@domesystems/templates 0.1.1 → 0.3.0

package/README.md

@@ -1,168 +1,26 @@
-# Dome templates
+# Dome Templates CLI
 
-Reusable, importable governed-agent templates. Each template combines an HCL
-configuration bundle for Dome with an optional companion application.
-
-## Use the template CLI
-
-The public package is also an executable. It copies the template, creates a
-local `.env` from `.env.example`, and generates the Compose file from the
-runtime declaration in `template.yaml` — individual templates do not need a
-Dockerfile or a committed Compose file.
-
-```bash
-# Create a working copy in ./ai-agent-for-documentation.
-npx @domesystems/templates init ai-agent-for-documentation
-
-# Initialize when needed, provision Dome, then start the selected runtime.
-npx @domesystems/templates up ai-agent-for-documentation
-```
-
-`up` runs `dome import dome.tf`, then `docker compose` with a generated,
-Git-ignored `.dome-compose.yaml`. Use `--no-start` to provision without
-starting a container, `--skip-provision` to start an already-provisioned
-template, `--detach` for a background container, and `--dir <directory>` to
-choose a local destination.
-
-Runtime selection is explicit rather than guessed:
-
-```yaml
-app:
-  runtime:
-    pattern: chat         # chat or run
-    language: python      # python or typescript
-    image_tag: "0.1.0"    # optional; defaults to latest
-```
-
-The CLI maps `language` and `pattern` to a shared, published runtime image.
-For an unusual runtime, set `app.runtime.image` to a complete image reference
-(including its tag) to override that mapping.
-Add a template directory to the package's `files` list when publishing a new
-template so the CLI can discover it.
-
-## Use a template
+Pull immutable Dome template releases, publish public templates from GitHub, and run an existing local directory.
 
 ```bash
-git clone https://github.com/dome-systems/templates.git
-cd templates/<template>
-
-brew install dome-systems/tap/dome
-dome auth login
-dome sandbox provision
-
-# Preview resources, variables, and required permissions. Changes nothing.
-dome import dome.tf --plan-only
-
-# Apply after reviewing the preview. Dome prompts for required variables.
-dome import dome.tf
+npx @domesystems/templates login --github
+npx @domesystems/templates pull dome-systems/ai-agent-for-documentation --dir ai-agent-for-documentation
+npx @domesystems/templates up --dir ai-agent-for-documentation
 ```
 
-Imports run as asynchronous jobs in Dome. Existing resources are converged by
-name, missing resources are created, and any destructive replacement is
-refused. Secrets are input variables: they are never committed to a template
-or returned in an export.
+Every remote command takes `--server <Dome application URL>`. The selected app server discovers its Registry endpoint; the CLI never derives one by rewriting hostnames. Credentials are isolated per server profile.
 
-Every built companion app needs the one-time agent token created by the import:
+## Commands
 
-```bash
-dome import outputs <job-id>
-cp .env.example .env
-docker compose up
-```
-
-Tool and model credentials remain in Dome; the app only holds its agent token.
-
-### Runtime image
-
-Templates do not build a runtime themselves. In development, clone the sibling
-`dome-systems/template-runtime` repository and build the archetype image before
-starting a template:
-
-```bash
-cd template-runtime
-docker build -f Dockerfile.chat -t ghcr.io/dome-systems/runtime-py-chat:dev .
-docker build -f Dockerfile.run -t ghcr.io/dome-systems/runtime-py-run:dev .
+```text
+templates login [--server <URL>] [--github]
+templates logout [--server <URL>]
+templates doctor <pull|up|publish> [--dir <directory>] [--server <URL>] [--json]
+templates pull <scope/package[@version]> [--dir <directory>] [--server <URL>]
+templates up [--dir <directory>] [--port <host-port>] [--skip-provision|--provision] [--no-start] [--detach]
+templates publish [--dry-run] [--server <URL>]
 ```
 
-TypeScript equivalents are available as `ghcr.io/dome-systems/runtime-ts-chat`
-and `ghcr.io/dome-systems/runtime-ts-run`; substitute either image in a template's Compose file
-when using the Node runtime.
-
-The CLI-generated Compose configuration uses the appropriate image and mounts
-only the template's local `app/` configuration. Release templates should set a
-versioned `app.runtime.image_tag` rather than relying on `latest`.
