@dexto/core 1.3.0 → 1.5.0

package/dist/filesystem/index.js

@@ -1,4 +1,4 @@
-import "../chunk-C6A6W6XS.js";
+import "../chunk-PTJYTZNU.js";
 import { FileSystemService } from "./filesystem-service.js";
 import { PathValidator } from "./path-validator.js";
 import { FileSystemError } from "./errors.js";

package/dist/filesystem/path-validator.cjs

@@ -39,6 +39,7 @@ class PathValidator {
   normalizedBlockedPaths;
   normalizedBlockedExtensions;
   logger;
+  directoryApprovalChecker;
   constructor(config, logger) {
     this.config = config;
     this.logger = logger;
@@ -53,6 +54,16 @@ class PathValidator {
       `PathValidator initialized with ${this.normalizedAllowedPaths.length} allowed paths`
     );
   }
+  /**
+   * Set a callback to check if a path is in an approved directory.
+   * This allows PathValidator to consult ApprovalManager without a direct dependency.
+   *
+   * @param checker Function that returns true if path is in an approved directory
+   */
+  setDirectoryApprovalChecker(checker) {
+    this.directoryApprovalChecker = checker;
+    this.logger.debug("Directory approval checker configured");
+  }
   /**
    * Validate a file path for security and policy compliance
    */
@@ -123,15 +134,23 @@ class PathValidator {
   }
   /**
    * Check if path is within allowed paths (whitelist check)
+   * Also consults the directory approval checker if configured.
    */
   isPathAllowed(normalizedPath) {
     if (this.normalizedAllowedPaths.length === 0) {
       return true;
     }
-    return this.normalizedAllowedPaths.some((allowedPath) => {
+    const isInConfigPaths = this.normalizedAllowedPaths.some((allowedPath) => {
       const relative = path.relative(allowedPath, normalizedPath);
       return !relative.startsWith("..") && !path.isAbsolute(relative);
     });
+    if (isInConfigPaths) {
+      return true;
+    }
+    if (this.directoryApprovalChecker) {
+      return this.directoryApprovalChecker(normalizedPath);
+    }
+    return false;
   }
   /**
    * Check if path matches blocked patterns (blacklist check)
@@ -154,6 +173,55 @@ class PathValidator {
   isPathAllowedQuick(normalizedPath) {
     return this.isPathAllowed(normalizedPath) && !this.isPathBlocked(normalizedPath);
   }
+  /**
+   * Check if a file path is within the configured allowed paths (from config only).
+   * This method does NOT consult ApprovalManager - it only checks the static config paths.
+   *
+   * This is used by ToolManager.checkDirectoryAccess() to determine if a path
+   * needs directory approval. Paths within config-allowed directories don't need
+   * directory approval prompts.
+   *
+   * @param filePath The file path to check (can be relative or absolute)
+   * @returns true if the path is within config-allowed paths, false otherwise
+   *
+   * @example
+   * ```typescript
+   * // Check if path needs directory approval
+   * if (!pathValidator.isPathWithinAllowed('/external/project/file.ts')) {
+   *   // Request directory access approval
+   * }
+   * ```
+   */
+  isPathWithinAllowed(filePath) {
+    if (!filePath || filePath.trim() === "") {
+      return false;
+    }
+    const workingDir = this.config.workingDirectory || process.cwd();
+    let normalizedPath;
+    try {
+      normalizedPath = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(workingDir, filePath);
+      try {
+        normalizedPath = import_node_fs.realpathSync.native(normalizedPath);
+      } catch {
+      }
+    } catch {
+      return false;
+    }
+    return this.isInConfigAllowedPaths(normalizedPath);
+  }
+  /**
+   * Check if path is within config-allowed paths only (no approval checker).
+   * Used for prompting decisions.
+   */
+  isInConfigAllowedPaths(normalizedPath) {
+    if (this.normalizedAllowedPaths.length === 0) {
+      return true;
+    }
+    return this.normalizedAllowedPaths.some((allowedPath) => {
+      const relative = path.relative(allowedPath, normalizedPath);
+      return !relative.startsWith("..") && !path.isAbsolute(relative);
+    });
+  }
   /**
    * Get normalized allowed paths
    */

