@dxos/plugin-registry 0.9.0 → 0.9.1-staging.ee54ba693a

package/dist/lib/neutral/RegistryPlugin.node.mjs

@@ -7,10 +7,10 @@ import { Plugin as Plugin4 } from "@dxos/app-framework";
 import { AppPlugin } from "@dxos/app-toolkit";
 import { meta } from "#meta";
 
-// src/commands/index.ts
+// src/commands/plugin/index.ts
 import * as Command4 from "@effect/cli/Command";
 
-// src/commands/disable.ts
+// src/commands/plugin/disable.ts
 import * as Args from "@effect/cli/Args";
 import * as Command from "@effect/cli/Command";
 import * as Console from "effect/Console";
@@ -18,12 +18,12 @@ import * as Effect from "effect/Effect";
 import { Plugin } from "@dxos/app-framework";
 import { CommandConfig } from "@dxos/cli-util";
 import { invariant } from "@dxos/invariant";
-var __dxlog_file = "/__w/dxos/dxos/packages/plugins/plugin-registry/src/commands/disable.ts";
+var __dxlog_file = "/__w/dxos/dxos/packages/plugins/plugin-registry/src/commands/plugin/disable.ts";
 var handler = Effect.fn(function* ({ id }) {
   const { json, profile } = yield* CommandConfig;
   const manager = yield* Plugin.Service;
   const plugins = manager.getPlugins();
-  const plugin2 = plugins.find((p) => p.meta.id === id);
+  const plugin2 = plugins.find((p) => p.meta.profile.key === id);
   invariant(plugin2, `Plugin not found: ${id}`, { "~LogMeta": "~LogMeta", F: __dxlog_file, L: 17, S: this, A: ["plugin", "`Plugin not found: ${id}`"] });
   const core = manager.getCore();
   invariant(!core.includes(id), `Cannot disable core plugin: ${id}`, { "~LogMeta": "~LogMeta", F: __dxlog_file, L: 19, S: this, A: ["!core.includes(id)", "`Cannot disable core plugin: ${id}`"] });
@@ -42,7 +42,7 @@ var handler = Effect.fn(function* ({ id }) {
       enabled: false
     }, null, 2));
   } else {
-    yield* Console.log(`Plugin "${plugin2.meta.name ?? id}" disabled.`);
+    yield* Console.log(`Plugin "${plugin2.meta.profile.name ?? id}" disabled.`);
   }
 });
 var disable = Command.make("disable", {
@@ -51,7 +51,7 @@ var disable = Command.make("disable", {
   }).pipe(Args.withDescription("The ID of the plugin to disable."))
 }, handler).pipe(Command.withDescription("Disable a plugin."));
 
-// src/commands/enable.ts
+// src/commands/plugin/enable.ts
 import * as Args2 from "@effect/cli/Args";
 import * as Command2 from "@effect/cli/Command";
 import * as Console2 from "effect/Console";
@@ -59,12 +59,12 @@ import * as Effect2 from "effect/Effect";
 import { Plugin as Plugin2 } from "@dxos/app-framework";
 import { CommandConfig as CommandConfig2 } from "@dxos/cli-util";
 import { invariant as invariant2 } from "@dxos/invariant";
-var __dxlog_file2 = "/__w/dxos/dxos/packages/plugins/plugin-registry/src/commands/enable.ts";
+var __dxlog_file2 = "/__w/dxos/dxos/packages/plugins/plugin-registry/src/commands/plugin/enable.ts";
 var handler2 = Effect2.fn(function* ({ id }) {
   const { json, profile } = yield* CommandConfig2;
   const manager = yield* Plugin2.Service;
   const plugins = manager.getPlugins();
-  const plugin2 = plugins.find((p) => p.meta.id === id);
+  const plugin2 = plugins.find((p) => p.meta.profile.key === id);
   invariant2(plugin2, `Plugin not found: ${id}`, { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 17, S: this, A: ["plugin", "`Plugin not found: ${id}`"] });
   const enabled = yield* manager.enable(id);
   invariant2(enabled, `Failed to enable plugin: ${id}`, { "~LogMeta": "~LogMeta", F: __dxlog_file2, L: 19, S: this, A: ["enabled", "`Failed to enable plugin: ${id}`"] });
@@ -81,7 +81,7 @@ var handler2 = Effect2.fn(function* ({ id }) {
       enabled: true
     }, null, 2));
   } else {
-    yield* Console2.log(`Plugin "${plugin2.meta.name ?? id}" enabled.`);
+    yield* Console2.log(`Plugin "${plugin2.meta.profile.name ?? id}" enabled.`);
   }
 });
 var enable = Command2.make("enable", {
@@ -90,14 +90,14 @@ var enable = Command2.make("enable", {
   }).pipe(Args2.withDescription("The ID of the plugin to enable."))