-
-## Runtime contract
-
-Every built companion app follows the same small operational contract:
-
-| Surface | Guarantee |
-|---|---|
-| `.env.example` | The complete committed list of values a local operator may need. It contains names and setup guidance, never real values. |
-| `docker-compose.yml` | Starts the app on port `3000`, loads `.env`, mounts `app/` read-only, and declares the health check. |
-| `GET /health` | Liveness only: returns `200 {"status":"ok"}` without calling Dome or an upstream system. Offline mode is valid. `/healthz` is an equivalent compatibility alias. |
-| `GET /readyz` | Readiness of the initialized runtime API. Returns `200`; its `mode` is `live` or `offline`. |
-| Docker `HEALTHCHECK` | Probes `/health`; inherited by every shared runtime image and repeated in Compose for a visible local contract. |
-
-The Library renders each template's committed `.env.example` verbatim, so setup
-requirements have one source of truth. Add a new variable there when the
-companion app needs it; use `app.options.env` in `template.yaml` as well when
-that value is interpolated into an agent prompt, starter, or help text.
-
-## Archetype containers
-
-The separate `dome-systems/template-runtime` repository builds one image per app
-shape. They contain no template-specific code — a template mounts an
-`app/agent.yaml` giving its **prompt**, its **skills** and its **invoker**, which
-is the shape the Dome agent runtime will take, so swapping a container for the
-real runner is a config move rather than a rewrite.
-
-Four UIs cover all 249 templates. A report is a run whose output is a table; an approval
-console is a queue with two extra buttons.
-
-| Archetype | Covers | Shapes | State |
-|---|---|---|---|
-| `ghcr.io/dome-systems/runtime-py-chat` | 66 | interactive-assistant | Built |
-| `ghcr.io/dome-systems/runtime-py-run` | 120 | scheduled-job, report-dashboard | Built |
-| `dome/template-queue` | 48 | triage-queue, approval-console | Not built |
-| `dome/template-console` | 15 | external-service, developer-harness | Not built |
-
-The governance drawer is shared chrome across all four, not a per-archetype feature.
-
-Tools go through the Gateway over MCP; models go through the Broker's
-Anthropic-compatible ingress. Both authenticate with the same agent token, which is why
-the container holds one secret and no provider key. Without `DOME_TOKEN` it starts in
-offline mode: the chrome works and the allow-list is still enforced, but tools and model
-are simulated.
-
-## What is source and what is generated
-
-`dome.tf` is the configuration source of truth for Dome resources. It is a
-portable HCL bundle that `dome import` can inspect, preview, and apply.
-`template.yaml` is catalog metadata and the source of truth for choosing the
-shared local runtime; `rules/*.cedar` and `app/instructions.md` are
-human-authored source.
-
-## Relationship to the Template Library
-
-This repository is the Library's only template-content source. A merge to `main`
-dispatches its commit SHA to `dome-systems/web-library`; that repository checks out
-and builds the exact revision, then opens or updates one source-refresh PR. The
-Library does not copy or edit template content, and a refresh PR must be merged
-before the new source can be published.
-
-The dispatch uses the `LIBRARY_SOURCE_SYNC_TOKEN` repository secret. It needs a
-fine-grained token that may dispatch workflows in `dome-systems/web-library`.
-
-## Validation
-
-Run the metadata and source-reference checks locally:
-
-```bash
-npm install
-npm run validate
-terraform fmt -check -recursive
-```
+`pull` only accepts scoped package names, verifies the Registry SHA-256 before extraction, accepts only the archive's `template/` root, writes `.dome-template-lock.yaml`, and never overwrites a non-empty directory. `up` is local-only and never downloads or updates a release. `publish` reads the scoped name and SemVer version from `template.yaml`, requires a clean Git checkout, and cannot replace a published version.
 
-CI runs the same checks. A plan-only import against a designated Dome sandbox can
-be added when CI has an appropriate non-production workspace and credentials.
+The CLI holds no authority over package ownership or artifact access. The Registry revalidates every publish and creates short-lived artifact URLs; it does not expose raw S3 keys.

