE/E,IAAI,aAAa,EAAE,CAAC;QAChB,MAAM,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACxC,OAAO;IACX,CAAC;IAED,IAAI,CAAC;QACD,MAAM,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CAAC,uCAAuC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC;IAClG,CAAC;AACL,CAAC;AAED,KAAK,UAAU,kBAAkB,CAAC,aAAqB;IACnD,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IACjE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;QACtD,OAAO,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACtC,OAAO,KAAK;SACP,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;SACvB,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IAClC,OAAO,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC"}

package/dist/cli/sources.d.ts

@@ -0,0 +1,21 @@
+export interface NpmSpecifier {
+    packageName: string;
+    version: string | null;
+    packageSpec: string;
+}
+export type ParsedInstallSource = ParsedLocalSource | ParsedNpmSource;
+export interface ParsedLocalSource {
+    kind: 'local';
+    source: string;
+    absolutePath: string;
+}
+export interface ParsedNpmSource {
+    kind: 'npm';
+    source: string;
+    packageName: string;
+    version: string | null;
+    packageSpec: string;
+}
+export declare function parseInstallSource(input: string, cwd?: string): ParsedInstallSource;
+export declare function parseNpmSpecifier(raw: string): NpmSpecifier;
+export declare function looksLikeLocalPath(value: string): boolean;

package/dist/cli/sources.js

@@ -0,0 +1,131 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { fileURLToPath } from 'url';
+export function parseInstallSource(input, cwd = process.cwd()) {
+    const value = input.trim();
+    if (!value) {
+        throw new Error('Install source is required');
+    }
+    if (value.startsWith('git:')) {
+        throw new Error('git source is not supported yet. Use npm package or local path');
+    }
+    if (value.startsWith('local:')) {
+        const localPath = value.slice('local:'.length);
+        return parseLocalSource(localPath, cwd);
+    }
+    if (value.startsWith('file://')) {
+        const absolutePath = fileURLToPath(value);
+        return {
+            kind: 'local',
+            source: `local:${absolutePath}`,
+            absolutePath
+        };
+    }
+    if (value.startsWith('npm:')) {
+        const npm = parseNpmSpecifier(value.slice('npm:'.length));
+        return {
+            kind: 'npm',
+            source: `npm:${npm.packageSpec}`,
+            packageName: npm.packageName,
+            version: npm.version,
+            packageSpec: npm.packageSpec
+        };
+    }
+    if (looksLikeLocalPath(value)) {
+        return parseLocalSource(value, cwd);
+    }
+    const npm = parseNpmSpecifier(value);
+    return {
+        kind: 'npm',
+        source: `npm:${npm.packageSpec}`,
+        packageName: npm.packageName,
+        version: npm.version,
+        packageSpec: npm.packageSpec
+    };
+}
+function parseLocalSource(localPathInput, cwd) {
+    const expanded = expandHomePath(localPathInput.trim());
+    const absolutePath = path.isAbsolute(expanded)
+        ? expanded
+        : path.resolve(cwd, expanded);
+    return {
+        kind: 'local',
+        source: `local:${absolutePath}`,
+        absolutePath
+    };
+}
+export function parseNpmSpecifier(raw) {
+    const spec = raw.trim();
+    if (!spec) {
+        throw new Error('npm package spec cannot be empty');
+    }
+    if (spec.startsWith('@')) {
+        const slashIndex = spec.indexOf('/');
+        if (slashIndex <= 1) {
+            throw new Error(`Invalid scoped npm package spec: ${raw}`);
+        }
+        const atAfterScope = spec.lastIndexOf('@');
+        if (atAfterScope > slashIndex) {
+            const packageName = spec.slice(0, atAfterScope);
+            const version = spec.slice(atAfterScope + 1);
+            validatePackageName(packageName, raw);
+            return {
+                packageName,
+                version: version || null,
+                packageSpec: version ? `${packageName}@${version}` : packageName
+            };
+        }
+        validatePackageName(spec, raw);
+        return {
+            packageName: spec,
+            version: null,
+            packageSpec: spec
+        };
+    }
+    const atIndex = spec.lastIndexOf('@');
+    if (atIndex > 0) {
+        const packageName = spec.slice(0, atIndex);
+        const version = spec.slice(atIndex + 1);
+        validatePackageName(packageName, raw);
+        return {
+            packageName,
+            version: version || null,
+            packageSpec: version ? `${packageName}@${version}` : packageName
+        };
+    }
+    validatePackageName(spec, raw);
+    return {
+        packageName: spec,
+        version: null,
+        packageSpec: spec
+    };
+}
+export function looksLikeLocalPath(value) {
+    if (!value)
+        return false;
+    if (value.startsWith('.') || value.startsWith('/') || value.startsWith('~'))
+        return true;
+    if (/^[a-zA-Z]:[\\/]/.test(value))
+        return true;
+    if (value.startsWith('file://'))
+        return true;
+    if (value.startsWith('@'))
+        return false;
+    if (fs.existsSync(value))
+        return true;
+    return false;
+}
+function expandHomePath(input) {
+    if (!input.startsWith('~')) {
+        return input;
+    }
+    return path.join(os.homedir(), input.slice(1));
+}
+function validatePackageName(name, raw) {
+    const npmNamePattern = /^(?:@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/;
+    if (!npmNamePattern.test(name)) {
+        throw new Error(`Invalid npm package name in spec "${raw}"`);
+    }
+}
+//# sourceMappingURL=sources.js.map

