@capybara-hq/plugin-tools 0.1.0-rc.1 → 0.1.0-rc.3

package/README.md

@@ -14,8 +14,6 @@ npm install --save-dev @capybara-hq/plugin-tools
 
 ```bash
 capybara-plugin pack [<dir>...] [--all <root>] [--out <dir>]
-capybara-plugin pack --bootstrap <manifest> [--root <dir>] [--out <dir>] [--registry <url>]
-                     [--npm-token <token>]
 capybara-plugin check [--root <dir>] [--plugins <glob>] [--base <ref>]
 capybara-plugin sync-versions [--root <dir>] [--plugins <glob>]
 capybara-plugin marketplace --write|--check [--base <rev>] [--root <dir>] [--file <path>]
@@ -30,12 +28,8 @@ capybara-plugin release [--dry-run] [--provenance] [--out <dir>] [--auto] [--roo
   manifest written into `plugin.json`, LICENSE / NOTICE and the bundled dependencies' notices
   included. A plugin with an extension gets `"main"` and `"exports": { ".": "./dist/index.mjs" }`,
   so once installed it resolves by package name (a test loads `@capybara-hq/plugin-model-fake`
-  from npm). `--all <root>` packs every plugin of a repository; `--bootstrap` packs the entries of
-  a bootstrap manifest (workspace entries from the repository, npm entries downloaded from
-  `--registry`, default `CAPYBARA_PACKAGES__NPM_REGISTRY` or the public registry, with
-  `--npm-token` / `CAPYBARA_PACKAGES__NPM_TOKEN` sent to the registry origin only, tarballs capped
-  at 50 MiB) and checks them against their pinned sha512 and their `package.json` name and version.
-  Output: `artifacts/plugins`.
+  from npm). `--all <root>` packs every plugin of a repository. Output: `artifacts/plugins`. (The
+  bootstrap plugins a kernel pins are no longer packed here: a starting kernel downloads them.)
 - **check**: every plugin check, on the plugins under `<root>/plugins/*` (or `--plugins <glob>`, or
   the root itself when it is a plugin): the dependency boundary (a plugin depends only on
   `@capybara-hq/plugin-sdk` and third-party packages), extension state under multiple replicas (no
@@ -101,7 +95,7 @@ and hides packaging bugs.
 
 ## Library
 
-The same code as functions: `packPlugin`, `packBootstrap`, `pluginChecks` / `runChecks` and each
+The same code as functions: `packPlugin`, `downloadPinnedNpmPackage`, `pluginChecks` / `runChecks` and each
 check (`checkDeps`, `checkPluginState`, `checkPluginPermissions`, `checkPluginPack`,
 `checkToolDesign`, `checkMigrations`, `checkAppliedMigrations`, `checkPluginTestImports`,
 `checkPluginReleaseMetadata`), `syncPluginVersions` (after `changeset version`),

package/bin/capybara-plugin.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // The `capybara-plugin` bin: runs the compiled CLI (dist/cli.js, built by `tsc -b`). In this
-// repository, the root scripts (pnpm pack-plugin, pack-plugins, pack-bootstrap, release) run the
+// repository, the root scripts (pnpm pack-plugin, pack-plugins, release) run the
 // TypeScript sources through tsx instead.