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "@domesystems/templates",
-  "version": "0.1.1",
-  "description": "Initialize and run Dome governed-agent templates.",
+  "version": "0.3.0",
+  "description": "Pull, publish, and run versioned Dome templates.",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/dome-systems/templates-cli.git"
+  },
   "type": "module",
   "bin": {
     "dome-templates": "bin/dome-templates.mjs"
@@ -9,9 +13,7 @@
   "files": [
     "bin",
     "src",
-    "ai-agent-for-documentation",
-    "ai-agent-for-notion",
-    "ai-agent-for-release-notes"
+    "README.md"
   ],
   "engines": {
     "node": ">=20"
@@ -24,6 +26,7 @@
     "test": "node --test"
   },
   "dependencies": {
+    "unzipper": "0.12.3",
     "yaml": "2.9.0"
   }
 }

package/src/cli.mjs

@@ -1,237 +1,51 @@
 import fs from "node:fs";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { spawn, spawnSync } from "node:child_process";
 import readline from "node:readline/promises";
-import { readManifest } from "./manifest.mjs";
+import { readManifest, readPublishManifest } from "./manifest.mjs";
 import { imageForRuntime, renderCompose } from "./runtime.mjs";
-import { copyTemplate, initializeEnvironment } from "./template-files.mjs";
-
-const packageRoot = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
-
-function usage() {
-  return `Usage:\n  npx @domesystems/templates init <template> [--dir <directory>] [--force]\n  npx @domesystems/templates up <template> [--dir <directory>] [--skip-provision] [--no-start] [--detach] [--force]\n\nCommands:\n  init  Copy a template locally and create .env from .env.example.\n  up    Initialize (when needed), generate Compose from template.yaml, provision Dome, and start it.\n\nThe generated .dome-compose.yaml is ignored by Git. Runtime images are selected\nfrom app.runtime.language and app.runtime.pattern in template.yaml.\n`;
-}
-
-function fail(message) {
-  throw new Error(`${message}\n\n${usage()}`);
-}
-
-function parseArguments(argv) {
-  if (argv.length === 0 || argv.includes("--help") || argv.includes("-h")) return { help: true };
-  const [command, slug, ...rest] = argv;
-  const options = { force: false, provision: true, start: true, detach: false, directory: undefined };
-  for (let index = 0; index < rest.length; index += 1) {
-    const argument = rest[index];
-    if (argument === "--force") options.force = true;
-    else if (argument === "--skip-provision") options.provision = false;
-    else if (argument === "--no-start") options.start = false;
-    else if (argument === "--detach") options.detach = true;
-    else if (argument === "--dir") {
-      options.directory = rest[index + 1];
-      if (!options.directory) fail("--dir requires a directory.");
-      index += 1;
-    } else {
-      fail(`Unknown option: ${argument}`);
-    }
-  }
-  if (!["init", "up"].includes(command)) fail(`Unknown command: ${command}`);
-  if (!slug) fail("A template slug is required.");
-  return { command, slug, options };
-}
-
-function templateSource(slug) {
-  if (slug.includes("/") || slug.includes("\\") || slug === "." || slug === "..") {
-    fail(`Invalid template slug: ${slug}`);
-  }
-  const source = path.join(packageRoot, slug);
-  if (!fs.statSync(path.join(source, "template.yaml"), { throwIfNoEntry: false })?.isFile()) {
-    fail(`Unknown template: ${slug}`);
-  }
-  return source;
-}
-
-function targetDirectory(slug, directory) {
-  return path.resolve(process.cwd(), directory ?? slug);
-}
-
-function isEmpty(directory) {
-  return !fs.existsSync(directory) || fs.readdirSync(directory).length === 0;
-}
-
-function init(slug, options, output) {
-  const source = templateSource(slug);
-  const target = targetDirectory(slug, options.directory);
-  if (!isEmpty(target) && !options.force) {
-    throw new Error(`${target} already exists and is not empty. Choose --dir or pass --force.`);
-  }
-  copyTemplate(source, target);
-  const environmentCreated = initializeEnvironment(target);
-  output(`Initialized ${slug} in ${target}.`);
-  if (environmentCreated) {
-    output("Created .env from .env.example.");
-    output("When you run `up`, Dome will prompt for import credentials; they are never written to .env.");
-    output("After import, `up` writes DOME_TOKEN and DOME_GATEWAY_URL into .env. Add any other template-specific runtime values before starting.");
-  }
-  return target;
-}
-
-function resolveUpDirectory(slug, options, output) {
-  const target = targetDirectory(slug, options.directory);
-  if (fs.statSync(path.join(target, "template.yaml"), { throwIfNoEntry: false })?.isFile()) return target;
-  return init(slug, options, output);
-}
-
-function run(command, args, cwd) {
-  const result = spawnSync(command, args, { cwd, stdio: "inherit" });
-  if (result.error) throw new Error(`Could not run ${command}: ${result.error.message}`);
-  if (result.status !== 0) throw new Error(`${command} ${args.join(" ")} exited with status ${result.status}.`);
-}
-
-function parseFinalJSON(output, command) {
-  const starts = [...output.matchAll(/(?:^|\n)\{/g)].map((match) => match.index + (match[0][0] === "\n" ? 1 : 0));
-  for (const start of starts.reverse()) {
-    try {
-      return JSON.parse(output.slice(start));
-    } catch {
-      // The CLI may have printed an interactive prompt before its final JSON result.