package/dist/filesystem/path-validator.d.ts

@@ -5,16 +5,23 @@
  */
 import { FileSystemConfig, PathValidation } from './types.js';
 import type { IDextoLogger } from '../logger/v2/types.js';
+/**
+ * Callback type for checking if a path is in an approved directory.
+ * Used to consult ApprovalManager without creating a direct dependency.
+ */
+export type DirectoryApprovalChecker = (filePath: string) => boolean;
 /**
  * PathValidator - Validates file paths for security and policy compliance
  *
  * Security checks:
  * 1. Path traversal detection (../, symbolic links)
- * 2. Allowed paths enforcement (whitelist)
+ * 2. Allowed paths enforcement (whitelist + approved directories)
  * 3. Blocked paths detection (blacklist)
  * 4. File extension restrictions
  * 5. Absolute path normalization
- * TODO: Add tests
+ *
+ * PathValidator can optionally consult an external approval checker (e.g., ApprovalManager)
+ * to determine if paths outside the config's allowed paths are accessible.
  */
 export declare class PathValidator {
     private config;
@@ -22,7 +29,15 @@ export declare class PathValidator {
     private normalizedBlockedPaths;
     private normalizedBlockedExtensions;
     private logger;
+    private directoryApprovalChecker;
     constructor(config: FileSystemConfig, logger: IDextoLogger);
+    /**
+     * Set a callback to check if a path is in an approved directory.
+     * This allows PathValidator to consult ApprovalManager without a direct dependency.
+     *
+     * @param checker Function that returns true if path is in an approved directory
+     */
+    setDirectoryApprovalChecker(checker: DirectoryApprovalChecker): void;
     /**
      * Validate a file path for security and policy compliance
      */
@@ -33,6 +48,7 @@ export declare class PathValidator {
     private hasPathTraversal;
     /**
      * Check if path is within allowed paths (whitelist check)
+     * Also consults the directory approval checker if configured.
      */
     private isPathAllowed;
     /**
@@ -43,6 +59,31 @@ export declare class PathValidator {
      * Quick check if a path is allowed (for internal use)
      */
     isPathAllowedQuick(normalizedPath: string): boolean;
+    /**
+     * Check if a file path is within the configured allowed paths (from config only).
+     * This method does NOT consult ApprovalManager - it only checks the static config paths.
+     *
+     * This is used by ToolManager.checkDirectoryAccess() to determine if a path
+     * needs directory approval. Paths within config-allowed directories don't need
+     * directory approval prompts.
+     *
+     * @param filePath The file path to check (can be relative or absolute)
+     * @returns true if the path is within config-allowed paths, false otherwise
+     *
+     * @example
+     * ```typescript
+     * // Check if path needs directory approval
+     * if (!pathValidator.isPathWithinAllowed('/external/project/file.ts')) {
+     *   // Request directory access approval
+     * }
+     * ```
+     */
+    isPathWithinAllowed(filePath: string): boolean;
+    /**
+     * Check if path is within config-allowed paths only (no approval checker).
+     * Used for prompting decisions.
+     */
+    private isInConfigAllowedPaths;
     /**
      * Get normalized allowed paths
      */

package/dist/filesystem/path-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../src/filesystem/path-validator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;;;;;;;;GAUG;AACH,qBAAa,aAAa;IACtB,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,sBAAsB,CAAW;IACzC,OAAO,CAAC,sBAAsB,CAAW;IACzC,OAAO,CAAC,2BAA2B,CAAW;IAC9C,OAAO,CAAC,MAAM,CAAe;gBAEjB,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY;IAsB1D;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc;IA0E9C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;OAEG;IACH,OAAO,CAAC,aAAa;IAcrB;;OAEG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAInD;;OAEG;IACH,eAAe,IAAI,MAAM,EAAE;IAI3B;;OAEG;IACH,eAAe,IAAI,MAAM,EAAE;CAG9B"}
+{"version":3,"file":"path-validator.d.ts","sourceRoot":"","sources":["../../src/filesystem/path-validator.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC9D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAE1D;;;GAGG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;AAErE;;;;;;;;;;;;GAYG;AACH,qBAAa,aAAa;IACtB,OAAO,CAAC,MAAM,CAAmB;IACjC,OAAO,CAAC,sBAAsB,CAAW;IACzC,OAAO,CAAC,sBAAsB,CAAW;IACzC,OAAO,CAAC,2BAA2B,CAAW;IAC9C,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,wBAAwB,CAAuC;gBAE3D,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,YAAY;IAsB1D;;;;;OAKG;IACH,2BAA2B,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI;IAKpE;;OAEG;IACH,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc;IA0E9C;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAaxB;;;OAGG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,OAAO,CAAC,aAAa;IAyBrB;;OAEG;IACH,kBAAkB,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO;IAInD;;;;;;;;;;;;;;;;;;OAkBG;IACH,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IA8B9C;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAY9B;;OAEG;IACH,eAAe,IAAI,MAAM,EAAE;IAI3B;;OAEG;IACH,eAAe,IAAI,MAAM,EAAE;CAG9B"}