 import { existsSync } from "node:fs";
 

package/dist/check/index.d.ts

@@ -5,6 +5,7 @@ export { checkMigrations, checkSql } from "./migrations.js";
 export { checkPluginPack, PLUGIN_PACK_MAX_BYTES } from "./plugin-pack.js";
 export { checkPluginPermissions } from "./plugin-permissions.js";
 export { checkPluginState } from "./plugin-state.js";
+export { checkPluginToolKeys, TOOL_KEY_MAX } from "./plugin-tool-keys.js";
 export { syncPluginVersions } from "./plugin-versions.js";
 export { checkPluginReleaseMetadata } from "./release-metadata.js";
 export { formatFinding, printCheck } from "./report.js";

package/dist/check/index.js

@@ -5,6 +5,7 @@ export { checkMigrations, checkSql } from "./migrations.js";
 export { checkPluginPack, PLUGIN_PACK_MAX_BYTES } from "./plugin-pack.js";
 export { checkPluginPermissions } from "./plugin-permissions.js";
 export { checkPluginState } from "./plugin-state.js";
+export { checkPluginToolKeys, TOOL_KEY_MAX } from "./plugin-tool-keys.js";
 export { syncPluginVersions } from "./plugin-versions.js";
 export { checkPluginReleaseMetadata } from "./release-metadata.js";
 export { formatFinding, printCheck } from "./report.js";

package/dist/check/plugin-permissions.d.ts

@@ -1,5 +1,16 @@
 import { type Finding } from "./source.js";
 export type { Finding };
+/** A `ctx.tools.register({ name })` call found in an extension's setup. */
+export interface ToolRegistration {
+    file: string;
+    line: number;
+    /** The extension name of the enclosing defineExtension (undefined: not a literal). */
+    extension: string | undefined;
+    /** The tool name (undefined: not a literal or same-file const). */
+    tool: string | undefined;
+    /** The call carries a `capybara:allow-dynamic-permission <reason>` marker. */
+    allowed: boolean;
+}
 /**
  * 插件权限静态检查（AST）：把 setup(ctx) 里对平台能力的访问与 defineExtension 清单比对。规则：
  * - perm-secrets：用了 ctx.secrets 而 permissions.secrets 不是 true；
@@ -20,3 +31,9 @@ export type { Finding };
  * 扫描范围：传入目录下的非测试源码。
  */
 export declare function checkPluginPermissions(pluginDirs: string[]): Finding[];
+/**
+ * Every `ctx.tools.register({ name })` of the non-test sources under `pluginDirs`, found by the
+ * same scanner as {@link checkPluginPermissions} (so it follows ctx aliases and same-file helpers).
+ * Unparseable files are skipped here; the permissions check reports them.
+ */
+export declare function findToolRegistrations(pluginDirs: string[]): ToolRegistration[];

package/dist/check/plugin-permissions.js

@@ -115,6 +115,7 @@ function readManifest(obj, decls) {
         caps: new Set(),
         storage: false,
         models: false,
+        name: stringValue(prop(obj, "name")?.value ? resolve(prop(obj, "name")?.value, decls) : undefined),
         setup: undefined,
     };
     for (const key of ["requires", "optional", "provides"]) {
@@ -165,7 +166,7 @@ function readManifest(obj, decls) {
     }
     return m;
 }
-function scanSetup(f, m, decls) {
+function scanSetup(f, m, decls, onTool) {
     const out = [];
     /** 明确的违规：豁免注释不起作用。 */
     const add = (at, rule, message) => {
@@ -253,6 +254,13 @@ function scanSetup(f, m, decls) {
                     const spec = args[0] ? resolve(args[0], decls) : undefined;
                     const nameProp = spec?.type === "ObjectExpression" ? prop(spec, "name") : undefined;
                     const name = nameProp ? stringValue(resolve(nameProp.value, decls)) : undefined;
+                    onTool?.({
+                        file: f.file,
+                        line: f.lineOf(n.start),
+                        extension: m.name,
+                        tool: name,
+                        allowed: !!findMarker(f, n)?.reason,
+                    });
                     if (name === undefined)
                         return dynamic(n, "perm-tools", "the tool name");
                     if (!m.tools.has(name)) {
@@ -338,7 +346,7 @@ function scanSetup(f, m, decls) {
     }
     return out;
 }
-function scanFile(f) {
+function scanFile(f, onTool) {
     const decls = buildDecls(f);
     const out = [];
     walk(f.program, (n) => {
@@ -351,7 +359,7 @@ function scanFile(f) {
         const obj = arg ? resolve(arg, decls) : undefined;
         if (obj?.type !== "ObjectExpression")
             return;
-        out.push(...scanSetup(f, readManifest(obj, decls), decls));
+        out.push(...scanSetup(f, readManifest(obj, decls), decls, onTool));
     });
     return out;
 }
@@ -390,3 +398,22 @@ export function checkPluginPermissions(pluginDirs) {
     }
     return findings;
 }
+/**
+ * Every `ctx.tools.register({ name })` of the non-test sources under `pluginDirs`, found by the
+ * same scanner as {@link checkPluginPermissions} (so it follows ctx aliases and same-file helpers).
+ * Unparseable files are skipped here; the permissions check reports them.