-    }
-  }
-  throw new Error(`${command} completed without a readable JSON result.`);
-}
-
-function runJSON(command, args, cwd, { displayOutput = true } = {}) {
-  return new Promise((resolve, reject) => {
-    const child = spawn(command, args, { cwd, stdio: ["inherit", "pipe", "inherit"] });
-    let output = "";
-    child.stdout.on("data", (chunk) => {
-      const text = chunk.toString();
-      output += text;
-      if (displayOutput) process.stdout.write(text);
-    });
-    child.on("error", (error) => reject(new Error(`Could not run ${command}: ${error.message}`)));
-    child.on("close", (status) => {
-      if (status !== 0) {
-        reject(new Error(`${command} ${args.join(" ")} exited with status ${status}.`));
-        return;
-      }
-      try {
-        resolve(parseFinalJSON(output, command));
-      } catch (error) {
-        reject(error);
-      }
-    });
-  });
-}
-
-function replaceEnvironmentValue(source, name, value) {
-  const expression = new RegExp(`^${name}=.*$`, "m");
-  if (!expression.test(source)) throw new Error(`The runtime .env is missing ${name}.`);
-  return source.replace(expression, `${name}=${JSON.stringify(value)}`);
-}
-
-function undefinedEnvironmentValues(source) {
-  return source
-    .split(/\r?\n/)
-    .map((line) => line.match(/^([A-Za-z_][A-Za-z0-9_]*)=(?:\s*|""|''|undefined)$/)?.[1])
-    .filter(Boolean);
-}
-
-async function fillRuntimeEnvironment(target, output) {
-  const environmentPath = path.join(target, ".env");
-  let environment = fs.readFileSync(environmentPath, "utf8");
-  const missing = undefinedEnvironmentValues(environment);
-  if (missing.length === 0) return;
-  if (!process.stdin.isTTY || !process.stdout.isTTY) {
-    throw new Error(`Missing runtime .env values: ${missing.join(", ")}. Set them before starting Docker.`);
-  }
-
-  output(`Complete ${environmentPath} before starting the app.`);
-  const terminal = readline.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
-  const write = terminal._writeToOutput.bind(terminal);
-  terminal._writeToOutput = (text) => {
-    if (text === "\n" || text === "\r\n") write(text);
-  };
-  try {
-    for (const name of missing) {
-      const value = (await terminal.question(`Enter ${name}: `)).trim();
-      if (!value) throw new Error(`${name} is required to start the app.`);
-      environment = replaceEnvironmentValue(environment, name, value);
-    }
-  } finally {
-    terminal.close();
-  }
-  fs.writeFileSync(environmentPath, environment);
-  output(`Saved runtime values to ${environmentPath}.`);
-}
-
-function gatewayURL(response) {
-  return response.data?.gateway?.endpoints?.gatewayUrl ?? response.data?.gateway?.endpoints?.gateway_url;
-}
-
-async function writeRuntimeEnvironment(target, manifest, importResponse, output) {
-  const jobID = importResponse.data?.job?.id;
-  if (!jobID) throw new Error("Dome import succeeded but did not return an import job ID.");
-
-  const gatewayName = manifest.catalog?.gateway?.name;
-  if (!gatewayName) throw new Error("template.yaml must declare catalog.gateway.name to configure the runtime.");
-
-  const environmentPath = path.join(target, ".env");
-  let environment = fs.readFileSync(environmentPath, "utf8");
-  // Validate the local contract before consuming a one-time secret.