package/dist/filesystem/path-validator.js

@@ -1,4 +1,4 @@
-import "../chunk-C6A6W6XS.js";
+import "../chunk-PTJYTZNU.js";
 import * as path from "node:path";
 import { realpathSync } from "node:fs";
 class PathValidator {
@@ -7,6 +7,7 @@ class PathValidator {
   normalizedBlockedPaths;
   normalizedBlockedExtensions;
   logger;
+  directoryApprovalChecker;
   constructor(config, logger) {
     this.config = config;
     this.logger = logger;
@@ -21,6 +22,16 @@ class PathValidator {
       `PathValidator initialized with ${this.normalizedAllowedPaths.length} allowed paths`
     );
   }
+  /**
+   * Set a callback to check if a path is in an approved directory.
+   * This allows PathValidator to consult ApprovalManager without a direct dependency.
+   *
+   * @param checker Function that returns true if path is in an approved directory
+   */
+  setDirectoryApprovalChecker(checker) {
+    this.directoryApprovalChecker = checker;
+    this.logger.debug("Directory approval checker configured");
+  }
   /**
    * Validate a file path for security and policy compliance
    */
@@ -91,15 +102,23 @@ class PathValidator {
   }
   /**
    * Check if path is within allowed paths (whitelist check)
+   * Also consults the directory approval checker if configured.
    */
   isPathAllowed(normalizedPath) {
     if (this.normalizedAllowedPaths.length === 0) {
       return true;
     }
-    return this.normalizedAllowedPaths.some((allowedPath) => {
+    const isInConfigPaths = this.normalizedAllowedPaths.some((allowedPath) => {
       const relative = path.relative(allowedPath, normalizedPath);
       return !relative.startsWith("..") && !path.isAbsolute(relative);
     });
+    if (isInConfigPaths) {
+      return true;
+    }
+    if (this.directoryApprovalChecker) {
+      return this.directoryApprovalChecker(normalizedPath);
+    }
+    return false;
   }
   /**
    * Check if path matches blocked patterns (blacklist check)
@@ -122,6 +141,55 @@ class PathValidator {
   isPathAllowedQuick(normalizedPath) {
     return this.isPathAllowed(normalizedPath) && !this.isPathBlocked(normalizedPath);
   }
+  /**
+   * Check if a file path is within the configured allowed paths (from config only).
+   * This method does NOT consult ApprovalManager - it only checks the static config paths.
+   *
+   * This is used by ToolManager.checkDirectoryAccess() to determine if a path
+   * needs directory approval. Paths within config-allowed directories don't need
+   * directory approval prompts.
+   *
+   * @param filePath The file path to check (can be relative or absolute)
+   * @returns true if the path is within config-allowed paths, false otherwise
+   *
+   * @example
+   * ```typescript
+   * // Check if path needs directory approval
+   * if (!pathValidator.isPathWithinAllowed('/external/project/file.ts')) {
+   *   // Request directory access approval
+   * }
+   * ```
+   */
+  isPathWithinAllowed(filePath) {
+    if (!filePath || filePath.trim() === "") {
+      return false;
+    }
+    const workingDir = this.config.workingDirectory || process.cwd();
+    let normalizedPath;
+    try {
+      normalizedPath = path.isAbsolute(filePath) ? path.resolve(filePath) : path.resolve(workingDir, filePath);
+      try {
+        normalizedPath = realpathSync.native(normalizedPath);
+      } catch {
+      }
+    } catch {
+      return false;
+    }
+    return this.isInConfigAllowedPaths(normalizedPath);
+  }
+  /**
+   * Check if path is within config-allowed paths only (no approval checker).
+   * Used for prompting decisions.
+   */
+  isInConfigAllowedPaths(normalizedPath) {
+    if (this.normalizedAllowedPaths.length === 0) {
+      return true;
+    }
+    return this.normalizedAllowedPaths.some((allowedPath) => {
+      const relative = path.relative(allowedPath, normalizedPath);
+      return !relative.startsWith("..") && !path.isAbsolute(relative);
+    });
+  }
   /**
    * Get normalized allowed paths
    */