+ */
+export function findToolRegistrations(pluginDirs) {
+    const out = [];
+    for (const dir of pluginDirs) {
+        for (const { file, isTest } of listSourceFiles(dir)) {
+            if (isTest)
+                continue;
+            const parsed = parseFile(file);
+            if (isParseError(parsed))
+                continue;
+            scanFile(parsed, (r) => out.push(r));
+        }
+    }
+    return out.sort((a, b) => a.file.localeCompare(b.file) || a.line - b.line);
+}

package/dist/check/plugin-tool-keys.d.ts

@@ -0,0 +1,13 @@
+import type { Finding } from "./source.js";
+export type { Finding };
+/** The model-visible key of an extension tool is `plugin__<extension>__<tool>`; 64 characters at most. */
+export declare const TOOL_KEY_PREFIX = "plugin__";
+export declare const TOOL_KEY_MAX = 64;
+/**
+ * plugin-tool-key-length: the key `plugin__<extension>__<tool>` of every `ctx.tools.register`
+ * must fit in {@link TOOL_KEY_MAX} characters (model APIs cap tool names at 64). The names must be
+ * string literals or same-file consts, as for `perm-tools`; a name that is not is reported as
+ * "cannot be confirmed statically" unless the call carries `// capybara:allow-dynamic-permission
+ * <reason>`. Scans the non-test sources under `pluginDirs`.
+ */
+export declare function checkPluginToolKeys(pluginDirs: string[]): Finding[];

package/dist/check/plugin-tool-keys.js

@@ -0,0 +1,38 @@
+import { findToolRegistrations } from "./plugin-permissions.js";
+/** The model-visible key of an extension tool is `plugin__<extension>__<tool>`; 64 characters at most. */
+export const TOOL_KEY_PREFIX = "plugin__";
+export const TOOL_KEY_MAX = 64;
+/**
+ * plugin-tool-key-length: the key `plugin__<extension>__<tool>` of every `ctx.tools.register`
+ * must fit in {@link TOOL_KEY_MAX} characters (model APIs cap tool names at 64). The names must be
+ * string literals or same-file consts, as for `perm-tools`; a name that is not is reported as
+ * "cannot be confirmed statically" unless the call carries `// capybara:allow-dynamic-permission
+ * <reason>`. Scans the non-test sources under `pluginDirs`.
+ */
+export function checkPluginToolKeys(pluginDirs) {
+    const rule = "plugin-tool-key-length";
+    const out = [];
+    for (const r of findToolRegistrations(pluginDirs)) {
+        if (r.extension === undefined || r.tool === undefined) {
+            if (r.allowed)
+                continue;
+            out.push({
+                file: r.file,
+                line: r.line,
+                rule,
+                message: `Cannot statically confirm the length of the tool key (${r.extension === undefined ? "extension name" : "tool name"} is not a literal). Use a string literal (or a same-file const), or add // capybara:allow-dynamic-permission <reason>`,
+            });
+            continue;
+        }
+        const key = `${TOOL_KEY_PREFIX}${r.extension}__${r.tool}`;
+        if (key.length > TOOL_KEY_MAX) {
+            out.push({
+                file: r.file,
+                line: r.line,
+                rule,
+                message: `Tool key "${key}" is ${key.length} characters; the limit is ${TOOL_KEY_MAX} (plugin__<extension>__<tool>). Shorten the tool name to at most ${Math.max(0, TOOL_KEY_MAX - TOOL_KEY_PREFIX.length - r.extension.length - 2)} characters or the extension name`,
+            });
+        }
+    }
+    return out;
+}

package/dist/check/run.js

@@ -4,6 +4,7 @@ import { checkMigrations } from "./migrations.js";
 import { checkPluginPack } from "./plugin-pack.js";
 import { checkPluginPermissions } from "./plugin-permissions.js";
 import { checkPluginState } from "./plugin-state.js";
+import { checkPluginToolKeys } from "./plugin-tool-keys.js";