-  for (const name of ["DOME_TOKEN", "DOME_GATEWAY_URL"]) {
-    if (!new RegExp(`^${name}=.*$`, "m").test(environment)) throw new Error(`The runtime .env is missing ${name}.`);
-  }
-
-  const gateway = await runJSON("dome", ["gateways", "get", gatewayName, "--format", "json"], target, { displayOutput: false });
-  const url = gatewayURL(gateway);
-  if (!url) throw new Error(`Gateway ${gatewayName} has no runtime endpoint.`);
-
-  const revealed = await runJSON("dome", ["import", "outputs", jobID, "--format", "json"], target, { displayOutput: false });
-  const outputs = revealed.data?.outputs ?? {};
-  const tokens = Object.entries(outputs).filter(([name, value]) => name.endsWith("_token") && value);
-  if (tokens.length !== 1) throw new Error("The import must produce exactly one *_token output to configure DOME_TOKEN.");
-
-  environment = replaceEnvironmentValue(environment, "DOME_TOKEN", tokens[0][1]);
-  environment = replaceEnvironmentValue(environment, "DOME_GATEWAY_URL", url);
-  fs.writeFileSync(environmentPath, environment);
-  output(`Configured ${environmentPath} with the one-time agent token and Gateway URL.`);
-}
-
-export async function main(argv, { output = console.log, error = console.error } = {}) {
-  try {
-    const parsed = parseArguments(argv);
-    if (parsed.help) {
-      output(usage());
-      return;
-    }
-    const { command, slug, options } = parsed;
-    if (command === "init") {
-      init(slug, options, output);
-      return;
-    }
-
-    const target = resolveUpDirectory(slug, options, output);
-    const manifest = readManifest(target);
-    const composePath = path.join(target, ".dome-compose.yaml");
-    fs.writeFileSync(composePath, renderCompose(manifest.app.runtime));
-    output(`Generated ${path.basename(composePath)} using ${imageForRuntime(manifest.app.runtime)}.`);
-
-    if (options.provision) {
-      const imported = await runJSON("dome", ["import", "dome.tf", "--format", "json"], target);
-      await writeRuntimeEnvironment(target, manifest, imported, output);
-    }
-    if (options.start) {
-      await fillRuntimeEnvironment(target, output);
-      const args = ["compose", "-f", ".dome-compose.yaml", "up"];
-      if (options.detach) args.push("--detach");
-      run("docker", args, target);
-    }
-    if (!options.provision || !options.start) {
-      output("Skipped requested steps. Re-run without --skip-provision or --no-start when ready.");
-    }
-  } catch (caught) {
-    error(`Error: ${caught.message}`);
-    process.exitCode = 1;
-  }
-}
+import { extractRelease, initializeEnvironment } from "./template-files.mjs";
+import { createArchive, publishSource } from "./publish-files.mjs";
+import { DEFAULT_SERVER, deleteProfile, discover, login, normalizeServer, readProfile, registryRequest } from "./registry.mjs";
+
+function ansi(code, value, options) { return options.color && process.stdout.isTTY ? `\u001B[${code}m${value}\u001B[0m` : value; }
+function line(kind, value, options) { const styles = { info: ["•", "36"], success: ["✓", "32"], warning: ["!", "33"], error: ["✗", "31"] }; const [mark, code] = styles[kind]; return `${ansi(code, mark, options)} ${value}`; }
+function usage() { return "Usage:\n  templates login [--server <Dome application URL>] [--github]\n  templates logout [--server <Dome application URL>]\n  templates doctor <pull|up|publish> [package] [--dir <directory>] [--server <URL>] [--json]\n  templates pull <scope/package[@version]> [--dir <directory>] [--server <URL>]\n  templates up [--dir <directory>] [--port <host-port>] [--skip-provision|--provision] [--no-start] [--detach] [--verbose]\n  templates publish [--dry-run] [--server <Dome application URL>]\n"; }
+function parse(argv) {
+  if (!argv.length || argv.includes("--help") || argv.includes("-h")) return { help: true };
+  const [command, ...rest] = argv;
+  const options = { server: undefined, directory: undefined, port: 3000, dryRun: false, json: false, github: false, provision: true, forceProvision: false, start: true, detach: false, verbose: false, color: !process.env.NO_COLOR };
+  const values = [];
+  for (let i = 0; i < rest.length; i += 1) {
+    const arg = rest[i];
+    if (arg === "--server" || arg === "--dir" || arg === "--port" || arg === "--color") { const value = rest[++i]; if (!value) throw new Error(`${arg} requires a value.`); if (arg === "--server") options.server = normalizeServer(value); else if (arg === "--dir") options.directory = value; else if (arg === "--color") { if (!["auto", "always", "never"].includes(value)) throw new Error("--color must be auto, always, or never."); options.color = value === "always" || (value === "auto" && !process.env.NO_COLOR); } else { options.port = Number(value); if (!Number.isInteger(options.port) || options.port < 1 || options.port > 65535) throw new Error("--port requires an integer from 1 to 65535."); } }
