@dxos/plugin-registry 0.10.0 → 0.11.0

package/dist/lib/RegistryPlugin.node.mjs

@@ -0,0 +1,770 @@
+import { n as saveEnabledPlugins } from "./chunk-storage.mjs";
+import { Plugin } from "@dxos/app-framework";
+import { AppPlugin, AppSpace } from "@dxos/app-toolkit";
+import * as FileSystem from "@effect/platform/FileSystem";
+import * as Path from "@effect/platform/Path";
+import * as Effect from "effect/Effect";
+import * as Schema from "effect/Schema";
+import { meta } from "#meta";
+import * as Command from "@effect/cli/Command";
+import * as Args from "@effect/cli/Args";
+import * as Console from "effect/Console";
+import { CommandConfig, FormBuilder, printList } from "@dxos/cli-util";
+import { invariant } from "@dxos/invariant";
+import * as Options from "@effect/cli/Options";
+import * as PlatformCommand from "@effect/platform/Command";
+import * as FetchHttpClient from "@effect/platform/FetchHttpClient";
+import * as Function from "effect/Function";
+import * as Option from "effect/Option";
+import { findDxConfigFile, loadDxConfig } from "@dxos/app-framework/vite-plugin";
+import { ClientService } from "@dxos/client";
+import { Context } from "@dxos/context";
+import { EdgeHttpClient } from "@dxos/edge-client";
+import { ALL_NSIDS, Config2, NSID } from "@dxos/protocols";
+import * as HttpClient from "@effect/platform/HttpClient";
+import * as HttpClientRequest from "@effect/platform/HttpClientRequest";
+import * as Config from "effect/Config";
+import { Filter } from "@dxos/echo";
+import { AccessToken } from "@dxos/link";
+//#region src/commands/plugin/disable.ts
+var __dxlog_file$2 = "/__w/dxos/dxos/packages/plugins/plugin-registry/src/commands/plugin/disable.ts";
+var handler$2 = Effect.fn(function* ({ id }) {
+	const { json, profile } = yield* CommandConfig;
+	const manager = yield* Plugin.Service;
+	const plugin = manager.getPlugins().find((p) => p.meta.profile.key === id);
+	invariant(plugin, `Plugin not found: ${id}`, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$2,
+		L: 22,
+		S: this,
+		A: ["plugin", "`Plugin not found: ${id}`"]
+	});
+	invariant(!manager.getCore().includes(id), `Cannot disable core plugin: ${id}`, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$2,
+		L: 25,
+		S: this,
+		A: ["!core.includes(id)", "`Cannot disable core plugin: ${id}`"]
+	});
+	invariant(yield* manager.disable(id), `Failed to disable plugin: ${id}`, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$2,
+		L: 28,
+		S: this,
+		A: ["disabled", "`Failed to disable plugin: ${id}`"]
+	});
+	yield* saveEnabledPlugins({
+		profile,
+		enabled: [...manager.getEnabled()]
+	});
+	if (json) yield* Console.log(JSON.stringify({
+		id,
+		enabled: false
+	}, null, 2));
+	else yield* Console.log(`Plugin "${plugin.meta.profile.name ?? id}" disabled.`);
+});
+var disable = Command.make("disable", { id: Args.text({ name: "id" }).pipe(Args.withDescription("The ID of the plugin to disable.")) }, handler$2).pipe(Command.withDescription("Disable a plugin."));
+//#endregion
+//#region src/commands/plugin/enable.ts
+var __dxlog_file$1 = "/__w/dxos/dxos/packages/plugins/plugin-registry/src/commands/plugin/enable.ts";
+var handler$1 = Effect.fn(function* ({ id }) {
+	const { json, profile } = yield* CommandConfig;
+	const manager = yield* Plugin.Service;
+	const plugin = manager.getPlugins().find((p) => p.meta.profile.key === id);
+	invariant(plugin, `Plugin not found: ${id}`, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$1,
+		L: 22,
+		S: this,
+		A: ["plugin", "`Plugin not found: ${id}`"]
+	});
+	invariant(yield* manager.enable(id), `Failed to enable plugin: ${id}`, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file$1,
+		L: 25,
+		S: this,
+		A: ["enabled", "`Failed to enable plugin: ${id}`"]
+	});
+	yield* saveEnabledPlugins({
+		profile,
+		enabled: [...manager.getEnabled()]
+	});
+	if (json) yield* Console.log(JSON.stringify({
+		id,
+		enabled: true
+	}, null, 2));
+	else yield* Console.log(`Plugin "${plugin.meta.profile.name ?? id}" enabled.`);
+});
+var enable = Command.make("enable", { id: Args.text({ name: "id" }).pipe(Args.withDescription("The ID of the plugin to enable.")) }, handler$1).pipe(Command.withDescription("Enable a plugin."));
+//#endregion
+//#region src/commands/plugin/util.ts
+/**
+* Pretty prints a plugin with ANSI colors.