 import { checkPluginReleaseMetadata } from "./release-metadata.js";
 import { printCheck } from "./report.js";
 import { checkPluginTestImports } from "./test-imports.js";
@@ -30,6 +31,7 @@ export function pluginChecks(scope) {
             name: "Tool design",
             run: () => checkToolDesign([...(scope.toolDesignDirs ?? []), ...plugins]),
         },
+        { name: "Tool key length", run: () => checkPluginToolKeys(plugins) },
         { name: "Plugin test imports", run: () => checkPluginTestImports(plugins) },
         {
             name: "Plugin release metadata",

package/dist/check/tool-design.d.ts

@@ -5,7 +5,7 @@ export type { Finding };
  * - tool-description：`ctx.tools.register(spec, …)` 与 `BuiltinTool` 字面量（有 spec 与 run）里的 spec
  *   必须有字符串字面量 description（可 `+` 拼接）、不少于 20 字符、不含中文（模型可见文案一律英文）；
  * - tool-error-actionable：`new ToolError(msg)` 的 msg 是字符串字面量 / 模板（或本文件内的常量、函数返回值），
- *   且含建议动词 use / call / retry / check / ask / pass / provide 之一，让模型知道下一步做什么。
+ *   且含建议动词 use / call / retry / check / ask / pass / provide / read 之一，让模型知道下一步做什么。
  * spec 可以直接写对象字面量，也可以引用本文件内的 const；其他写法（跨文件、动态构造）报 tool-description。
  * 已知缺口：从别的文件导入的消息常量 / 函数不追踪；非 ToolError 类的错误不查；运行时拼出的 spec 不查。
  * 扫描：传入目录下的非测试源码。

package/dist/check/tool-design.js

@@ -2,7 +2,7 @@ import { isParseError, listSourceFiles, parseFile, stringValue, walk, } from "./
 const MIN_DESCRIPTION = 20;
 const CJK = /[㐀-鿿豈-﫿　-〿＀-￯]/;
 /** 可执行的建议动词：错误信息里至少出现其一（整词、不分大小写）。 */
-const ACTION_VERB = /\b(?:use|call|retry|check|ask|pass|provide)\b/i;
+const ACTION_VERB = /\b(?:use|call|retry|check|ask|pass|provide|read)\b/i;
 const WRAPPERS = new Set([
     "ParenthesizedExpression",
     "TSAsExpression",
@@ -129,7 +129,7 @@ const MSG_DESC_MISSING = "工具缺少 description，或它不是字符串字面
 const MSG_DESC_SHORT = `工具 description 至少 ${MIN_DESCRIPTION} 个字符：说清工具做什么、何时该用、何时不该用`;
 const MSG_DESC_CJK = "工具 description 是模型可见文案，必须是英文，不得含中文字符";
 const MSG_ERR_DYNAMIC = "ToolError 的消息必须是字符串字面量或模板（或指向本文件内的此类常量 / 函数），否则无法检查是否可执行";
-const MSG_ERR_ACTION = "ToolError 的消息要让模型知道下一步怎么做：必须含建议动词之一（use / call / retry / check / ask / pass / provide）";
+const MSG_ERR_ACTION = "ToolError 的消息要让模型知道下一步怎么做：必须含建议动词之一（use / call / retry / check / ask / pass / provide / read）";
 /** 取一个 spec 表达式对应的对象字面量（直接写，或经本文件内的常量引用）。 */
 function specObject(n, env) {
     let e = unwrap(n);
@@ -204,7 +204,7 @@ function scanFile(f) {
  * - tool-description：`ctx.tools.register(spec, …)` 与 `BuiltinTool` 字面量（有 spec 与 run）里的 spec
  *   必须有字符串字面量 description（可 `+` 拼接）、不少于 20 字符、不含中文（模型可见文案一律英文）；
  * - tool-error-actionable：`new ToolError(msg)` 的 msg 是字符串字面量 / 模板（或本文件内的常量、函数返回值），
- *   且含建议动词 use / call / retry / check / ask / pass / provide 之一，让模型知道下一步做什么。
+ *   且含建议动词 use / call / retry / check / ask / pass / provide / read 之一，让模型知道下一步做什么。
  * spec 可以直接写对象字面量，也可以引用本文件内的 const；其他写法（跨文件、动态构造）报 tool-description。
  * 已知缺口：从别的文件导入的消息常量 / 函数不追踪；非 ToolError 类的错误不查；运行时拼出的 spec 不查。
  * 扫描：传入目录下的非测试源码。

package/dist/cli.js

@@ -2,8 +2,6 @@
  * `capybara-plugin`: pack, check, sync the versions of and release Capybara plugins.
  *
  *   capybara-plugin pack [<dir>...] [--all <root>] [--out <dir>]
- *   capybara-plugin pack --bootstrap <manifest> [--root <dir>] [--out <dir>] [--registry <url>]
- *                        [--npm-token <token>]
  *   capybara-plugin check [--root <dir>] [--plugins <glob>] [--base <ref>]
  *   capybara-plugin sync-versions [--root <dir>] [--plugins <glob>]
  *   capybara-plugin marketplace --write|--check [--base <rev>] [--root <dir>] [--file <path>]

package/dist/pack/cli.d.ts

@@ -1,19 +1,12 @@
-export declare const PACK_USAGE: string;
+export declare const PACK_USAGE = "capybara-plugin pack [<dir>...] [--all <root>] [--out <dir>]";
 /**
  * `capybara-plugin pack`: packs plugin directories into plugin tgz files.