+    else if (arg === "--github") options.github = true; else if (arg === "--dry-run") options.dryRun = true; else if (arg === "--json") options.json = true; else if (arg === "--skip-provision") options.provision = false; else if (arg === "--provision") options.forceProvision = true; else if (arg === "--no-start") options.start = false; else if (arg === "--detach") options.detach = true; else if (arg === "--verbose") options.verbose = true; else if (arg.startsWith("-")) throw new Error(`Unknown option: ${arg}`); else values.push(arg);
+  }
+  if (!["login", "logout", "doctor", "pull", "up", "publish"].includes(command)) throw new Error(`Unknown command: ${command}`);
+  return { command, values, options };
+}
+function packageReference(value) { const match = /^([a-z0-9][a-z0-9-]*\/[a-z0-9][a-z0-9-]*)(?:@(.+))?$/.exec(value ?? ""); if (!match) throw new Error("Template package must be fully qualified as scope/package or scope/package@version."); return { name: match[1], version: match[2] }; }
+function destination(name, directory) { return path.resolve(process.cwd(), directory ?? name.split("/")[1]); }
+function empty(dir) { return !fs.existsSync(dir) || fs.readdirSync(dir).length === 0; }
+async function pull(name, options, output, fetchImplementation) {
+  const ref = packageReference(name); const target = destination(ref.name, options.directory); if (!empty(target)) throw new Error(`${target} already exists and is not empty. Choose an empty --dir.`);
+  output(line("info", `Fetching ${ref.name}@${ref.version ?? "latest"}`, options));
+  const [scope, slug] = ref.name.split("/"); const { body: release } = await registryRequest(options.server ?? DEFAULT_SERVER, `/v1/packages/${scope}/${slug}${ref.version ? `/${encodeURIComponent(ref.version)}` : ""}`, { fetchImplementation });
+  if (!release.name || !release.version || !release.sha256 || !release.source) throw new Error("Registry returned incomplete release metadata.");
+  const { body: download } = await registryRequest(options.server ?? DEFAULT_SERVER, `/v1/packages/${scope}/${slug}/${encodeURIComponent(release.version)}/download-url`, { method: "POST", fetchImplementation });
+  const response = await fetchImplementation(download.url, { headers: { accept: "application/zip" } }); if (!response.ok) throw new Error(`Could not download ${ref.name}: ${response.status} ${response.statusText}.`);
+  fs.mkdirSync(target, { recursive: true }); await extractRelease(Buffer.from(await response.arrayBuffer()), target, release); const created = initializeEnvironment(target);
+  output(line("success", `Pulled ${release.name}@${release.version}`, options)); output(`  Saved to ${target}`); if (created) output(line("success", "Created .env from .env.example", options));
+}
+function run(command, args, cwd) { const result = spawnSync(command, args, { cwd, stdio: "inherit" }); if (result.error || result.status !== 0) throw new Error(`${command} ${args.join(" ")} failed.`); }
+function configured(target) { const env = path.join(target, ".env"); return fs.existsSync(env) && ["DOME_TOKEN", "DOME_GATEWAY_URL"].every((key) => new RegExp(`^${key}=(?!\\s*$|undefined|\"\")`, "m").test(fs.readFileSync(env, "utf8"))); }
+async function up(options, output) { const target = path.resolve(process.cwd(), options.directory ?? "."); const manifest = readManifest(target); output(line("info", `Checking ${target}`, options)); fs.writeFileSync(path.join(target, ".dome-compose.yaml"), renderCompose(manifest.app.runtime, options.port)); if (options.provision && (!configured(target) || options.forceProvision)) { output(line("info", "Setting up Dome resources", options)); run("dome", ["import", "dome.tf"], target); } if (options.start) { output(line("info", `Starting app at http://localhost:${options.port}`, options)); run("docker", ["compose", "-f", ".dome-compose.yaml", "up", ...(options.detach ? ["--detach"] : [])], target); } }
+async function publish(options, output, fetchImplementation) { const target = path.resolve(process.cwd(), options.directory ?? "."); const manifest = readPublishManifest(target); const source = publishSource(target); const name = manifest.metadata.name; const [scope, slug] = name.split("/"); const archive = options.dryRun ? null : createArchive(source); output(line("info", `Checking ${name}@${manifest.metadata.version}`, options)); const payload = { name, version: manifest.metadata.version, title: manifest.metadata.title, summary: manifest.metadata.summary ?? "", sha256: archive?.sha256, size_bytes: archive?.buffer.length, source: { repository: manifest.metadata.source.repository, path: manifest.metadata.source.path, commit: source.commit, remote: source.remote, files: source.files } };