 }, handler2).pipe(Command2.withDescription("Enable a plugin."));
 
-// src/commands/list.ts
+// src/commands/plugin/list.ts
 import * as Command3 from "@effect/cli/Command";
 import * as Console3 from "effect/Console";
 import * as Effect3 from "effect/Effect";
 import { Plugin as Plugin3 } from "@dxos/app-framework";
 import { CommandConfig as CommandConfig3, printList } from "@dxos/cli-util";
 
-// src/commands/util.ts
+// src/commands/plugin/util.ts
 import { FormBuilder } from "@dxos/cli-util";
 var printPlugin = (plugin2) => {
   const status = plugin2.core ? "core" : plugin2.enabled ? "enabled" : "disabled";
@@ -106,7 +106,7 @@ var printPlugin = (plugin2) => {
   }).pipe(FormBuilder.set("id", plugin2.id), FormBuilder.set("status", status), FormBuilder.build);
 };
 
-// src/commands/list.ts
+// src/commands/plugin/list.ts
 var handler3 = Effect3.fn(function* () {
   const { json } = yield* CommandConfig3;
   const manager = yield* Plugin3.Service;
@@ -114,11 +114,11 @@ var handler3 = Effect3.fn(function* () {
   const enabled = manager.getEnabled();
   const core = manager.getCore();
   const formattedPlugins = plugins.map((plugin2) => {
-    const isEnabled = enabled.includes(plugin2.meta.id);
-    const isCore = core.includes(plugin2.meta.id);
+    const isEnabled = enabled.includes(plugin2.meta.profile.key);
+    const isCore = core.includes(plugin2.meta.profile.key);
     return {
-      id: plugin2.meta.id,
-      name: plugin2.meta.name ?? plugin2.meta.id,
+      id: plugin2.meta.profile.key,
+      name: plugin2.meta.profile.name ?? plugin2.meta.profile.key,
       enabled: isEnabled,
       core: isCore
     };
@@ -132,17 +132,708 @@ var handler3 = Effect3.fn(function* () {
 });
 var list = Command3.make("list", {}, handler3).pipe(Command3.withDescription("List all available plugins."));
 
-// src/commands/index.ts
+// src/commands/plugin/index.ts
 var plugin = Command4.make("plugin").pipe(Command4.withDescription("Manage plugins."), Command4.withSubcommands([
   enable,
   disable,
   list
 ]));
 
+// src/commands/registry/index.ts
+import * as Command11 from "@effect/cli/Command";
+
+// src/commands/registry/publish.ts
+import * as Command5 from "@effect/cli/Command";
+import * as Options from "@effect/cli/Options";
+import * as PlatformCommand from "@effect/platform/Command";
+import * as FetchHttpClient from "@effect/platform/FetchHttpClient";
+import * as FileSystem from "@effect/platform/FileSystem";
+import * as Path from "@effect/platform/Path";
+import * as Console4 from "effect/Console";
+import * as Effect5 from "effect/Effect";
+import * as Function from "effect/Function";
+import * as Option2 from "effect/Option";
+import * as Schema2 from "effect/Schema";
+import { findDxConfigFile, loadDxConfig } from "@dxos/app-framework/vite-plugin";
+import { ClientService } from "@dxos/client";
+import { Context } from "@dxos/context";
+import { EdgeHttpClient } from "@dxos/edge-client";
+import { Config2 } from "@dxos/protocols";
+
+// src/commands/registry/util.ts
+import * as HttpClient from "@effect/platform/HttpClient";
+import * as HttpClientRequest from "@effect/platform/HttpClientRequest";
+import * as Config from "effect/Config";
+import * as Effect4 from "effect/Effect";
+import * as Option from "effect/Option";
+import * as Schema from "effect/Schema";
+import { AppSpace } from "@dxos/app-toolkit";
+import { Filter } from "@dxos/echo";
+import { ALL_NSIDS, NSID } from "@dxos/protocols";
+import { AccessToken } from "@dxos/types";
+var ATMOSPHERE_SOURCE = "atproto.local";
+var BSKY_PUBLIC_API = "https://public.api.bsky.app/xrpc";
+var PLC_DIRECTORY = "https://plc.directory";
+var CreateSessionResponseSchema = Schema.Struct({
+  did: Schema.String,
+  handle: Schema.String,
+  accessJwt: Schema.String,
+  refreshJwt: Schema.String
+});
+var ResolveHandleResponseSchema = Schema.Struct({
+  did: Schema.String
+});
+var DidServiceSchema = Schema.Struct({
+  id: Schema.String,
+  type: Schema.optional(Schema.String),
+  serviceEndpoint: Schema.Unknown
+});
+var DidDocumentSchema = Schema.Struct({
+  service: Schema.optional(Schema.Array(DidServiceSchema))
+});
+var PutRecordResponseSchema = Schema.Struct({
+  uri: Schema.String,
+  cid: Schema.String
+});
+var ListRecordsEntrySchema = Schema.Struct({
+  uri: Schema.String,
+  cid: Schema.String,
+  value: Schema.Unknown
+});
+var ListRecordsResponseSchema = Schema.Struct({
+  cursor: Schema.optional(Schema.String),
+  records: Schema.Array(ListRecordsEntrySchema)
+});