+*/
+var printPlugin = (plugin) => {
+	const status = plugin.core ? "core" : plugin.enabled ? "enabled" : "disabled";
+	return FormBuilder.make({ title: plugin.name }).pipe(FormBuilder.set("id", plugin.id), FormBuilder.set("status", status), FormBuilder.build);
+};
+//#endregion
+//#region src/commands/plugin/list.ts
+var handler = Effect.fn(function* () {
+	const { json } = yield* CommandConfig;
+	const manager = yield* Plugin.Service;
+	const plugins = manager.getPlugins();
+	const enabled = manager.getEnabled();
+	const core = manager.getCore();
+	const formattedPlugins = plugins.map((plugin) => {
+		const isEnabled = enabled.includes(plugin.meta.profile.key);
+		const isCore = core.includes(plugin.meta.profile.key);
+		return {
+			id: plugin.meta.profile.key,
+			name: plugin.meta.profile.name ?? plugin.meta.profile.key,
+			enabled: isEnabled,
+			core: isCore
+		};
+	});
+	if (json) yield* Console.log(JSON.stringify(formattedPlugins, null, 2));
+	else {
+		const formatted = formattedPlugins.map(printPlugin);
+		yield* Console.log(printList(formatted));
+	}
+});
+var list = Command.make("list", {}, handler).pipe(Command.withDescription("List all available plugins."));
+//#endregion
+//#region src/commands/plugin/index.ts
+var plugin = Command.make("plugin").pipe(Command.withDescription("Manage plugins."), Command.withSubcommands([
+	enable,
+	disable,
+	list
+]));
+//#endregion
+//#region src/commands/registry/util.ts
+/**
+* Shared helpers for the `dx registry *` commands.
+*
+* These commands write `org.dxos.experimental.*` records to a publisher's PDS via AT Protocol
+* XRPC. Auth has two modes (see {@link resolveSession}):
+*
+* - **Personal-space (default):** when logged in (`dx account login`), the publisher's atproto
+*   session lives in their personal space as the "Atmosphere" `AccessToken`. Record writes are
+*   signed by Edge's DPoP proxy (`/atproto/proxy`) — no app password required.
+* - **App password (fallback):** explicit `--handle` / `--app-password` (or `$ATPROTO_HANDLE` /
+*   `$ATPROTO_APP_PASSWORD`) authenticate directly against the PDS with a session token.
+*/
+var ATMOSPHERE_SOURCE = "atproto.local";
+var BSKY_PUBLIC_API = "https://public.api.bsky.app/xrpc";
+var PLC_DIRECTORY = "https://plc.directory";
+var CreateSessionResponseSchema = Schema.Struct({
+	did: Schema.String,
+	handle: Schema.String,
+	accessJwt: Schema.String,
+	refreshJwt: Schema.String
+});
+var ResolveHandleResponseSchema = Schema.Struct({ did: Schema.String });
+var DidServiceSchema = Schema.Struct({
+	id: Schema.String,
+	type: Schema.optional(Schema.String),
+	serviceEndpoint: Schema.Unknown
+});
+var DidDocumentSchema = Schema.Struct({ service: Schema.optional(Schema.Array(DidServiceSchema)) });
+var PutRecordResponseSchema = Schema.Struct({
+	uri: Schema.String,
+	cid: Schema.String
+});
+var ListRecordsEntrySchema = Schema.Struct({
+	uri: Schema.String,
+	cid: Schema.String,
+	value: Schema.Unknown
+});
+var ListRecordsResponseSchema = Schema.Struct({
+	cursor: Schema.optional(Schema.String),
+	records: Schema.Array(ListRecordsEntrySchema)
+});
+var decodeJson = (schema) => (response) => Effect.flatMap(response.json, Schema.decodeUnknown(schema));
+/** GET an XRPC endpoint and decode the JSON response. */
+var xrpcGet = (url, query, schema) => Effect.gen(function* () {
+	const client = yield* HttpClient.HttpClient;
+	return yield* HttpClientRequest.get(url).pipe(HttpClientRequest.setUrlParams(query), client.execute, Effect.flatMap(decodeJson(schema)), Effect.scoped);
+});
+/** POST a JSON body to an XRPC endpoint and decode the JSON response. */
+var xrpcPost = (url, body, schema, headers = {}) => Effect.gen(function* () {
+	const client = yield* HttpClient.HttpClient;
+	const response = yield* HttpClientRequest.post(url).pipe(HttpClientRequest.setHeaders(headers), HttpClientRequest.bodyJson(body), Effect.flatMap((req) => client.execute(req)), Effect.scoped);
+	if (schema === void 0) return;
+	return yield* decodeJson(schema)(response);
+});
+/** Resolve a handle (e.g. `alice.bsky.social`) to a DID via the public XRPC. */
+var resolveHandle = (handle) => xrpcGet(`${BSKY_PUBLIC_API}/com.atproto.identity.resolveHandle`, { handle }, ResolveHandleResponseSchema).pipe(Effect.map((response) => response.did));
+/** Resolve a DID to its PDS service endpoint via the PLC directory (or did:web well-known). */
+var resolvePds = (did) => Effect.gen(function* () {
+	let doc;
+	if (did.startsWith("did:plc:")) doc = yield* xrpcGet(`${PLC_DIRECTORY}/${did}`, {}, DidDocumentSchema);
+	else if (did.startsWith("did:web:")) {
+		const [host, ...segments] = did.slice(8).split(":").map((part) => decodeURIComponent(part));
+		doc = yield* xrpcGet(`https://${host}${segments.length > 0 ? `/${segments.join("/")}/did.json` : "/.well-known/did.json"}`, {}, DidDocumentSchema);
+	} else return yield* Effect.fail(/* @__PURE__ */ new Error(`Unsupported DID method: ${did}`));
+	const endpoint = (doc.service?.find((entry) => entry.id === "#atproto_pds" || entry.type === "AtprotoPersonalDataServer"))?.serviceEndpoint;
+	if (typeof endpoint !== "string" || endpoint.length === 0) return yield* Effect.fail(/* @__PURE__ */ new Error(`PDS endpoint missing in DID document for ${did}`));
+	return endpoint;
+});
+/** Resolve a handle or DID to its `{ did, pdsBaseUrl }`. */
+var resolveRepo = (handleOrDid) => Effect.gen(function* () {
+	const did = handleOrDid.startsWith("did:") ? handleOrDid : yield* resolveHandle(handleOrDid);
+	return {
+		did,
+		pdsBaseUrl: yield* resolvePds(did)
+	};
+});
+/**
+* App-password session — call `com.atproto.server.createSession` against the caller's resolved
+* PDS, then return the access JWT, DID, and PDS endpoint needed for subsequent writes.