package/dist/image/define-image.cjs

@@ -0,0 +1,146 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var define_image_exports = {};
+__export(define_image_exports, {
+  defineImage: () => defineImage,
+  defineProviderCategory: () => defineProviderCategory,
+  validateImageDefinition: () => validateImageDefinition
+});
+module.exports = __toCommonJS(define_image_exports);
+function defineImage(definition) {
+  if (!definition.name) {
+    throw new Error("Image definition must have a name");
+  }
+  if (!definition.version) {
+    throw new Error("Image definition must have a version");
+  }
+  if (!definition.description) {
+    throw new Error("Image definition must have a description");
+  }
+  for (const [category, config] of Object.entries(definition.providers)) {
+    if (!config) continue;
+    if (!config.providers && !config.register) {
+      throw new Error(
+        `Provider category '${category}' must have either 'providers' array or 'register' function`
+      );
+    }
+  }
+  return definition;
+}
+function defineProviderCategory(config) {
+  if (!config.providers && !config.register) {
+    throw new Error("Provider category must have either providers or register function");
+  }
+  return config;
+}
+function validateImageDefinition(definition) {
+  if (!definition.name || typeof definition.name !== "string") {
+    throw new Error("Image name must be a non-empty string");
+  }
+  if (!definition.version || typeof definition.version !== "string") {
+    throw new Error("Image version must be a non-empty string");
+  }
+  if (!definition.description || typeof definition.description !== "string") {
+    throw new Error("Image description must be a non-empty string");
+  }
+  const versionRegex = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?$/;
+  if (!versionRegex.test(definition.version)) {
+    throw new Error(
+      `Image version '${definition.version}' is not valid semver. Expected format: x.y.z`
+    );
+  }
+  const validTargets = [
+    "local-development",
+    "cloud-production",
+    "edge-serverless",
+    "embedded-iot",
+    "enterprise",
+    "custom"
+  ];
+  if (definition.target && !validTargets.includes(definition.target)) {
+    throw new Error(
+      `Invalid target '${definition.target}'. Valid targets: ${validTargets.join(", ")}`
+    );
+  }
+  const hasProviders = definition.providers && Object.values(definition.providers).some((config) => config !== void 0);
+  if (!hasProviders && !definition.extends) {
+    throw new Error(
+      "Image must either define at least one provider category or extend a base image"
+    );
+  }
+  for (const [category, config] of Object.entries(definition.providers)) {
+    if (!config) continue;
+    if (!config.providers && !config.register) {
+      throw new Error(
+        `Provider category '${category}' must have either 'providers' array or 'register' function`
+      );
+    }
+    if (config.providers && !Array.isArray(config.providers)) {
+      throw new Error(`Provider category '${category}' providers must be an array`);
+    }
+    if (config.register && typeof config.register !== "function") {
+      throw new Error(`Provider category '${category}' register must be a function`);
+    }
+  }
+  const validConstraints = [
+    "filesystem-required",
+    "network-required",
+    "offline-capable",
+    "serverless-compatible",
+    "cold-start-optimized",
+    "low-memory",
+    "edge-compatible",
+    "browser-compatible"
+  ];
+  if (definition.constraints) {
+    if (!Array.isArray(definition.constraints)) {
+      throw new Error("Image constraints must be an array");
+    }
+    for (const constraint of definition.constraints) {
+      if (!validConstraints.includes(constraint)) {
+        throw new Error(
+          `Invalid constraint '${constraint}'. Valid constraints: ${validConstraints.join(", ")}`
+        );
+      }
+    }
+  }
+  if (definition.utils) {
+    for (const [name, path] of Object.entries(definition.utils)) {
+      if (typeof path !== "string") {
+        throw new Error(`Utility '${name}' path must be a string`);
+      }
+      if (!path.startsWith("./")) {
+        throw new Error(
+          `Utility '${name}' path must be relative (start with './'). Got: ${path}`
+        );
+      }
+    }
+  }
+  if (definition.extends) {
+    if (typeof definition.extends !== "string") {
+      throw new Error("Image extends must be a string (parent image name)");
+    }
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  defineImage,
+  defineProviderCategory,
+  validateImageDefinition
+});