+var decodeJson = (schema) => (response) => Effect4.flatMap(response.json, Schema.decodeUnknown(schema));
+var xrpcGet = (url, query, schema) => Effect4.gen(function* () {
+  const client = yield* HttpClient.HttpClient;
+  return yield* HttpClientRequest.get(url).pipe(HttpClientRequest.setUrlParams(query), client.execute, Effect4.flatMap(decodeJson(schema)), Effect4.scoped);
+});
+var xrpcPost = (url, body, schema, headers = {}) => Effect4.gen(function* () {
+  const client = yield* HttpClient.HttpClient;
+  const response = yield* HttpClientRequest.post(url).pipe(HttpClientRequest.setHeaders(headers), HttpClientRequest.bodyJson(body), Effect4.flatMap((req) => client.execute(req)), Effect4.scoped);
+  if (schema === void 0) {
+    return void 0;
+  }
+  return yield* decodeJson(schema)(response);
+});
+var resolveHandle = (handle) => xrpcGet(`${BSKY_PUBLIC_API}/com.atproto.identity.resolveHandle`, {
+  handle
+}, ResolveHandleResponseSchema).pipe(Effect4.map((response) => response.did));
+var resolvePds = (did) => Effect4.gen(function* () {
+  let doc;
+  if (did.startsWith("did:plc:")) {
+    doc = yield* xrpcGet(`${PLC_DIRECTORY}/${did}`, {}, DidDocumentSchema);
+  } else if (did.startsWith("did:web:")) {
+    const rest = did.slice("did:web:".length);
+    const [host, ...segments] = rest.split(":").map((part) => decodeURIComponent(part));
+    const path = segments.length > 0 ? `/${segments.join("/")}/did.json` : "/.well-known/did.json";
+    doc = yield* xrpcGet(`https://${host}${path}`, {}, DidDocumentSchema);
+  } else {
+    return yield* Effect4.fail(new Error(`Unsupported DID method: ${did}`));
+  }
+  const service = doc.service?.find((entry) => entry.id === "#atproto_pds" || entry.type === "AtprotoPersonalDataServer");
+  const endpoint = service?.serviceEndpoint;
+  if (typeof endpoint !== "string" || endpoint.length === 0) {
+    return yield* Effect4.fail(new Error(`PDS endpoint missing in DID document for ${did}`));
+  }
+  return endpoint;
+});
+var resolveRepo = (handleOrDid) => Effect4.gen(function* () {
+  const did = handleOrDid.startsWith("did:") ? handleOrDid : yield* resolveHandle(handleOrDid);
+  const pdsBaseUrl = yield* resolvePds(did);
+  return {
+    did,
+    pdsBaseUrl
+  };
+});
+var createSession = (handle, appPassword) => Effect4.gen(function* () {
+  const { did, pdsBaseUrl } = yield* resolveRepo(handle);
+  const response = yield* xrpcPost(`${pdsBaseUrl}/xrpc/com.atproto.server.createSession`, {
+    identifier: handle,
+    password: appPassword
+  }, CreateSessionResponseSchema);
+  return {
+    mode: "app-password",
+    did: response.did,
+    handle: response.handle,
+    accessJwt: response.accessJwt,
+    pdsBaseUrl
+  };
+});
+var resolveSession = (options) => Effect4.gen(function* () {
+  const handle = options.handle ?? Option.getOrUndefined(yield* Config.option(Config.string("ATPROTO_HANDLE")));
+  const appPassword = options.appPassword ?? Option.getOrUndefined(yield* Config.option(Config.string("ATPROTO_APP_PASSWORD")));
+  if (handle && appPassword) {
+    return yield* createSession(handle, appPassword);
+  }
+  const fromPersonalSpace = yield* resolvePersonalSpaceSession(options.client);
+  if (fromPersonalSpace) {
+    return fromPersonalSpace;
+  }
+  if (options.client.halo.identity.get()) {
+    return yield* Effect4.fail(new Error("No atproto integration connected. Connect one with `dx integration add`, or pass --handle/--app-password. (`dx account login` cannot add an integration to an existing identity.)"));
+  }
+  return yield* Effect4.fail(new Error("No DXOS identity. Run `dx account login` first, or pass --handle/--app-password."));
+});
+var resolvePersonalSpaceSession = (client) => Effect4.gen(function* () {
+  const space = AppSpace.getPersonalSpace(client);
+  if (!space) {
+    return void 0;
+  }
+  const tokens = yield* Effect4.promise(() => space.db.query(Filter.type(AccessToken.AccessToken)).run());
+  const token = tokens.find((object) => object.source === ATMOSPHERE_SOURCE && !!object.account && !!object.token);
+  if (!token?.account) {
+    return void 0;
+  }
+  const { did, pdsBaseUrl } = yield* resolveRepo(token.account);
+  return {
+    mode: "dpop-proxy",
+    did,
+    handle: token.account,
+    pdsBaseUrl,
+    edgeBaseUrl: client.edge.http.baseUrl,
+    spaceId: space.id,
+    accessTokenId: token.id,
+    token: token.token,
+    // Best-effort VP auth header for the proxy. The `/atproto/proxy` route currently skips auth
+    // in dev; production reads the caller's verifiable presentation when present.