+*/
+var createSession = (handle, appPassword) => Effect.gen(function* () {
+	const { did, pdsBaseUrl } = yield* resolveRepo(handle);
+	const response = yield* xrpcPost(`${pdsBaseUrl}/xrpc/com.atproto.server.createSession`, {
+		identifier: handle,
+		password: appPassword
+	}, CreateSessionResponseSchema);
+	return {
+		mode: "app-password",
+		did: response.did,
+		handle: response.handle,
+		accessJwt: response.accessJwt,
+		pdsBaseUrl
+	};
+});
+/**
+* Resolve an authenticated {@link Session} for the registry commands, in precedence order:
+*
+* 1. Explicit `--handle` + `--app-password` (or `$ATPROTO_HANDLE` / `$ATPROTO_APP_PASSWORD`) →
+*    app-password session (works without a DXOS identity).
+* 2. The logged-in identity's personal-space "Atmosphere" `AccessToken` → DPoP-proxy session.
+* 3. A context-specific error guiding the user to log in / connect an integration / pass creds.
+*/
+var resolveSession = (options) => Effect.gen(function* () {
+	const handle = options.handle ?? Option.getOrUndefined(yield* Config.option(Config.string("ATPROTO_HANDLE")));
+	const appPassword = options.appPassword ?? Option.getOrUndefined(yield* Config.option(Config.string("ATPROTO_APP_PASSWORD")));
+	if (handle && appPassword) return yield* createSession(handle, appPassword);
+	const fromPersonalSpace = yield* resolvePersonalSpaceSession(options.client);
+	if (fromPersonalSpace) return fromPersonalSpace;
+	if (options.client.halo.identity.get()) return yield* Effect.fail(/* @__PURE__ */ new Error("No atproto integration connected. Connect one with `dx integration add`, or pass --handle/--app-password. (`dx account login` cannot add an integration to an existing identity.)"));
+	return yield* Effect.fail(/* @__PURE__ */ new Error("No DXOS identity. Run `dx account login` first, or pass --handle/--app-password."));
+});
+/**
+* Build a DPoP-proxy session from the personal space's "Atmosphere" `AccessToken`, or `undefined`
+* if the user isn't logged in or hasn't connected an atproto integration.
+*/
+var resolvePersonalSpaceSession = (client) => Effect.gen(function* () {
+	const space = AppSpace.getPersonalSpace(client);
+	if (!space) return;
+	const token = (yield* Effect.promise(() => space.db.query(Filter.type(AccessToken.AccessToken)).run())).find((object) => object.source === ATMOSPHERE_SOURCE && !!object.account && !!object.token);
+	if (!token?.account) return;
+	const { did, pdsBaseUrl } = yield* resolveRepo(token.account);
+	return {
+		mode: "dpop-proxy",
+		did,
+		handle: token.account,
+		pdsBaseUrl,
+		edgeBaseUrl: client.edge.http.baseUrl,
+		spaceId: space.id,
+		accessTokenId: token.id,
+		token: token.token,
+		authHeader: client.edge.http._authHeader
+	};
+});
+/**
+* Proxy an XRPC call through Edge's `/atproto/proxy`, which attaches the DPoP proof signed with
+* the key Edge stored at OAuth time. The proxy forwards `request` verbatim and returns the
+* upstream PDS response body, so callers decode the same schema as the direct path.
