@floomhq/floom 1.0.64 → 2.0.0

package/dist/package.js

@@ -1,507 +0,0 @@
-import { constants } from "node:fs";
-import { lstat, open, readdir, readFile } from "node:fs/promises";
-import { createHash } from "node:crypto";
-import { execFile as execFileCb } from "node:child_process";
-import { promisify } from "node:util";
-import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
-import { FloomError } from "./errors.js";
-const ALLOWED_PACKAGE_DIRS = new Set([
-    ".github",
-    "agents",
-    "assets",
-    "bin",
-    "canvas-fonts",
-    "checks",
-    "claude",
-    "codex",
-    "contrib",
-    "core",
-    "cursor",
-    "design",
-    "docs",
-    "evidence",
-    "examples",
-    "extension",
-    "helpers",
-    "hosts",
-    "kimi",
-    "lib",
-    "migrations",
-    "model-overlays",
-    "openclaw",
-    "opencode",
-    "reference",
-    "references",
-    "remotion-starter",
-    "scripts",
-    "sdk",
-    "schemas",
-    "src",
-    "specialists",
-    "supabase",
-    "templates",
-    "test",
-    "tests",
-    "themes",
-    "vendor",
-]);
-const ALLOWED_PACKAGE_ROOT_FILES = new Set(["SKILL.md", ".gitignore"]);
-const ALLOWED_PACKAGE_ROOT_SUPPORT_FILES = new Set([
-    ".env.example",
-    "ACKNOWLEDGEMENTS.md",
-    "CHANGELOG.md",
-    "LICENSE",
-    "LICENSE.md",
-    "LICENSE.txt",
-    "README.md",
-    "AGENTS.md",
-    "ARCHITECTURE.md",
-    "BROWSER.md",
-    "CLAUDE.md",
-    "CONTRIBUTING.md",
-    "DESIGN.md",
-    "ETHOS.md",
-    "PLAN-snapshot-dropdown-interactive.md",
-    "REMOTION_PROTOCOL.md",
-    "SKILL.md.tmpl",
-    "TODOS.md",
-    "TODOS-format.md",
-    "USING_GBRAIN_WITH_GSTACK.md",
-    "VERSION",
-    ".gitlab-ci.yml",
-    "actionlint.yaml",
-    "bun.lock",
-    "checklist.md",
-    "conductor.json",
-    "design-checklist.md",
-    "dx-hall-of-fame.md",
-    "editing.md",
-    "forms.md",
-    "instructions.md",
-    "nanobanana.py",
-    "package.json",
-    "plan.md",
-    "pptxgenjs.md",
-    "reference.md",
-    "requirements.txt",
-    "greptile-triage.md",
-    "setup",
-    "skill.md",
-    "slop-scan.config.json",
-    "style_guidelines.md",
-    "theme-showcase.pdf",
-]);
-const GENERATED_PACKAGE_DIRS = new Set([
-    ".agents",
-    ".cache",
-    ".cursor",
-    ".factory",
-    ".gbrain",
-    ".git",
-    ".hermes",
-    ".kiro",
-    ".next",
-    ".openclaw",
-    ".opencode",
-    ".pytest_cache",
-    ".slate",
-    "__pycache__",
-    "build",
-    "coverage",
-    "dist",
-    "fixtures",
-    "node_modules",
-    "out",
-]);
-const GENERATED_PACKAGE_FILES = new Set([".DS_Store"]);
-const GENERATED_PACKAGE_FILE_SUFFIXES = [".icns", ".log", ".mov", ".mp3", ".mp4", ".pyc", ".pyo", ".wav", ".webm"];
-const PACKAGE_FILE_LIMIT = 100;
-const PACKAGE_TOTAL_BYTES_LIMIT = 8_000_000;
-const PACKAGE_FILE_BYTES_LIMIT = 500_000;
-const PACKAGE_SEGMENT_RE = /^[A-Za-z0-9._-]{1,128}$/;
-const BASE64_RE = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
-const execFile = promisify(execFileCb);
-export function sha256Bytes(input) {
-    return createHash("sha256").update(input).digest("hex");
-}
-export async function readSkillPackage(inputPath) {
-    const resolved = resolve(process.cwd(), inputPath);
-    let stat;
-    try {
-        stat = await lstat(resolved);
-    }
-    catch (err) {
-        if (err.code === "ENOENT") {
-            throw new FloomError(`File not found: ${inputPath}`);
-        }
-        throw new FloomError(`Couldn't read ${inputPath}: ${err.message}`);
-    }
-    if (stat.isSymbolicLink()) {
-        throw new FloomError(`Package path is a symbolic link: ${inputPath}`);
-    }
-    if (stat.isFile()) {
-        const body = await readSkillFile(resolved, inputPath);
-        return {
-            rootPath: dirname(resolved),
-            skillPath: resolved,
-            skillBody: body,
-            packageFiles: [],
-            originalFilename: basename(resolved),
-            isFolder: false,
-        };
-    }
-    if (!stat.isDirectory()) {
-        throw new FloomError(`That's not a file or skill folder: ${inputPath}`);
-    }
-    const skillPath = join(resolved, "SKILL.md");
-    const skillBody = await readSkillFile(skillPath, join(inputPath, "SKILL.md"));
-    const packageFiles = await collectPackageFiles(resolved);
-    return {
-        rootPath: resolved,
-        skillPath,
-        skillBody,
-        packageFiles,
-        originalFilename: `${basename(resolved)}/SKILL.md`,
-        isFolder: true,
-    };
-}
-async function readSkillFile(path, label) {