+    authHeader: client.edge.http._authHeader
+  };
+});
+var proxyCall = (session, params, schema) => {
+  const query = params.query ? `?${new URLSearchParams(params.query).toString()}` : "";
+  const innerHeaders = {
+    Accept: "application/json",
+    Authorization: `DPoP ${session.token}`
+  };
+  if (params.jsonBody) {
+    innerHeaders["Content-Type"] = "application/json";
+  }
+  const outerHeaders = {};
+  if (session.authHeader) {
+    outerHeaders.Authorization = session.authHeader;
+  }
+  return xrpcPost(`${session.edgeBaseUrl.replace(/\/$/, "")}/atproto/proxy`, {
+    spaceId: session.spaceId,
+    accessTokenId: session.accessTokenId,
+    request: {
+      endpoint: `${session.pdsBaseUrl}/xrpc/${params.xrpcMethod}${query}`,
+      method: params.method,
+      headers: innerHeaders,
+      // Edge's proxy forwards the body to `fetch` as-is, so it must be a pre-serialized string.
+      body: params.jsonBody ? JSON.stringify(params.jsonBody) : null
+    }
+  }, schema, outerHeaders);
+};
+var putRecord = (session, collection, rkey, record) => {
+  const body = {
+    repo: session.did,
+    collection,
+    rkey,
+    record: {
+      $type: collection,
+      ...record
+    }
+  };
+  return session.mode === "app-password" ? xrpcPost(`${session.pdsBaseUrl}/xrpc/com.atproto.repo.putRecord`, body, PutRecordResponseSchema, {
+    Authorization: `Bearer ${session.accessJwt}`
+  }) : proxyCall(session, {
+    xrpcMethod: "com.atproto.repo.putRecord",
+    method: "POST",
+    jsonBody: body
+  }, PutRecordResponseSchema);
+};
+var deleteRecord = (session, collection, rkey) => {
+  const body = {
+    repo: session.did,
+    collection,
+    rkey
+  };
+  return session.mode === "app-password" ? xrpcPost(`${session.pdsBaseUrl}/xrpc/com.atproto.repo.deleteRecord`, body, void 0, {
+    Authorization: `Bearer ${session.accessJwt}`
+  }) : proxyCall(session, {
+    xrpcMethod: "com.atproto.repo.deleteRecord",
+    method: "POST",
+    jsonBody: body
+  }, void 0);
+};
+var listRecords = (session, collection, options = {}) => {
+  const query = {
+    repo: session.did,
+    collection,
+    ...options.limit !== void 0 ? {
+      limit: String(options.limit)
+    } : {},
+    ...options.cursor !== void 0 ? {
+      cursor: options.cursor
+    } : {}
+  };
+  return session.mode === "app-password" ? xrpcGet(`${session.pdsBaseUrl}/xrpc/com.atproto.repo.listRecords`, query, ListRecordsResponseSchema) : proxyCall(session, {
+    xrpcMethod: "com.atproto.repo.listRecords",
+    method: "GET",
+    query
+  }, ListRecordsResponseSchema);
+};
+var AUTH_OPTION_DESCRIPTIONS = {
+  handle: "AT Protocol handle (e.g. alice.bsky.social). Defaults to the logged-in identity; falls back to $ATPROTO_HANDLE.",
+  appPassword: "AT Protocol app password (https://bsky.app/settings/app-passwords). Falls back to $ATPROTO_APP_PASSWORD. Not needed when logged in via `dx account login`."
+};
+
+// src/commands/registry/publish.ts
+var __dxlog_file3 = "/__w/dxos/dxos/packages/plugins/plugin-registry/src/commands/registry/publish.ts";
+var ManifestSchema = Schema2.Struct({
+  ...Config2.Plugin.fields,
+  version: Schema2.String.pipe(Schema2.nonEmptyString()),
+  dependencies: Schema2.optional(Schema2.Record({
+    key: Schema2.String,
+    value: Schema2.String
+  }))
+});
+var ensureTrailingSlash = (url) => url.endsWith("/") ? url : `${url}/`;
+var sha256Base64 = async (bytes) => {
+  const digest = await globalThis.crypto.subtle.digest("SHA-256", bytes);
+  return Buffer.from(new Uint8Array(digest)).toString("base64");
+};
+var publish = Command5.make("publish", {
+  handle: Options.text("handle").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options.optional),
+  appPassword: Options.text("app-password").pipe(Options.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options.optional),
+  dir: Options.text("dir").pipe(Options.withDescription("Project directory containing dx.config.ts. Defaults to the current directory."), Options.withDefault(".")),
+  noBuild: Options.boolean("no-build").pipe(Options.withDescription("Skip running the build command (publish a pre-built dist).")),
+  assetBaseUrl: Options.text("asset-base-url").pipe(Options.withDescription("Skip upload and point the release at an already-hosted bundle directory."), Options.optional),
+  edgeUrl: Options.text("edge-url").pipe(Options.withDescription("Edge base URL for bundle upload (e.g. http://localhost:8787). Bypasses profile config; auth is skipped (requires WORKER_ENV=dev on the server)."), Options.optional)
+}, (options) => Function.pipe(Effect5.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const dir = path.resolve(options.dir);