+*/
+var proxyCall = (session, params, schema) => {
+	const query = params.query ? `?${new URLSearchParams(params.query).toString()}` : "";
+	const innerHeaders = {
+		Accept: "application/json",
+		Authorization: `DPoP ${session.token}`
+	};
+	if (params.jsonBody) innerHeaders["Content-Type"] = "application/json";
+	const outerHeaders = {};
+	if (session.authHeader) outerHeaders.Authorization = session.authHeader;
+	return xrpcPost(`${session.edgeBaseUrl.replace(/\/$/, "")}/atproto/proxy`, {
+		spaceId: session.spaceId,
+		accessTokenId: session.accessTokenId,
+		request: {
+			endpoint: `${session.pdsBaseUrl}/xrpc/${params.xrpcMethod}${query}`,
+			method: params.method,
+			headers: innerHeaders,
+			body: params.jsonBody ? JSON.stringify(params.jsonBody) : null
+		}
+	}, schema, outerHeaders);
+};
+/** Write a record at `com.atproto.repo.putRecord` (idempotent on rkey). */
+var putRecord = (session, collection, rkey, record) => {
+	const body = {
+		repo: session.did,
+		collection,
+		rkey,
+		record: {
+			$type: collection,
+			...record
+		}
+	};
+	return session.mode === "app-password" ? xrpcPost(`${session.pdsBaseUrl}/xrpc/com.atproto.repo.putRecord`, body, PutRecordResponseSchema, { Authorization: `Bearer ${session.accessJwt}` }) : proxyCall(session, {
+		xrpcMethod: "com.atproto.repo.putRecord",
+		method: "POST",
+		jsonBody: body
+	}, PutRecordResponseSchema);
+};
+/** Delete a record at `com.atproto.repo.deleteRecord`. */
+var deleteRecord = (session, collection, rkey) => {
+	const body = {
+		repo: session.did,
+		collection,
+		rkey
+	};
+	return session.mode === "app-password" ? xrpcPost(`${session.pdsBaseUrl}/xrpc/com.atproto.repo.deleteRecord`, body, void 0, { Authorization: `Bearer ${session.accessJwt}` }) : proxyCall(session, {
+		xrpcMethod: "com.atproto.repo.deleteRecord",
+		method: "POST",
+		jsonBody: body
+	}, void 0);
+};
+/**
+* List records in a single collection on the authenticated repo. Paging is left to the caller (the
+* four registry collections are tiny in practice); the cursor is surfaced on the return.
+*/
+var listRecords = (session, collection, options = {}) => {
+	const query = {
+		repo: session.did,
+		collection,
+		...options.limit !== void 0 ? { limit: String(options.limit) } : {},
+		...options.cursor !== void 0 ? { cursor: options.cursor } : {}
+	};
+	return session.mode === "app-password" ? xrpcGet(`${session.pdsBaseUrl}/xrpc/com.atproto.repo.listRecords`, query, ListRecordsResponseSchema) : proxyCall(session, {
+		xrpcMethod: "com.atproto.repo.listRecords",
+		method: "GET",
+		query
+	}, ListRecordsResponseSchema);
+};
+var AUTH_OPTION_DESCRIPTIONS = {
+	handle: "AT Protocol handle (e.g. alice.bsky.social). Defaults to the logged-in identity; falls back to $ATPROTO_HANDLE.",
+	appPassword: "AT Protocol app password (https://bsky.app/settings/app-passwords). Falls back to $ATPROTO_APP_PASSWORD. Not needed when logged in via `dx account login`."
+};
+//#endregion
+//#region src/commands/registry/publish.ts
+var __dxlog_file = "/__w/dxos/dxos/packages/plugins/plugin-registry/src/commands/registry/publish.ts";
+/** Manifest emitted by the build (subset consumed here). Extends `Config2.Plugin` with build-time fields. */
+var ManifestSchema = Schema.Struct({
+	...Config2.Plugin.fields,
+	version: Schema.String.pipe(Schema.nonEmptyString()),
+	dependencies: Schema.optional(Schema.Record({
+		key: Schema.String,
+		value: Schema.String
+	}))
+});
+var ensureTrailingSlash = (url) => url.endsWith("/") ? url : `${url}/`;
+var sha256Base64 = async (bytes) => {
+	const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+	return Buffer.from(new Uint8Array(digest)).toString("base64");
+};
+/**
+* `dx registry publish` — config-driven build + publish.
+*
+* Reads the build/publish orchestration from `dx.config.ts`, runs the declared build command,
+* reads the emitted `manifest.json`, hosts the bundle (default: upload the build
+* output to the DXOS edge registry; override with `publish.assetBaseUrl` to point
+* at your own already-hosted directory), then writes the `plugin.profile` and
+* `plugin.release` records to the authenticated publisher's PDS. Release
+* integrity is anchored by `manifestHash` (sha256 of `manifest.json`) in the
+* signed release record.