package/dist/image/define-image.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Image definition helper
+ *
+ * Provides type-safe API for defining base images.
+ */
+import type { ImageDefinition } from './types.js';
+/**
+ * Define a Dexto base image.
+ *
+ * This function provides type checking and validation for image definitions.
+ * Use this in your dexto.image.ts file.
+ *
+ * @example
+ * ```typescript
+ * // dexto.image.ts
+ * import { defineImage } from '@dexto/core';
+ * import { localBlobProvider } from './providers/blob.js';
+ *
+ * export default defineImage({
+ *   name: 'local',
+ *   version: '1.0.0',
+ *   description: 'Local development base image',
+ *   target: 'local-development',
+ *
+ *   providers: {
+ *     blobStore: {
+ *       providers: [localBlobProvider],
+ *     },
+ *   },
+ *
+ *   defaults: {
+ *     storage: {
+ *       blob: { type: 'local', storePath: './data/blobs' },
+ *     },
+ *   },
+ *
+ *   constraints: ['filesystem-required', 'offline-capable'],
+ * });
+ * ```
+ *
+ * @param definition - Image definition object
+ * @returns The same definition (for type inference)
+ */
+export declare function defineImage(definition: ImageDefinition): ImageDefinition;
+/**
+ * Helper to create a provider category configuration.
+ *
+ * @example
+ * ```typescript
+ * import { defineProviderCategory } from '@dexto/core';
+ *
+ * const blobStore = defineProviderCategory({
+ *   providers: [localBlobProvider, s3BlobProvider],
+ * });
+ * ```
+ */
+export declare function defineProviderCategory(config: {
+    providers?: any[];
+    register?: () => void | Promise<void>;
+}): {
+    providers?: any[];
+    register?: () => void | Promise<void>;
+};
+/**
+ * Validate an image definition.
+ * Throws if the definition is invalid.
+ *
+ * Used by bundler to validate images before building.
+ */
+export declare function validateImageDefinition(definition: ImageDefinition): void;
+//# sourceMappingURL=define-image.d.ts.map

package/dist/image/define-image.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"define-image.d.ts","sourceRoot":"","sources":["../../src/image/define-image.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,eAAe,GAAG,eAAe,CAuBxE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC3C,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzC;gBAFe,GAAG,EAAE;eACN,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;EAMxC;AAED;;;;;GAKG;AACH,wBAAgB,uBAAuB,CAAC,UAAU,EAAE,eAAe,GAAG,IAAI,CAiHzE"}