+  const configFile = findDxConfigFile(dir);
+  if (!configFile) {
+    return yield* Effect5.fail(new Error(`No dx.config.ts found in ${dir}.`));
+  }
+  const config = yield* Effect5.tryPromise({
+    try: () => loadDxConfig(configFile),
+    catch: (error) => new Error(`Failed to load dx.config.ts in ${dir}: ${error}`)
+  });
+  const buildCommand = config.publish?.buildCommand;
+  if (!options.noBuild && buildCommand) {
+    yield* Console4.log(`Building: ${buildCommand}`);
+    const binDir = path.join(dir, "node_modules", ".bin");
+    const exitCode2 = yield* PlatformCommand.make("sh", "-c", `export PATH="${binDir}:$PATH"; ${buildCommand}`).pipe(PlatformCommand.workingDirectory(dir), PlatformCommand.stdout("inherit"), PlatformCommand.stderr("inherit"), PlatformCommand.exitCode);
+    if (exitCode2 !== 0) {
+      return yield* Effect5.fail(new Error(`Build failed (exit ${exitCode2}): ${buildCommand}`));
+    }
+  }
+  const outdir = path.join(dir, config.publish?.outputDirectory ?? "dist");
+  const manifestPath = path.join(outdir, "manifest.json");
+  if (!(yield* fs.exists(manifestPath))) {
+    return yield* Effect5.fail(new Error(`manifest.json not found in ${outdir}. Did the build run?`));
+  }
+  const manifestRaw = yield* fs.readFileString(manifestPath);
+  const manifest = yield* Schema2.decodeUnknown(ManifestSchema)(JSON.parse(manifestRaw));
+  const key = manifest.key;
+  const version = manifest.version;
+  const manifestHash = `sha256-${yield* Effect5.promise(() => sha256Base64(new TextEncoder().encode(manifestRaw)))}`;
+  const assetBaseUrl = Option2.getOrUndefined(options.assetBaseUrl) ?? config.publish?.assetBaseUrl;
+  let moduleUrl;
+  if (assetBaseUrl) {
+    moduleUrl = new URL("manifest.json", ensureTrailingSlash(assetBaseUrl)).toString();
+    yield* Console4.log(`Self-hosted: ${moduleUrl}`);
+  } else {
+    const explicitEdgeUrl = Option2.getOrUndefined(options.edgeUrl);
+    if (explicitEdgeUrl) {
+      const http = new EdgeHttpClient(explicitEdgeUrl);
+      moduleUrl = yield* uploadBundleDirect({
+        http,
+        key,
+        version,
+        outdir
+      });
+    } else {
+      const client2 = yield* ClientService;
+      const hasIdentity = !!client2.halo.identity.get();
+      moduleUrl = yield* uploadBundle({
+        client: client2,
+        key,
+        version,
+        outdir,
+        auth: hasIdentity
+      });
+    }
+    yield* Console4.log(`Uploaded:  ${moduleUrl}`);
+  }
+  const client = yield* ClientService;
+  const session = yield* resolveSession({
+    handle: Option2.getOrUndefined(options.handle),
+    appPassword: Option2.getOrUndefined(options.appPassword),
+    client
+  });
+  const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+  const profile = {
+    key,
+    name: manifest.name,
+    createdAt
+  };
+  if (manifest.description !== void 0) {
+    profile.description = manifest.description;
+  }
+  if (manifest.homePage !== void 0) {
+    profile.homePage = manifest.homePage;
+  }
+  if (manifest.source !== void 0) {
+    profile.source = manifest.source;
+  }
+  if (manifest.icon !== void 0) {
+    profile.icon = manifest.icon;
+  }
+  if (manifest.tags && manifest.tags.length > 0) {
+    profile.tags = manifest.tags;
+  }
+  if (manifest.screenshots && manifest.screenshots.length > 0) {
+    profile.screenshots = manifest.screenshots;
+  }
+  if (manifest.dependsOn?.length) {
+    profile.dependsOn = manifest.dependsOn;
+  }
+  if (manifest.spec !== void 0) {
+    profile.spec = manifest.spec;
+  }
+  const profileResult = yield* putRecord(session, NSID.PluginProfile, key, profile);
+  yield* Console4.log(`Profile    ${profileResult.uri}`);
+  const releaseResult = yield* putRecord(session, NSID.PluginRelease, `${key}:${version}`, {
+    pluginKey: key,
+    version,
+    moduleUrl,
+    manifestHash,
+    createdAt,
+    ...manifest.dependencies ? {
+      dependencies: manifest.dependencies
+    } : {}
+  });
+  yield* Console4.log(`Release    ${releaseResult.uri}`);
+}), Effect5.provide(FetchHttpClient.layer))).pipe(Command5.withDescription("Build, host, and publish the plugin in the current directory to the registry."));
+var uploadBundle = ({ client, key, version, outdir, auth = true }) => Effect5.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const entries = yield* fs.readDirectory(outdir, {
+    recursive: true
+  });
+  const files = [];
+  for (const entry of entries) {
+    const full = path.join(outdir, entry);
+    const info = yield* fs.stat(full);
+    if (info.type !== "File") {
+      continue;