+*/
+var publish = Command.make("publish", {
+	handle: Options.text("handle").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options.optional),
+	appPassword: Options.text("app-password").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options.optional),
+	dir: Options.text("dir").pipe(Options.withDescription("Project directory containing dx.config.ts. Defaults to the current directory."), Options.withDefault(".")),
+	noBuild: Options.boolean("no-build").pipe(Options.withDescription("Skip running the build command (publish a pre-built dist).")),
+	assetBaseUrl: Options.text("asset-base-url").pipe(Options.withDescription("Skip upload and point the release at an already-hosted bundle directory."), Options.optional),
+	edgeUrl: Options.text("edge-url").pipe(Options.withDescription("Edge base URL for bundle upload (e.g. http://localhost:8787). Bypasses profile config; auth is skipped (requires WORKER_ENV=dev on the server)."), Options.optional)
+}, (options) => Function.pipe(Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const dir = path.resolve(options.dir);
+	const configFile = findDxConfigFile(dir);
+	if (!configFile) return yield* Effect.fail(/* @__PURE__ */ new Error(`No dx.config.ts found in ${dir}.`));
+	const config = yield* Effect.tryPromise({
+		try: () => loadDxConfig(configFile),
+		catch: (error) => /* @__PURE__ */ new Error(`Failed to load dx.config.ts in ${dir}: ${error}`)
+	});
+	const buildCommand = config.publish?.buildCommand;
+	if (!options.noBuild && buildCommand) {
+		yield* Console.log(`Building: ${buildCommand}`);
+		const binDir = path.join(dir, "node_modules", ".bin");
+		const exitCode = yield* PlatformCommand.make("sh", "-c", `export PATH="${binDir}:$PATH"; ${buildCommand}`).pipe(PlatformCommand.workingDirectory(dir), PlatformCommand.stdout("inherit"), PlatformCommand.stderr("inherit"), PlatformCommand.exitCode);
+		if (exitCode !== 0) return yield* Effect.fail(/* @__PURE__ */ new Error(`Build failed (exit ${exitCode}): ${buildCommand}`));
+	}
+	const outdir = path.join(dir, config.publish?.outputDirectory ?? "dist");
+	const manifestPath = path.join(outdir, "manifest.json");
+	if (!(yield* fs.exists(manifestPath))) return yield* Effect.fail(/* @__PURE__ */ new Error(`manifest.json not found in ${outdir}. Did the build run?`));
+	const manifestRaw = yield* fs.readFileString(manifestPath);
+	const manifest = yield* Schema.decodeUnknown(ManifestSchema)(JSON.parse(manifestRaw));
+	const key = manifest.key;
+	const version = manifest.version;
+	const manifestHash = `sha256-${yield* Effect.promise(() => sha256Base64(new TextEncoder().encode(manifestRaw)))}`;
+	const assetBaseUrl = Option.getOrUndefined(options.assetBaseUrl) ?? config.publish?.assetBaseUrl;
+	let moduleUrl;
+	if (assetBaseUrl) {
+		moduleUrl = new URL("manifest.json", ensureTrailingSlash(assetBaseUrl)).toString();
+		yield* Console.log(`Self-hosted: ${moduleUrl}`);
+	} else {
+		const explicitEdgeUrl = Option.getOrUndefined(options.edgeUrl);
+		if (explicitEdgeUrl) moduleUrl = yield* uploadBundleDirect({
+			http: new EdgeHttpClient(explicitEdgeUrl),
+			key,
+			version,
+			outdir
+		});
+		else {
+			const client = yield* ClientService;
+			moduleUrl = yield* uploadBundle({
+				client,
+				key,
+				version,
+				outdir,
+				auth: !!client.halo.identity.get()
+			});
+		}
+		yield* Console.log(`Uploaded:  ${moduleUrl}`);
+	}
+	const client = yield* ClientService;
+	const session = yield* resolveSession({
+		handle: Option.getOrUndefined(options.handle),
+		appPassword: Option.getOrUndefined(options.appPassword),
+		client
+	});
+	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+	const profile = {
+		key,
+		name: manifest.name,
+		createdAt
+	};
+	if (manifest.description !== void 0) profile.description = manifest.description;
+	if (manifest.homePage !== void 0) profile.homePage = manifest.homePage;
+	if (manifest.source !== void 0) profile.source = manifest.source;
+	if (manifest.icon !== void 0) profile.icon = manifest.icon;
+	if (manifest.tags && manifest.tags.length > 0) profile.tags = manifest.tags;
+	if (manifest.screenshots && manifest.screenshots.length > 0) profile.screenshots = manifest.screenshots;
+	if (manifest.dependsOn?.length) profile.dependsOn = manifest.dependsOn;
+	if (manifest.spec !== void 0) profile.spec = manifest.spec;
+	const profileResult = yield* putRecord(session, NSID.PluginProfile, key, profile);
+	yield* Console.log(`Profile    ${profileResult.uri}`);
+	const releaseResult = yield* putRecord(session, NSID.PluginRelease, `${key}:${version}`, {
+		pluginKey: key,
+		version,
+		moduleUrl,
+		manifestHash,
+		createdAt,
+		...manifest.dependencies ? { dependencies: manifest.dependencies } : {}
+	});
+	yield* Console.log(`Release    ${releaseResult.uri}`);
+}), Effect.provide(FetchHttpClient.layer))).pipe(Command.withDescription("Build, host, and publish the plugin in the current directory to the registry."));
+/**
+* Upload the build output to the edge registry via the authenticated edge client.