+  const { target: registry, body: attempt } = await registryRequest(options.server ?? DEFAULT_SERVER, "/v1/publish-attempts", { method: "POST", body: { ...payload, dry_run: options.dryRun }, authenticated: true, fetchImplementation });
+  if (options.dryRun) { output(line("success", `Publish plan is valid for ${name}@${manifest.metadata.version}`, options)); return; }
+  try { output(line("info", "Uploading release artifact", options)); const upload = await fetchImplementation(attempt.upload_url, { method: "PUT", headers: { "content-type": "application/zip" }, body: archive.buffer }); if (!upload.ok) throw new Error(`Artifact upload failed: ${upload.status} ${upload.statusText}.`); const { body: published } = await registryRequest(registry.server, `/v1/publish-attempts/${encodeURIComponent(attempt.id)}/complete`, { method: "POST", body: { sha256: archive.sha256, size_bytes: archive.buffer.length }, authenticated: true, fetchImplementation }); output(line("success", `Published ${published.name ?? name}@${published.version ?? manifest.metadata.version}`, options)); if (published.url) output(`  ${published.url}`); } finally { archive.cleanup(); }
+}
+async function doctor(subject, options, output, fetchImplementation) { const checks = []; const add = (name, passed, remediation) => checks.push({ name, passed, remediation }); try { if (subject === "pull") { await discover(options.server ?? DEFAULT_SERVER, fetchImplementation); add("Registry reachability", true); } else if (subject === "up") { const target = path.resolve(process.cwd(), options.directory ?? "."); readManifest(target); add("template.yaml", true); add("Docker Compose", spawnSync("docker", ["compose", "version"], { stdio: "ignore" }).status === 0, "Install Docker Desktop or Docker Engine with the Compose plugin."); add("Dome CLI", spawnSync("dome", ["--version"], { stdio: "ignore" }).status === 0, "Install the Dome CLI."); } else if (subject === "publish") { readPublishManifest(path.resolve(process.cwd(), options.directory ?? ".")); publishSource(path.resolve(process.cwd(), options.directory ?? ".")); const profile = readProfile(options.server ?? DEFAULT_SERVER); add("Registry sign-in", Boolean(profile?.token), `Run npx @domesystems/templates login --server ${options.server ?? DEFAULT_SERVER}`); } else throw new Error("doctor expects pull, up, or publish."); } catch (error) { add("Preflight", false, error.message); }
+  if (options.json) output(JSON.stringify({ server: options.server ?? DEFAULT_SERVER, checks })); else checks.forEach((check) => output(line(check.passed ? "success" : "error", check.passed ? check.name : `${check.name}: ${check.remediation}`, options))); if (checks.some((check) => !check.passed)) throw new Error(`Cannot continue until ${subject} checks pass.`);
+}
+export async function main(argv, { output = console.log, error = console.error, fetchImplementation = globalThis.fetch, sleep } = {}) { try { const parsed = parse(argv); if (parsed.help) return output(usage()); const { command, values, options } = parsed; if (options.json) options.color = false; if (command === "login") { output(line("info", `Opening sign-in for ${options.server ?? DEFAULT_SERVER}`, options)); const session = await login(options.server ?? DEFAULT_SERVER, { github: options.github, fetchImplementation, sleep, onStart: (started) => output(`Open ${started.verification_uri} and enter ${started.user_code ?? "the displayed code"}.`) }); output(line("success", `Signed in as ${session.session.email}`, options)); return; } if (command === "logout") { const server = options.server ?? DEFAULT_SERVER; const profile = readProfile(server); if (profile?.token) await registryRequest(server, "/v1/auth/logout", { method: "POST", authenticated: true, fetchImplementation }); deleteProfile(server); output(line("success", `Signed out of ${server}`, options)); return; } if (command === "pull") return pull(values[0], options, output, fetchImplementation); if (command === "up") return up(options, output); if (command === "publish") return publish(options, output, fetchImplementation); return doctor(values[0], options, output, fetchImplementation); } catch (caught) { error(line("error", caught.message, { color: false })); process.exitCode = 1; } }

package/src/manifest.mjs

@@ -20,3 +20,36 @@ export function readManifest(templateDirectory) {
   }
   return manifest;
 }
+
+const PACKAGE_NAME = /^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/;
+const VERSION = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+
+export function readPublishManifest(templateDirectory) {
+  const manifest = readManifest(templateDirectory);
+  if (manifest.apiVersion !== "templates.domesystems.ai/v1" || manifest.kind !== "Template") {