+    }
+    const bytes = yield* fs.readFile(full);
+    files.push({
+      path: entry.split(path.sep).join("/"),
+      content: Buffer.from(bytes).toString("base64")
+    });
+  }
+  const { moduleUrl } = yield* Effect5.tryPromise(() => client.edge.http.uploadPluginBundle(Context.default(void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 194 }), {
+    slug: key,
+    version,
+    files
+  }, {
+    auth
+  }));
+  return moduleUrl;
+});
+var uploadBundleDirect = ({ http, key, version, outdir }) => Effect5.gen(function* () {
+  const fs = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const entries = yield* fs.readDirectory(outdir, {
+    recursive: true
+  });
+  const files = [];
+  for (const entry of entries) {
+    const full = path.join(outdir, entry);
+    const info = yield* fs.stat(full);
+    if (info.type !== "File") {
+      continue;
+    }
+    const bytes = yield* fs.readFile(full);
+    files.push({
+      path: entry.split(path.sep).join("/"),
+      content: Buffer.from(bytes).toString("base64")
+    });
+  }
+  const { moduleUrl } = yield* Effect5.tryPromise(() => http.uploadPluginBundle(Context.default(void 0, { "~LogMeta": "~LogMeta", F: __dxlog_file3, L: 225 }), {
+    slug: key,
+    version,
+    files
+  }, {
+    auth: false
+  }));
+  return moduleUrl;
+});
+
+// src/commands/registry/publish-package.ts
+import * as Command6 from "@effect/cli/Command";
+import * as Options2 from "@effect/cli/Options";
+import * as FetchHttpClient2 from "@effect/platform/FetchHttpClient";
+import * as Console5 from "effect/Console";
+import * as Effect6 from "effect/Effect";
+import * as Function2 from "effect/Function";
+import * as Option3 from "effect/Option";
+import { ClientService as ClientService2 } from "@dxos/client";
+var publishPackage = Command6.make("publish-package", {
+  handle: Options2.text("handle").pipe(Options2.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options2.optional),
+  appPassword: Options2.text("app-password").pipe(Options2.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options2.optional),
+  key: Options2.text("key").pipe(Options2.withDescription("Plugin key \u2014 a reverse-domain NSID (e.g. org.dxos.plugin.excalidraw); also the profile record rkey.")),
+  name: Options2.text("name").pipe(Options2.withDescription("Human-readable package name.")),
+  description: Options2.text("description").pipe(Options2.withDescription("Short description shown in the registry."), Options2.withDefault("")),
+  version: Options2.text("version").pipe(Options2.withDescription("Semver version (no build metadata). The release rkey is `<key>:<version>`.")),
+  moduleUrl: Options2.text("module-url").pipe(Options2.withDescription("HTTPS URL to the bundle or manifest for this release.")),
+  homepage: Options2.text("homepage").pipe(Options2.withDescription("Homepage URL."), Options2.optional),
+  source: Options2.text("source").pipe(Options2.withDescription("Source repository URL."), Options2.optional),
+  tag: Options2.text("tag").pipe(Options2.withDescription("Tag (repeatable). Categorizes the package for discovery."), Options2.repeated),
+  iconKey: Options2.text("icon-key").pipe(Options2.withDescription("Icon identifier (e.g. ph--sparkle--regular) resolvable by @ch-ui/icons."), Options2.optional),
+  iconHue: Options2.text("icon-hue").pipe(Options2.withDescription("Icon palette hue (e.g. blue)."), Options2.optional),
+  manifestHash: Options2.text("manifest-hash").pipe(Options2.withDescription("Optional content hash for the bundle/manifest."), Options2.optional)
+}, (options) => Function2.pipe(Effect6.gen(function* () {
+  const client = yield* ClientService2;
+  const session = yield* resolveSession({
+    handle: Option3.getOrUndefined(options.handle),
+    appPassword: Option3.getOrUndefined(options.appPassword),
+    client
+  });
+  const createdAt = (/* @__PURE__ */ new Date()).toISOString();
+  const homepage = Option3.getOrUndefined(options.homepage);
+  const source = Option3.getOrUndefined(options.source);
+  const iconKey = Option3.getOrUndefined(options.iconKey);
+  const iconHue = Option3.getOrUndefined(options.iconHue);
+  const icon = iconKey !== void 0 ? {
+    key: iconKey,
+    ...iconHue !== void 0 && {
+      hue: iconHue
+    }
+  } : void 0;
+  const profile = {
+    key: options.key,
+    name: options.name,
+    ...options.description.length > 0 && {
+      description: options.description
+    },
+    ...homepage !== void 0 && {
+      homePage: homepage
+    },
+    ...source !== void 0 && {
+      source
+    },
+    ...options.tag.length > 0 && {
+      tags: options.tag