+* The edge gates `/registry/upload` on the caller's hub identity (verifiable
+* presentation; bypassed for local dev). Release integrity is anchored by the
+* signed record's `manifestHash`, not the transport. Returns the canonical
+* `moduleUrl` (the hosted `manifest.json`), targeting the client's configured edge.
+*/
+var uploadBundle = ({ client, key, version, outdir, auth = true }) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const entries = yield* fs.readDirectory(outdir, { recursive: true });
+	const files = [];
+	for (const entry of entries) {
+		const full = path.join(outdir, entry);
+		if ((yield* fs.stat(full)).type !== "File") continue;
+		const bytes = yield* fs.readFile(full);
+		files.push({
+			path: entry.split(path.sep).join("/"),
+			content: Buffer.from(bytes).toString("base64")
+		});
+	}
+	const { moduleUrl } = yield* Effect.tryPromise(() => client.edge.http.uploadPluginBundle(Context.default(void 0, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file,
+		L: 238
+	}), {
+		slug: key,
+		version,
+		files
+	}, { auth }));
+	return moduleUrl;
+});
+/**
+* Upload using a standalone EdgeHttpClient (no DXOS profile required).
+* Auth is skipped — the server must have WORKER_ENV=dev to accept unauthenticated uploads.
+*/
+var uploadBundleDirect = ({ http, key, version, outdir }) => Effect.gen(function* () {
+	const fs = yield* FileSystem.FileSystem;
+	const path = yield* Path.Path;
+	const entries = yield* fs.readDirectory(outdir, { recursive: true });
+	const files = [];
+	for (const entry of entries) {
+		const full = path.join(outdir, entry);
+		if ((yield* fs.stat(full)).type !== "File") continue;
+		const bytes = yield* fs.readFile(full);
+		files.push({
+			path: entry.split(path.sep).join("/"),
+			content: Buffer.from(bytes).toString("base64")
+		});
+	}
+	const { moduleUrl } = yield* Effect.tryPromise(() => http.uploadPluginBundle(Context.default(void 0, {
+		"~LogMeta": "~LogMeta",
+		F: __dxlog_file,
+		L: 275
+	}), {
+		slug: key,
+		version,
+		files
+	}, { auth: false }));
+	return moduleUrl;
+});
+//#endregion
+//#region src/commands/registry/publish-package.ts
+/**
+* `dx registry publish-package` — publishes both the mutable
+* `plugin.profile` (rkey = key) and a `plugin.release`
+* (rkey = `<key>:<version>`) record to the authenticated user's PDS.
+*
+* The two writes are independent `putRecord` (upsert) calls; if the second fails the
+* first is left in place (the indexer treats a profile with no releases as
+* present-but-unpublishable, so a half-success is benign). Releases are conceptually
+* single-write per version but not enforced — see docs/registry-spec.md (Integrity).
+*/
+var publishPackage = Command.make("publish-package", {
+	handle: Options.text("handle").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options.optional),
+	appPassword: Options.text("app-password").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options.optional),
+	key: Options.text("key").pipe(Options.withDescription("Plugin key — a reverse-domain NSID (e.g. org.dxos.plugin.excalidraw); also the profile record rkey.")),
+	name: Options.text("name").pipe(Options.withDescription("Human-readable package name.")),
+	description: Options.text("description").pipe(Options.withDescription("Short description shown in the registry."), Options.withDefault("")),
+	version: Options.text("version").pipe(Options.withDescription("Semver version (no build metadata). The release rkey is `<key>:<version>`.")),
+	moduleUrl: Options.text("module-url").pipe(Options.withDescription("HTTPS URL to the bundle or manifest for this release.")),
+	homepage: Options.text("homepage").pipe(Options.withDescription("Homepage URL."), Options.optional),
+	source: Options.text("source").pipe(Options.withDescription("Source repository URL."), Options.optional),
+	tag: Options.text("tag").pipe(Options.withDescription("Tag (repeatable). Categorizes the package for discovery."), Options.repeated),
+	iconKey: Options.text("icon-key").pipe(Options.withDescription("Icon identifier (e.g. ph--sparkle--regular) resolvable by @ch-ui/icons."), Options.optional),
+	iconHue: Options.text("icon-hue").pipe(Options.withDescription("Icon palette hue (e.g. blue)."), Options.optional),
+	manifestHash: Options.text("manifest-hash").pipe(Options.withDescription("Optional content hash for the bundle/manifest."), Options.optional)
+}, (options) => Function.pipe(Effect.gen(function* () {
+	const client = yield* ClientService;
+	const session = yield* resolveSession({
+		handle: Option.getOrUndefined(options.handle),
+		appPassword: Option.getOrUndefined(options.appPassword),
+		client
+	});
+	const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+	const homepage = Option.getOrUndefined(options.homepage);
+	const source = Option.getOrUndefined(options.source);
+	const iconKey = Option.getOrUndefined(options.iconKey);
+	const iconHue = Option.getOrUndefined(options.iconHue);
+	const icon = iconKey !== void 0 ? {
+		key: iconKey,
+		...iconHue !== void 0 && { hue: iconHue }
+	} : void 0;
+	const profile = {
+		key: options.key,
+		name: options.name,
+		...options.description.length > 0 && { description: options.description },
+		...homepage !== void 0 && { homePage: homepage },
+		...source !== void 0 && { source },
+		...options.tag.length > 0 && { tags: options.tag },
+		...icon !== void 0 && { icon },
+		createdAt
+	};
+	const profileResult = yield* putRecord(session, NSID.PluginProfile, options.key, profile);
+	yield* Console.log(`Profile  ${profileResult.uri}`);
+	const manifestHash = Option.getOrUndefined(options.manifestHash);
+	const release = {
+		pluginKey: options.key,
+		version: options.version,
+		moduleUrl: options.moduleUrl,
+		createdAt,
+		...manifestHash !== void 0 && { manifestHash }
+	};
+	const releaseResult = yield* putRecord(session, NSID.PluginRelease, `${options.key}:${options.version}`, release);
+	yield* Console.log(`Release  ${releaseResult.uri}`);
+}), Effect.provide(FetchHttpClient.layer))).pipe(Command.withDescription("Publish a package profile + release to the authenticated user's PDS."));
+//#endregion
+//#region src/commands/registry/publish-publisher.ts
+/**
+* `dx registry publish-publisher` — publishes the authenticated user's own
+* `org.dxos.experimental.publisher.profile` record (rkey = `self`).