-    let body;
-    try {
-        const handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
-        try {
-            const stat = await handle.stat();
-            if (!stat.isFile())
-                throw new FloomError(`That's a directory, not a file: ${label}`);
-            if (stat.size > PACKAGE_FILE_BYTES_LIMIT) {
-                throw new FloomError(`File too large: ${label}`, "Each package file is capped at 500KB.");
-            }
-            body = await handle.readFile("utf8");
-        }
-        finally {
-            await handle.close();
-        }
-    }
-    catch (err) {
-        const code = err.code;
-        if (code === "ENOENT")
-            throw new FloomError(`File not found: ${label}`);
-        if (code === "ELOOP")
-            throw new FloomError(`Package file is a symbolic link: ${label}`);
-        if (err instanceof FloomError)
-            throw err;
-        throw new FloomError(`Couldn't read ${label}: ${err.message}`);
-    }
-    if (!body.trim()) {
-        throw new FloomError(`File is empty: ${label}`, "Add skill instructions before scanning or publishing.");
-    }
-    return body;
-}
-async function collectPackageFiles(root) {
-    const files = [];
-    let totalBytes = Buffer.byteLength(await readFile(join(root, "SKILL.md")));
-    const isIgnored = gitIgnoreChecker(root);
-    const rootEntries = await readdir(root, { withFileTypes: true });
-    for (const entry of rootEntries) {
-        if (ALLOWED_PACKAGE_ROOT_FILES.has(entry.name) || ALLOWED_PACKAGE_DIRS.has(entry.name))
-            continue;
-        if (ALLOWED_PACKAGE_ROOT_SUPPORT_FILES.has(entry.name)) {
-            if (entry.isSymbolicLink())
-                continue;
-            if (!entry.isFile())
-                throw new FloomError(`Package path is not a regular file: ${entry.name}`);
-            continue;
-        }
-        if (isGeneratedPackageEntry(entry.name, entry.isDirectory()))
-            continue;
-        if (await isIgnored(entry.name))
-            continue;
-        if (entry.isDirectory() && await hasNestedSkillDir(join(root, entry.name)))
-            continue;
-        if (entry.isSymbolicLink())
-            continue;
-        const hint = "Move supporting files under references/, examples/, scripts/, or assets/.";
-        throw new FloomError(`Unsupported root package entry: ${entry.name}`, hint);
-    }
-    for (const entry of rootEntries) {
-        if (!ALLOWED_PACKAGE_ROOT_SUPPORT_FILES.has(entry.name))
-            continue;
-        if (entry.isSymbolicLink())
-            continue;
-        const fullPath = join(root, entry.name);
-        if (await isIgnored(entry.name))
-            continue;
-        await collectFile(fullPath, entry.name, files, (size) => {
-            totalBytes += size;
-            if (totalBytes > PACKAGE_TOTAL_BYTES_LIMIT) {
-                throw new FloomError("Skill package is too large.", "A skill package is capped at 8MB total.");
-            }
-        });
-    }
-    for (const dirName of ALLOWED_PACKAGE_DIRS) {
-        const dirPath = join(root, dirName);
-        let stat;
-        try {
-            stat = await lstat(dirPath);
-        }
-        catch (err) {
-            if (err.code === "ENOENT")
-                continue;
-            throw err;
-        }
-        if (await isIgnored(dirName))
-            continue;
-        if (stat.isSymbolicLink())
-            continue;
-        if (!stat.isDirectory())
-            throw new FloomError(`Package entry must be a directory: ${dirName}`);
-        await collectDir(root, dirPath, files, isIgnored, (size) => {
-            totalBytes += size;
-            if (totalBytes > PACKAGE_TOTAL_BYTES_LIMIT) {
-                throw new FloomError("Skill package is too large.", "A skill package is capped at 8MB total.");
-            }
-        });
-    }
-    return files.sort((a, b) => a.path.localeCompare(b.path));
-}
-async function collectDir(root, dir, files, isIgnored, addBytes) {
-    const entries = await readdir(dir, { withFileTypes: true });
-    for (const entry of entries) {
-        if (isGeneratedPackageEntry(entry.name, entry.isDirectory()))
-            continue;
-        if (!PACKAGE_SEGMENT_RE.test(entry.name)) {
-            throw new FloomError(`Invalid package path segment: ${entry.name}`);
-        }
-        const fullPath = join(dir, entry.name);
-        const rel = packageRelativePath(root, fullPath);
-        if (await isIgnored(rel))
-            continue;