+    },
+    ...icon !== void 0 && {
+      icon
+    },
+    createdAt
+  };
+  const profileResult = yield* putRecord(session, NSID.PluginProfile, options.key, profile);
+  yield* Console5.log(`Profile  ${profileResult.uri}`);
+  const manifestHash = Option3.getOrUndefined(options.manifestHash);
+  const release = {
+    pluginKey: options.key,
+    version: options.version,
+    moduleUrl: options.moduleUrl,
+    createdAt,
+    ...manifestHash !== void 0 && {
+      manifestHash
+    }
+  };
+  const releaseResult = yield* putRecord(session, NSID.PluginRelease, `${options.key}:${options.version}`, release);
+  yield* Console5.log(`Release  ${releaseResult.uri}`);
+}), Effect6.provide(FetchHttpClient2.layer))).pipe(Command6.withDescription("Publish a package profile + release to the authenticated user's PDS."));
+
+// src/commands/registry/publish-publisher.ts
+import * as Command7 from "@effect/cli/Command";
+import * as Options3 from "@effect/cli/Options";
+import * as FetchHttpClient3 from "@effect/platform/FetchHttpClient";
+import * as Console6 from "effect/Console";
+import * as Effect7 from "effect/Effect";
+import * as Function3 from "effect/Function";
+import * as Option4 from "effect/Option";
+import { ClientService as ClientService3 } from "@dxos/client";
+var publishPublisher = Command7.make("publish-publisher", {
+  handle: Options3.text("handle").pipe(Options3.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options3.optional),
+  appPassword: Options3.text("app-password").pipe(Options3.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options3.optional),
+  displayName: Options3.text("display-name").pipe(Options3.withDescription("Publisher display name (the human/org name shown in UIs).")),
+  bio: Options3.text("bio").pipe(Options3.withDescription("Short bio."), Options3.optional),
+  homepageUrl: Options3.text("homepage-url").pipe(Options3.withDescription("Publisher homepage URL."), Options3.optional),
+  contact: Options3.text("contact").pipe(Options3.withDescription("Contact (email, handle, etc.)."), Options3.optional)
+}, (options) => Function3.pipe(Effect7.gen(function* () {
+  const client = yield* ClientService3;
+  const session = yield* resolveSession({
+    handle: Option4.getOrUndefined(options.handle),
+    appPassword: Option4.getOrUndefined(options.appPassword),
+    client
+  });
+  const record = {
+    displayName: options.displayName
+  };
+  const bio = Option4.getOrUndefined(options.bio);
+  if (bio !== void 0) {
+    record.bio = bio;
+  }
+  const homepageUrl = Option4.getOrUndefined(options.homepageUrl);
+  if (homepageUrl !== void 0) {
+    record.homepageUrl = homepageUrl;
+  }
+  const contact = Option4.getOrUndefined(options.contact);
+  if (contact !== void 0) {
+    record.contact = contact;
+  }
+  const result = yield* putRecord(session, NSID.PublisherProfile, "self", record);
+  yield* Console6.log(`Publisher ${result.uri}`);
+}), Effect7.provide(FetchHttpClient3.layer))).pipe(Command7.withDescription("Publish the authenticated user's publisher.profile record (rkey = self)."));
+
+// src/commands/registry/records.ts
+import * as Command8 from "@effect/cli/Command";
+import * as Options4 from "@effect/cli/Options";
+import * as FetchHttpClient4 from "@effect/platform/FetchHttpClient";
+import * as Console7 from "effect/Console";
+import * as Effect8 from "effect/Effect";
+import * as Function4 from "effect/Function";
+import * as Option5 from "effect/Option";
+import { CommandConfig as CommandConfig4 } from "@dxos/cli-util";
+import { ClientService as ClientService4 } from "@dxos/client";
+var records = Command8.make("records", {
+  handle: Options4.text("handle").pipe(Options4.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options4.optional),
+  appPassword: Options4.text("app-password").pipe(Options4.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options4.optional)
+}, (options) => Function4.pipe(Effect8.gen(function* () {
+  const { json } = yield* CommandConfig4;
+  const client = yield* ClientService4;
+  const session = yield* resolveSession({
+    handle: Option5.getOrUndefined(options.handle),
+    appPassword: Option5.getOrUndefined(options.appPassword),
+    client
+  });
+  const results = yield* Effect8.all(ALL_NSIDS.map((collection) => listRecords(session, collection).pipe(
+    Effect8.map(({ records: entries }) => ({
+      collection,
+      records: entries
+    })),
+    // Empty collections come back as a 200 with `records: []`; if the
+    // PDS responds 400 because we've never written that collection we
+    // still want the others to render.