+*
+* This is metadata about the publisher (the human/org), shown alongside their
+* packages once a verifier has attested to their identity.
+*/
+var publishPublisher = Command.make("publish-publisher", {
+	handle: Options.text("handle").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options.optional),
+	appPassword: Options.text("app-password").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options.optional),
+	displayName: Options.text("display-name").pipe(Options.withDescription("Publisher display name (the human/org name shown in UIs).")),
+	bio: Options.text("bio").pipe(Options.withDescription("Short bio."), Options.optional),
+	homepageUrl: Options.text("homepage-url").pipe(Options.withDescription("Publisher homepage URL."), Options.optional),
+	contact: Options.text("contact").pipe(Options.withDescription("Contact (email, handle, etc.)."), Options.optional)
+}, (options) => Function.pipe(Effect.gen(function* () {
+	const client = yield* ClientService;
+	const session = yield* resolveSession({
+		handle: Option.getOrUndefined(options.handle),
+		appPassword: Option.getOrUndefined(options.appPassword),
+		client
+	});
+	const record = { displayName: options.displayName };
+	const bio = Option.getOrUndefined(options.bio);
+	if (bio !== void 0) record.bio = bio;
+	const homepageUrl = Option.getOrUndefined(options.homepageUrl);
+	if (homepageUrl !== void 0) record.homepageUrl = homepageUrl;
+	const contact = Option.getOrUndefined(options.contact);
+	if (contact !== void 0) record.contact = contact;
+	const result = yield* putRecord(session, NSID.PublisherProfile, "self", record);
+	yield* Console.log(`Publisher ${result.uri}`);
+}), Effect.provide(FetchHttpClient.layer))).pipe(Command.withDescription("Publish the authenticated user's publisher.profile record (rkey = self)."));
+//#endregion
+//#region src/commands/registry/records.ts
+/**
+* `dx registry records` — lists all `org.dxos.experimental.*` records on the
+* authenticated user's repo. Useful for double-checking what's been published
+* and what the registry indexer is about to ingest.
+*/
+var records = Command.make("records", {
+	handle: Options.text("handle").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options.optional),
+	appPassword: Options.text("app-password").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options.optional)
+}, (options) => Function.pipe(Effect.gen(function* () {
+	const { json } = yield* CommandConfig;
+	const client = yield* ClientService;
+	const session = yield* resolveSession({
+		handle: Option.getOrUndefined(options.handle),
+		appPassword: Option.getOrUndefined(options.appPassword),
+		client
+	});
+	const results = yield* Effect.all(ALL_NSIDS.map((collection) => listRecords(session, collection).pipe(Effect.map(({ records: entries }) => ({
+		collection,
+		records: entries
+	})), Effect.catchAll(() => Effect.succeed({
+		collection,
+		records: []
+	})))), { concurrency: "unbounded" });
+	if (json) {
+		yield* Console.log(JSON.stringify({
+			did: session.did,
+			results
+		}, null, 2));
+		return;
+	}
+	yield* Console.log(`Repo: ${session.did} (${session.handle})`);
+	for (const { collection, records: entries } of results) {
+		yield* Console.log(`\n${collection} (${entries.length})`);
+		for (const entry of entries) yield* Console.log(`  ${entry.uri}`);
+	}
+}), Effect.provide(FetchHttpClient.layer))).pipe(Command.withDescription("List org.dxos.experimental.* records on the authenticated user's repo."));
+//#endregion
+//#region src/commands/registry/unpublish.ts
+var rkeyOf = (uri) => uri.split("/").pop() ?? "";
+/**
+* `dx registry unpublish` — removes a plugin from the authenticated user's PDS:
+* deletes the `plugin.profile` (rkey = key) and every `plugin.release`
+* (rkey = `<key>:<version>`). The registry indexer unindexes on its next sweep.
+* Hosted bundles in edge R2 are immutable and are not removed.