package/dist/cli/sources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sources.js","sourceRoot":"","sources":["../../src/cli/sources.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAwBpC,MAAM,UAAU,kBAAkB,CAAC,KAAa,EAAE,MAAc,OAAO,CAAC,GAAG,EAAE;IACzE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAC;IACtF,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,YAAY,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO;YACH,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,SAAS,YAAY,EAAE;YAC/B,YAAY;SACf,CAAC;IACN,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,OAAO;YACH,IAAI,EAAE,KAAK;YACX,MAAM,EAAE,OAAO,GAAG,CAAC,WAAW,EAAE;YAChC,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,WAAW,EAAE,GAAG,CAAC,WAAW;SAC/B,CAAC;IACN,CAAC;IAED,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACrC,OAAO;QACH,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,OAAO,GAAG,CAAC,WAAW,EAAE;QAChC,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,OAAO,EAAE,GAAG,CAAC,OAAO;QACpB,WAAW,EAAE,GAAG,CAAC,WAAW;KAC/B,CAAC;AACN,CAAC;AAED,SAAS,gBAAgB,CAAC,cAAsB,EAAE,GAAW;IACzD,MAAM,QAAQ,GAAG,cAAc,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC;IACvD,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QAC1C,CAAC,CAAC,QAAQ;QACV,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAElC,OAAO;QACH,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,SAAS,YAAY,EAAE;QAC/B,YAAY;KACf,CAAC;AACN,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,GAAW;IACzC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACxD,CAAC;IAED,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,UAAU,IAAI,CAAC,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,YAAY,GAAG,UAAU,EAAE,CAAC;YAC5B,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;YAC7C,mBAAmB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;YACtC,OAAO;gBACH,WAAW;gBACX,OAAO,EAAE,OAAO,IAAI,IAAI;gBACxB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW;aACnE,CAAC;QACN,CAAC;QACD,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/B,OAAO;YACH,WAAW,EAAE,IAAI;YACjB,OAAO,EAAE,IAAI;YACb,WAAW,EAAE,IAAI;SACpB,CAAC;IACN,CAAC;IAED,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QACxC,mBAAmB,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACtC,OAAO;YACH,WAAW;YACX,OAAO,EAAE,OAAO,IAAI,IAAI;YACxB,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,WAAW,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW;SACnE,CAAC;IACN,CAAC;IAED,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,OAAO;QACH,WAAW,EAAE,IAAI;QACjB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,IAAI;KACpB,CAAC;AACN,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzF,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACjC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,GAAW;IAClD,MAAM,cAAc,GAAG,0DAA0D,CAAC;IAClF,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,GAAG,CAAC,CAAC;IACjE,CAAC;AACL,CAAC"}