+    Effect8.catchAll(() => Effect8.succeed({
+      collection,
+      records: []
+    }))
+  )), {
+    concurrency: "unbounded"
+  });
+  if (json) {
+    yield* Console7.log(JSON.stringify({
+      did: session.did,
+      results
+    }, null, 2));
+    return;
+  }
+  yield* Console7.log(`Repo: ${session.did} (${session.handle})`);
+  for (const { collection, records: entries } of results) {
+    yield* Console7.log(`
+${collection} (${entries.length})`);
+    for (const entry of entries) {
+      yield* Console7.log(`  ${entry.uri}`);
+    }
+  }
+}), Effect8.provide(FetchHttpClient4.layer))).pipe(Command8.withDescription("List org.dxos.experimental.* records on the authenticated user's repo."));
+
+// src/commands/registry/unpublish.ts
+import * as Command9 from "@effect/cli/Command";
+import * as Options5 from "@effect/cli/Options";
+import * as FetchHttpClient5 from "@effect/platform/FetchHttpClient";
+import * as Console8 from "effect/Console";
+import * as Effect9 from "effect/Effect";
+import * as Function5 from "effect/Function";
+import * as Option6 from "effect/Option";
+import { ClientService as ClientService5 } from "@dxos/client";
+var rkeyOf = (uri) => uri.split("/").pop() ?? "";
+var unpublish = Command9.make("unpublish", {
+  handle: Options5.text("handle").pipe(Options5.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options5.optional),
+  appPassword: Options5.text("app-password").pipe(Options5.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options5.optional),
+  key: Options5.text("key").pipe(Options5.withDescription("Plugin key (the profile rkey). Removes its profile and all releases."))
+}, (options) => Function5.pipe(Effect9.gen(function* () {
+  const client = yield* ClientService5;
+  const session = yield* resolveSession({
+    handle: Option6.getOrUndefined(options.handle),
+    appPassword: Option6.getOrUndefined(options.appPassword),
+    client
+  });
+  const key = options.key;
+  let cursor;
+  let deletedReleases = 0;
+  do {
+    const releases = yield* listRecords(session, NSID.PluginRelease, {
+      limit: 100,
+      cursor
+    });
+    cursor = releases.cursor;
+    for (const record of releases.records) {
+      const rkey = rkeyOf(record.uri);
+      if (rkey.startsWith(`${key}:`)) {
+        yield* deleteRecord(session, NSID.PluginRelease, rkey);
+        yield* Console8.log(`Deleted release ${rkey}`);
+        deletedReleases += 1;
+      }
+    }
+  } while (cursor !== void 0);
+  yield* deleteRecord(session, NSID.PluginProfile, key);
+  yield* Console8.log(`Deleted profile ${key} (${deletedReleases} release(s) removed)`);
+}), Effect9.provide(FetchHttpClient5.layer))).pipe(Command9.withDescription("Remove a package (profile + releases) from the authenticated user's PDS."));
+
+// src/commands/registry/verify.ts
+import * as Command10 from "@effect/cli/Command";
+import * as Options6 from "@effect/cli/Options";
+import * as FetchHttpClient6 from "@effect/platform/FetchHttpClient";
+import * as Console9 from "effect/Console";
+import * as Effect10 from "effect/Effect";
+import * as Function6 from "effect/Function";
+import * as Option7 from "effect/Option";
+import { ClientService as ClientService6 } from "@dxos/client";
+var verify = Command10.make("verify", {
+  handle: Options6.text("handle").pipe(Options6.withDescription(AUTH_OPTION_DESCRIPTIONS.handle), Options6.optional),
+  appPassword: Options6.text("app-password").pipe(Options6.withDescription(AUTH_OPTION_DESCRIPTIONS.appPassword), Options6.optional),
+  subject: Options6.text("subject").pipe(Options6.withDescription("Handle or DID of the publisher being verified.")),
+  subjectHandle: Options6.text("subject-handle").pipe(Options6.withDescription("Optional human-readable handle to record for the verified subject (defaults to --subject if it is a handle)."), Options6.optional),
+  displayName: Options6.text("display-name").pipe(Options6.withDescription("Display name to record for the verified subject."))
+}, (options) => Function6.pipe(Effect10.gen(function* () {
+  const client = yield* ClientService6;
+  const session = yield* resolveSession({
+    handle: Option7.getOrUndefined(options.handle),
+    appPassword: Option7.getOrUndefined(options.appPassword),
+    client
+  });
+  const subjectDid = options.subject.startsWith("did:") ? options.subject : yield* resolveHandle(options.subject);
+  const subjectHandle = Option7.getOrUndefined(options.subjectHandle) ?? (options.subject.startsWith("did:") ? "" : options.subject);
+  const record = {
+    subject: subjectDid,
+    ...subjectHandle ? {
+      handle: subjectHandle
+    } : {},
+    displayName: options.displayName,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  const result = yield* putRecord(session, NSID.PublisherVerification, subjectDid, record);
+  yield* Console9.log(`Verified ${subjectDid} -> ${result.uri}`);
+}), Effect10.provide(FetchHttpClient6.layer))).pipe(Command10.withDescription("Write a publisher.verification record (indexed only if authored by the configured verifier, REGISTRY_CURATOR_DID)."));
+
+// src/commands/registry/index.ts
+var registry = Command11.make("registry").pipe(Command11.withDescription("Publish to and inspect the AT Protocol-backed DXOS plugin registry."), Command11.withSubcommands([
+  publish,
+  publishPackage,
+  publishPublisher,
+  unpublish,
+  verify,
+  records
+]));
+
 // src/RegistryPlugin.node.ts
 var RegistryPlugin = Plugin4.define(meta).pipe(AppPlugin.addCommandModule({
   commands: [
-    plugin
+    plugin,
+    registry
   ]
 }), Plugin4.make);
 var RegistryPlugin_node_default = RegistryPlugin;