+*/
+var unpublish = Command.make("unpublish", {
+	handle: Options.text("handle").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options.optional),
+	appPassword: Options.text("app-password").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options.optional),
+	key: Options.text("key").pipe(Options.withDescription("Plugin key (the profile rkey). Removes its profile and all releases."))
+}, (options) => Function.pipe(Effect.gen(function* () {
+	const client = yield* ClientService;
+	const session = yield* resolveSession({
+		handle: Option.getOrUndefined(options.handle),
+		appPassword: Option.getOrUndefined(options.appPassword),
+		client
+	});
+	const key = options.key;
+	let cursor;
+	let deletedReleases = 0;
+	do {
+		const releases = yield* listRecords(session, NSID.PluginRelease, {
+			limit: 100,
+			cursor
+		});
+		cursor = releases.cursor;
+		for (const record of releases.records) {
+			const rkey = rkeyOf(record.uri);
+			if (rkey.startsWith(`${key}:`)) {
+				yield* deleteRecord(session, NSID.PluginRelease, rkey);
+				yield* Console.log(`Deleted release ${rkey}`);
+				deletedReleases += 1;
+			}
+		}
+	} while (cursor !== void 0);
+	yield* deleteRecord(session, NSID.PluginProfile, key);
+	yield* Console.log(`Deleted profile ${key} (${deletedReleases} release(s) removed)`);
+}), Effect.provide(FetchHttpClient.layer))).pipe(Command.withDescription("Remove a package (profile + releases) from the authenticated user's PDS."));
+//#endregion
+//#region src/commands/registry/verify.ts
+/**
+* `dx registry verify` — publishes a `org.dxos.experimental.publisher.verification`
+* record on the authenticated repo, with rkey = subject DID. Subject is given as a
+* handle or DID; handles are resolved through the public XRPC.
+*
+* Verification records are public and anyone may author them. The registry indexer only
+* honors records authored by the configured verifier (`REGISTRY_CURATOR_DID`), so this
+* command only affects discovery when run with that verifier's credentials.
+*/
+var verify = Command.make("verify", {
+	handle: Options.text("handle").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options.optional),
+	appPassword: Options.text("app-password").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options.optional),
+	subject: Options.text("subject").pipe(Options.withDescription("Handle or DID of the publisher being verified.")),
+	subjectHandle: Options.text("subject-handle").pipe(Options.withDescription("Optional human-readable handle to record for the verified subject (defaults to --subject if it is a handle)."), Options.optional),
+	displayName: Options.text("display-name").pipe(Options.withDescription("Display name to record for the verified subject."))
+}, (options) => Function.pipe(Effect.gen(function* () {
+	const client = yield* ClientService;
+	const session = yield* resolveSession({
+		handle: Option.getOrUndefined(options.handle),
+		appPassword: Option.getOrUndefined(options.appPassword),
+		client
+	});
+	const subjectDid = options.subject.startsWith("did:") ? options.subject : yield* resolveHandle(options.subject);
+	const subjectHandle = Option.getOrUndefined(options.subjectHandle) ?? (options.subject.startsWith("did:") ? "" : options.subject);
+	const record = {
+		subject: subjectDid,
+		...subjectHandle ? { handle: subjectHandle } : {},
+		displayName: options.displayName,
+		createdAt: (/* @__PURE__ */ new Date()).toISOString()
+	};
+	const result = yield* putRecord(session, NSID.PublisherVerification, subjectDid, record);
+	yield* Console.log(`Verified ${subjectDid} -> ${result.uri}`);
+}), Effect.provide(FetchHttpClient.layer))).pipe(Command.withDescription("Write a publisher.verification record (indexed only if authored by the configured verifier, REGISTRY_CURATOR_DID)."));
+//#endregion
+//#region src/commands/registry/index.ts
+/**
+* `dx registry *` — commands for publishing and inspecting records that the
+* DXOS plugin registry indexes from AT Protocol. Auth uses an App Password
+* (per-user secret minted at https://bsky.app/settings/app-passwords); OAuth
+* support is a follow-up.
+*
+* - `publish` — config-driven: build from dx.yml, host the bundle, write records.
+* - `publish-package` — low-level: write profile + release records from flags.
+* - `publish-publisher` — write the publisher's own profile record.
+* - `unpublish` — remove a package (profile + releases) from your PDS.
+* - `verify` — write a publisher.verification record (indexed only from the configured verifier).
+* - `records` — list everything the authenticated repo has published under `org.dxos.experimental.*`.
+*/
+var registry = Command.make("registry").pipe(Command.withDescription("Publish to and inspect the AT Protocol-backed DXOS plugin registry."), Command.withSubcommands([
+	publish,
+	publishPackage,
+	publishPublisher,
+	unpublish,
+	verify,
+	records
+]));
+//#endregion
+//#region src/RegistryPlugin.node.ts
+var RegistryPlugin = Plugin.define(meta).pipe(AppPlugin.addCommandModule({ commands: [plugin, registry] }), Plugin.make);
+//#endregion
+export { RegistryPlugin, RegistryPlugin as default };
+
+//# sourceMappingURL=RegistryPlugin.node.mjs.map