+    throw new Error("template.yaml must declare apiVersion templates.domesystems.ai/v1 and kind Template.");
+  }
+  const metadata = manifest.metadata ?? {};
+  if (!PACKAGE_NAME.test(metadata.name ?? "")) {
+    throw new Error("template.yaml metadata.name must be a lowercase scoped name such as im2nguyen/tinyfish.");
+  }
+  if (!VERSION.test(metadata.version ?? "")) {
+    throw new Error("template.yaml metadata.version must be a valid SemVer version.");
+  }
+  if (typeof metadata.title !== "string" || !metadata.title.trim()) {
+    throw new Error("template.yaml metadata.title is required to publish a template.");
+  }
+  const source = metadata.source;
+  if (!source || typeof source.repository !== "string" || typeof source.path !== "string" || !source.path.trim()) {
+    throw new Error("template.yaml metadata.source.repository and metadata.source.path are required to publish a template.");
+  }
+  let repository;
+  try { repository = new URL(source.repository); } catch { throw new Error("metadata.source.repository must be a GitHub HTTPS URL."); }
+  if (repository.protocol !== "https:" || repository.hostname !== "github.com" || !/^\/[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/?$/.test(repository.pathname)) {
+    throw new Error("metadata.source.repository must be a public https://github.com/<owner>/<repository> URL.");
+  }
+  if (source.path.split(/[\\/]+/).some((part) => !part || part === "." || part === "..")) {
+    throw new Error("metadata.source.path must be a relative repository path without traversal.");
+  }
+  return manifest;
+}

package/src/publish-files.mjs

@@ -0,0 +1,68 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { spawnSync } from "node:child_process";
+
+const EXCLUDED = new Set([".git", ".env", ".terraform", "node_modules", ".dome-compose.yaml", "docker-compose.yml"]);
+const MAX_BYTES = 100 * 1024 * 1024;
+
+function walk(root, relative = "") {
+  const directory = path.join(root, relative);
+  return fs.readdirSync(directory, { withFileTypes: true }).flatMap((entry) => {
+    if (EXCLUDED.has(entry.name)) return [];
+    const next = path.posix.join(relative, entry.name);
+    if (entry.isDirectory()) return walk(root, next);
+    if (!entry.isFile() || entry.isSymbolicLink()) throw new Error(`Cannot publish unsupported source entry: ${next}`);
+    return [next];
+  });
+}
+
+export function git(command, args, cwd) {
+  const result = spawnSync(command, args, { cwd, encoding: "utf8" });
+  if (result.error || result.status !== 0) {
+    const reason = result.error?.message ?? result.stderr.trim() ?? "command failed";
+    throw new Error(`Git is required to publish this template (${reason}).`);
+  }
+  return result.stdout.trim();
+}
+
+export function publishSource(directory) {
+  const root = path.resolve(directory);
+  const commit = git("git", ["rev-parse", "HEAD"], root);
+  if (git("git", ["status", "--porcelain", "--", "."], root)) throw new Error("The template directory has uncommitted changes. Commit or stash them before publishing.");
+  const remote = git("git", ["config", "--get", "remote.origin.url"], root).replace(/\.git$/, "");
+  const files = walk(root).sort();
+  let size = 0;
+  const entries = files.map((file) => {
+    const contents = fs.readFileSync(path.join(root, file));
+    size += contents.length;
+    if (size > MAX_BYTES) throw new Error("Template source exceeds the 100 MiB publishing limit.");
+    return { path: file, sha256: crypto.createHash("sha256").update(contents).digest("hex"), size: contents.length };
+  });
+  return { root, commit, remote, files: entries, size };
+}
+
+export function createArchive(source) {
+  const staging = fs.mkdtempSync(path.join(os.tmpdir(), "dome-template-publish-"));
+  const archive = path.join(staging, "release.zip");
+  const contents = path.join(staging, "template");
+  try {
+    fs.mkdirSync(contents);
+    for (const entry of source.files) {
+      const destination = path.join(contents, entry.path);
+      fs.mkdirSync(path.dirname(destination), { recursive: true });
+      fs.copyFileSync(path.join(source.root, entry.path), destination);
+    }
+    const result = spawnSync("zip", ["-q", "-r", archive, "template"], { cwd: staging, encoding: "utf8" });
+    if (result.error || result.status !== 0) {
+      const reason = result.error?.message ?? result.stderr.trim() ?? "zip failed";
+      throw new Error(`Could not package template release (${reason}).`);
+    }
+    const buffer = fs.readFileSync(archive);
+    return { buffer, sha256: crypto.createHash("sha256").update(buffer).digest("hex"), cleanup: () => fs.rmSync(staging, { recursive: true, force: true }) };
+  } catch (error) {
+    fs.rmSync(staging, { recursive: true, force: true });
+    throw error;
+  }
+}