package/dist/image/define-image.js

@@ -0,0 +1,121 @@
+import "../chunk-PTJYTZNU.js";
+function defineImage(definition) {
+  if (!definition.name) {
+    throw new Error("Image definition must have a name");
+  }
+  if (!definition.version) {
+    throw new Error("Image definition must have a version");
+  }
+  if (!definition.description) {
+    throw new Error("Image definition must have a description");
+  }
+  for (const [category, config] of Object.entries(definition.providers)) {
+    if (!config) continue;
+    if (!config.providers && !config.register) {
+      throw new Error(
+        `Provider category '${category}' must have either 'providers' array or 'register' function`
+      );
+    }
+  }
+  return definition;
+}
+function defineProviderCategory(config) {
+  if (!config.providers && !config.register) {
+    throw new Error("Provider category must have either providers or register function");
+  }
+  return config;
+}
+function validateImageDefinition(definition) {
+  if (!definition.name || typeof definition.name !== "string") {
+    throw new Error("Image name must be a non-empty string");
+  }
+  if (!definition.version || typeof definition.version !== "string") {
+    throw new Error("Image version must be a non-empty string");
+  }
+  if (!definition.description || typeof definition.description !== "string") {
+    throw new Error("Image description must be a non-empty string");
+  }
+  const versionRegex = /^\d+\.\d+\.\d+(-[a-zA-Z0-9.-]+)?$/;
+  if (!versionRegex.test(definition.version)) {
+    throw new Error(
+      `Image version '${definition.version}' is not valid semver. Expected format: x.y.z`
+    );
+  }
+  const validTargets = [
+    "local-development",
+    "cloud-production",
+    "edge-serverless",
+    "embedded-iot",
+    "enterprise",
+    "custom"
+  ];
+  if (definition.target && !validTargets.includes(definition.target)) {
+    throw new Error(
+      `Invalid target '${definition.target}'. Valid targets: ${validTargets.join(", ")}`
+    );
+  }
+  const hasProviders = definition.providers && Object.values(definition.providers).some((config) => config !== void 0);
+  if (!hasProviders && !definition.extends) {
+    throw new Error(
+      "Image must either define at least one provider category or extend a base image"
+    );
+  }
+  for (const [category, config] of Object.entries(definition.providers)) {
+    if (!config) continue;
+    if (!config.providers && !config.register) {
+      throw new Error(
+        `Provider category '${category}' must have either 'providers' array or 'register' function`
+      );
+    }
+    if (config.providers && !Array.isArray(config.providers)) {
+      throw new Error(`Provider category '${category}' providers must be an array`);
+    }
+    if (config.register && typeof config.register !== "function") {
+      throw new Error(`Provider category '${category}' register must be a function`);
+    }
+  }
+  const validConstraints = [
+    "filesystem-required",
+    "network-required",
+    "offline-capable",
+    "serverless-compatible",
+    "cold-start-optimized",
+    "low-memory",
+    "edge-compatible",
+    "browser-compatible"
+  ];
+  if (definition.constraints) {
+    if (!Array.isArray(definition.constraints)) {
+      throw new Error("Image constraints must be an array");
+    }
+    for (const constraint of definition.constraints) {
+      if (!validConstraints.includes(constraint)) {
+        throw new Error(
+          `Invalid constraint '${constraint}'. Valid constraints: ${validConstraints.join(", ")}`
+        );
+      }
+    }
+  }
+  if (definition.utils) {
+    for (const [name, path] of Object.entries(definition.utils)) {
+      if (typeof path !== "string") {
+        throw new Error(`Utility '${name}' path must be a string`);
+      }
+      if (!path.startsWith("./")) {
+        throw new Error(
+          `Utility '${name}' path must be relative (start with './'). Got: ${path}`
+        );
+      }
+    }
+  }
+  if (definition.extends) {
+    if (typeof definition.extends !== "string") {
+      throw new Error("Image extends must be a string (parent image name)");
+    }
+  }
+}
+export {
+  defineImage,
+  defineProviderCategory,
+  validateImageDefinition
+};

package/dist/{llm/tokenizer/default.cjs → image/index.cjs}

@@ -16,26 +16,17 @@ var __copyProps = (to, from, except, desc) => {
   return to;
 };
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-var default_exports = {};
-__export(default_exports, {
-  DefaultTokenizer: () => DefaultTokenizer
+var image_exports = {};
+__export(image_exports, {
+  defineImage: () => import_define_image.defineImage,
+  defineProviderCategory: () => import_define_image.defineProviderCategory,
+  validateImageDefinition: () => import_define_image.validateImageDefinition
 });
-module.exports = __toCommonJS(default_exports);
-class DefaultTokenizer {
-  /**
-   * Assumes roughly 4 characters per token.
-   * @param text Text content to count tokens for
-   * @returns Approximate number of tokens
-   */
-  countTokens(text) {
-    if (!text) return 0;
-    return Math.ceil(text.length / 4);
-  }
-  getProviderName() {
-    return "default";
-  }
-}
+module.exports = __toCommonJS(image_exports);
+var import_define_image = require("./define-image.js");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
-  DefaultTokenizer
+  defineImage,
+  defineProviderCategory,
+  validateImageDefinition
 });