  *
  * - `<dir>...`: the plugin directories to pack;
  * - `--all <root>`: also every plugin of the repository at `<root>` (`<root>/plugins/*`, or `<root>`
  *   itself when it is a plugin);
- * - `--bootstrap <manifest>`: the bootstrap directory an image bakes: every entry of the bootstrap
- *   manifest as `<name>-<version>.tgz`, checked against its pins (workspace entries' `path` is
- *   relative to `--root`, default the current directory; npm entries are downloaded from
- *   `--registry`, default `CAPYBARA_PACKAGES__NPM_REGISTRY` (the kernel's `packages.npmRegistry`)
- *   or else the public npm registry, and must match their pinned sha512; `--npm-token`, default
- *   `CAPYBARA_PACKAGES__NPM_TOKEN` (the kernel's `packages.npmToken`), is sent as a Bearer token to
- *   the registry origin only);
- * - `--out <dir>`: output directory, default `artifacts/plugins` (`artifacts/bootstrap` with
- *   `--bootstrap`) under the current directory. The last `--out` wins.
+ * - `--out <dir>`: output directory, default `artifacts/plugins` under the current directory. The
+ *   last `--out` wins.
  *
  * Relative paths resolve against `cwd` (the current directory). Returns the exit code.
  */

package/dist/pack/cli.js

@@ -1,27 +1,16 @@
 import { relative, resolve } from "node:path";
 import { parseArgs } from "node:util";
 import { discoverPlugins } from "../discover.js";
-import { packBootstrap } from "./bootstrap.js";
-import { DEFAULT_NPM_REGISTRY } from "./npm.js";
 import { packPlugin } from "./pack.js";
-export const PACK_USAGE = "capybara-plugin pack [<dir>...] [--all <root>] [--out <dir>]\n" +
-    "       capybara-plugin pack --bootstrap <manifest> [--root <dir>] [--out <dir>] [--registry <url>]\n" +
-    "                                [--npm-token <token>]";
+export const PACK_USAGE = "capybara-plugin pack [<dir>...] [--all <root>] [--out <dir>]";
 /**
  * `capybara-plugin pack`: packs plugin directories into plugin tgz files.
  *
  * - `<dir>...`: the plugin directories to pack;
  * - `--all <root>`: also every plugin of the repository at `<root>` (`<root>/plugins/*`, or `<root>`
  *   itself when it is a plugin);
- * - `--bootstrap <manifest>`: the bootstrap directory an image bakes: every entry of the bootstrap
- *   manifest as `<name>-<version>.tgz`, checked against its pins (workspace entries' `path` is
- *   relative to `--root`, default the current directory; npm entries are downloaded from
- *   `--registry`, default `CAPYBARA_PACKAGES__NPM_REGISTRY` (the kernel's `packages.npmRegistry`)
- *   or else the public npm registry, and must match their pinned sha512; `--npm-token`, default
- *   `CAPYBARA_PACKAGES__NPM_TOKEN` (the kernel's `packages.npmToken`), is sent as a Bearer token to
- *   the registry origin only);
- * - `--out <dir>`: output directory, default `artifacts/plugins` (`artifacts/bootstrap` with
- *   `--bootstrap`) under the current directory. The last `--out` wins.
+ * - `--out <dir>`: output directory, default `artifacts/plugins` under the current directory. The
+ *   last `--out` wins.
  *
  * Relative paths resolve against `cwd` (the current directory). Returns the exit code.
  */
@@ -33,10 +22,6 @@ export async function packCommand(args, cwd) {
             help: { type: "boolean", short: "h", default: false },
             all: { type: "string" },
             out: { type: "string" },
-            bootstrap: { type: "string" },
-            root: { type: "string" },
-            registry: { type: "string" },
-            "npm-token": { type: "string" },
         },
     });
     if (values.help) {
@@ -48,28 +33,6 @@ export async function packCommand(args, cwd) {
         const rel = relative(cwd, p);
         return rel === "" ? "." : rel.startsWith("..") ? p : rel;
     };
-    if (values.bootstrap !== undefined) {
-        if (values.all !== undefined || positionals.length > 0) {
-            return usage("--bootstrap takes no plugin directory");
-        }
-        try {
-            const root = values.root === undefined ? cwd : resolve(cwd, values.root);
-            const manifest = resolve(cwd, values.bootstrap);
-            const registry = values.registry ?? (process.env.CAPYBARA_PACKAGES__NPM_REGISTRY || DEFAULT_NPM_REGISTRY);
-            const token = values["npm-token"] ?? process.env.CAPYBARA_PACKAGES__NPM_TOKEN;
-            for (const p of await packBootstrap(manifest, root, outOf("artifacts/bootstrap"), {
-                registry,
-                ...(token !== undefined && token !== "" && { token }),
-            })) {
-                console.log(`${shown(p.file)}  ${p.integrity}`);
-            }
-            return 0;
-        }
-        catch (e) {
-            console.error(e instanceof Error ? e.message : String(e));
-            return 1;
-        }
-    }
     const plugins = positionals.map((d) => resolve(cwd, d));
     if (values.all !== undefined) {
         const root = resolve(cwd, values.all);

package/dist/pack/index.d.ts

@@ -1,4 +1,3 @@
-export { type BootstrapPack, packBootstrap } from "./bootstrap.js";
 export { PACK_USAGE, packCommand } from "./cli.js";
 export { assertNpmTarballLabel, DEFAULT_NPM_REGISTRY, downloadPinnedNpmPackage, fetchNpmTarball, NPM_TARBALL_MAX_BYTES, type NpmFetchOptions, NpmPackageError, type NpmPackageErrorKind, } from "./npm.js";
 export { METADATA_FIELDS, NOTICES_FILE, type PackResult, packPlugin, STAGING_PREFIX, } from "./pack.js";

package/dist/pack/index.js

@@ -1,4 +1,3 @@
-export { packBootstrap } from "./bootstrap.js";
 export { PACK_USAGE, packCommand } from "./cli.js";
 export { assertNpmTarballLabel, DEFAULT_NPM_REGISTRY, downloadPinnedNpmPackage, fetchNpmTarball, NPM_TARBALL_MAX_BYTES, NpmPackageError, } from "./npm.js";
 export { METADATA_FIELDS, NOTICES_FILE, packPlugin, STAGING_PREFIX, } from "./pack.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@capybara-hq/plugin-tools",
-  "version": "0.1.0-rc.1",
+  "version": "0.1.0-rc.3",
   "description": "Capybara plugin toolchain: the capybara-plugin CLI to pack, check and release Capybara plugins",
   "license": "Apache-2.0",
   "repository": {
@@ -51,12 +51,12 @@
     "esbuild": "0.28.2",
     "oxc-parser": "^0.154.0",
     "tar-stream": "3.2.2",
-    "@capybara-hq/plugin-sdk": "^0.1.0-rc.0",
-    "@capybara-hq/kernel": "^0.1.0-rc.0"
+    "@capybara-hq/kernel": "^0.1.0-rc.3",
+    "@capybara-hq/plugin-sdk": "^0.1.0-rc.1"
   },
   "devDependencies": {
     "zod": "^4.6.7",
-    "@capybara-hq/testing": "0.1.0-rc.1"
+    "@capybara-hq/testing": "0.1.0-rc.3"
   },
   "scripts": {
     "build": "tsc -b"

package/dist/pack/bootstrap.d.ts

@@ -1,25 +0,0 @@
-import { type NpmFetchOptions } from "./npm.js";
-/** One package {@link packBootstrap} wrote. */
-export interface BootstrapPack {
-    name: string;
-    version: string;
-    file: string;
-    integrity: string;
-}
-/**
- * Produces the bootstrap directory the image bakes (package ecosystem spec §7): every entry of the
- * bootstrap manifest (`packages/kernel/bootstrap.json`) as `<outDir>/<name>-<version>.tgz`. A
- * `source: "workspace"` entry is packed from `<repoRoot>/<path>` with {@link packPlugin}
- * (byte-reproducible) and must equal the entry: the plugin name, the version and the pinned sha512,
- * otherwise this throws naming the plugin and writes nothing for it (the image build fails rather
- * than baking a package `capybara bootstrap` would refuse). A `source: "npm"` entry is downloaded
- * from `opts.registry` (default the public npm registry, the kernel's `packages.npmRegistry`
- * default; `opts.token` goes to the registry origin only) and written only when its bytes match
- * the pinned sha512 and its package.json names the entry's package and version; a tampered,
- * mislabelled or oversized (`bootstrap.too_large`) tarball or an unpublished package or version
- * throws naming the plugin. So npm entries need the network at
- * build time only: init installs from the baked directory and never downloads.
- */
-export declare function packBootstrap(manifestFile: string, repoRoot: string, outDir: string, opts?: {
-    registry?: string;
-} & NpmFetchOptions): Promise<BootstrapPack[]>;

package/dist/pack/bootstrap.js

@@ -1,70 +0,0 @@
-import { copyFile, mkdir, mkdtemp, readFile, rm, writeFile } from "node:fs/promises";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { bootstrapFileName, parseBootstrapManifest } from "@capybara-hq/plugin-sdk";
-import { integrityOf } from "../integrity.js";
-import { DEFAULT_NPM_REGISTRY, downloadPinnedNpmPackage } from "./npm.js";
-import { packPlugin } from "./pack.js";
-/**
- * Produces the bootstrap directory the image bakes (package ecosystem spec §7): every entry of the
- * bootstrap manifest (`packages/kernel/bootstrap.json`) as `<outDir>/<name>-<version>.tgz`. A
- * `source: "workspace"` entry is packed from `<repoRoot>/<path>` with {@link packPlugin}
- * (byte-reproducible) and must equal the entry: the plugin name, the version and the pinned sha512,
- * otherwise this throws naming the plugin and writes nothing for it (the image build fails rather
- * than baking a package `capybara bootstrap` would refuse). A `source: "npm"` entry is downloaded
- * from `opts.registry` (default the public npm registry, the kernel's `packages.npmRegistry`
- * default; `opts.token` goes to the registry origin only) and written only when its bytes match
- * the pinned sha512 and its package.json names the entry's package and version; a tampered,
- * mislabelled or oversized (`bootstrap.too_large`) tarball or an unpublished package or version
- * throws naming the plugin. So npm entries need the network at
- * build time only: init installs from the baked directory and never downloads.
- */
-export async function packBootstrap(manifestFile, repoRoot, outDir, opts = {}) {
-    const parsed = parseBootstrapManifest(JSON.parse(await readFile(manifestFile, "utf8")));
-    if ("errors" in parsed) {
-        throw new Error(`invalid bootstrap manifest ${manifestFile}: ${parsed.errors.join("; ")}`);
-    }
-    await mkdir(outDir, { recursive: true });
-    const staging = await mkdtemp(join(tmpdir(), "pack-bootstrap-"));
-    const out = [];
-    try {
-        for (const e of parsed.plugins) {
-            if (e.source === "npm") {
-                let bytes;
-                try {
-                    bytes = await downloadPinnedNpmPackage(e, opts.registry ?? DEFAULT_NPM_REGISTRY, {
-                        ...(opts.token !== undefined && { token: opts.token }),
-                        ...(opts.maxBytes !== undefined && { maxBytes: opts.maxBytes }),
-                    });
-                }
-                catch (err) {
-                    throw new Error(`${e.name}: ${err instanceof Error ? err.message : String(err)}`, {
-                        cause: err,
-                    });
-                }
-                const file = join(outDir, bootstrapFileName(e));
-                await writeFile(file, bytes);
-                out.push({ name: e.name, version: e.version, file, integrity: e.integrity });
-                continue;
-            }
-            const r = await packPlugin(join(repoRoot, e.path), staging);
-            const integrity = integrityOf(new Uint8Array(await readFile(r.file)));
-            const problems = [
-                r.manifest.name !== e.name && `${e.path} packs the plugin "${r.manifest.name}"`,
-                r.manifest.version !== e.version &&
-                    `version is ${e.version} but ${e.path} packs ${r.manifest.version}`,
-                integrity !== e.integrity && `integrity is ${e.integrity} but ${e.path} packs ${integrity}`,
-            ].filter((p) => typeof p === "string");
-            if (problems.length > 0) {
-                throw new Error(`${e.name}: ${problems.join("; ")}; the bootstrap manifest is stale (pnpm check:bootstrap --write)`);
-            }
-            const file = join(outDir, bootstrapFileName(e));
-            await copyFile(r.file, file);
-            out.push({ name: e.name, version: e.version, file, integrity });
-        }
-    }
-    finally {
-        await rm(staging, { recursive: true, force: true });
-    }
-    return out;
-}