-        if (entry.isSymbolicLink())
-            continue;
-        if (entry.isDirectory()) {
-            await collectDir(root, fullPath, files, isIgnored, addBytes);
-            continue;
-        }
-        if (!entry.isFile())
-            throw new FloomError(`Package path is not a regular file: ${rel}`);
-        await collectFile(fullPath, rel, files, addBytes);
-    }
-}
-async function hasNestedSkillDir(path) {
-    return hasNestedSkillDirInner(path, 0);
-}
-async function hasNestedSkillDirInner(path, depth) {
-    if (depth > 8)
-        return false;
-    try {
-        const stat = await lstat(join(path, "SKILL.md"));
-        if (stat.isFile())
-            return true;
-    }
-    catch (err) {
-        if (err.code !== "ENOENT")
-            throw err;
-    }
-    let entries;
-    try {
-        entries = await readdir(path, { withFileTypes: true });
-    }
-    catch (err) {
-        if (err.code === "ENOENT")
-            return false;
-        throw err;
-    }
-    for (const entry of entries) {
-        if (!entry.isDirectory() || entry.isSymbolicLink())
-            continue;
-        if (isGeneratedPackageEntry(entry.name, true))
-            continue;
-        if (await hasNestedSkillDirInner(join(path, entry.name), depth + 1))
-            return true;
-    }
-    return false;
-}
-async function collectFile(fullPath, rel, files, addBytes) {
-    const normalized = rel.split(sep).join("/");
-    validatePackageRelativePath(normalized);
-    if (files.length >= PACKAGE_FILE_LIMIT) {
-        throw new FloomError("Skill package has too many files.", "A skill package is capped at 100 supporting files.");
-    }
-    const stat = await lstat(fullPath);
-    if (stat.isSymbolicLink())
-        throw new FloomError(`Package path is a symbolic link: ${normalized}`);
-    if (!stat.isFile())
-        throw new FloomError(`Package path is not a regular file: ${normalized}`);
-    if (stat.size > PACKAGE_FILE_BYTES_LIMIT) {
-        throw new FloomError(`File too large: ${normalized}`, "Each package file is capped at 500KB.");
-    }
-    addBytes(stat.size);
-    const bytes = await readFile(fullPath);
-    files.push({
-        path: normalized,
-        content_base64: bytes.toString("base64"),
-        encoding: "base64",
-        size_bytes: bytes.length,
-        sha256: sha256Bytes(bytes),
-    });
-}
-function isGeneratedPackageEntry(name, isDirectory) {
-    if (isDirectory && GENERATED_PACKAGE_DIRS.has(name))
-        return true;
-    if (GENERATED_PACKAGE_FILES.has(name))
-        return true;
-    return GENERATED_PACKAGE_FILE_SUFFIXES.some((suffix) => name.endsWith(suffix));
-}
-function gitIgnoreChecker(root) {
-    const cache = new Map();
-    let localRules = null;
-    return async (rel) => {
-        const cached = cache.get(rel);
-        if (cached !== undefined)
-            return cached;
-        let ignored = false;
-        try {
-            await execFile("git", ["-C", root, "check-ignore", "--quiet", "--", rel]);
-            ignored = true;
-        }
-        catch (err) {
-            const code = err.code;
-            if (code !== 1 && code !== 128 && code !== "ENOENT") {
-                ignored = false;
-            }
-            if (code === 128 || code === "ENOENT") {
-                localRules ??= readLocalGitignore(root);
-                ignored = matchesLocalGitignore(rel, await localRules);
-            }
-        }
-        cache.set(rel, ignored);
-        return ignored;
-    };
-}
-async function readLocalGitignore(root) {
-    try {
-        const body = await readFile(join(root, ".gitignore"), "utf8");
-        return body
-            .split(/\r?\n/)
-            .map((line) => line.trim())
-            .filter((line) => line.length > 0 && !line.startsWith("#") && !line.startsWith("!"));
-    }
-    catch {
-        return [];
-    }
-}
-function matchesLocalGitignore(rel, rules) {
-    const normalized = rel.replace(/\\/g, "/").replace(/^\/+/, "");
-    for (const rawRule of rules) {
-        const rule = rawRule.replace(/\\/g, "/").replace(/^\/+/, "");
-        if (!rule)
-            continue;
-        if (rule.endsWith("/")) {
-            const prefix = rule.replace(/\/+$/, "");
-            if (normalized === prefix || normalized.startsWith(`${prefix}/`))
-                return true;
-            continue;
-        }
-        if (normalized === rule || normalized.endsWith(`/${rule}`))
-            return true;
-    }
-    return false;
-}
-function packageRelativePath(root, path) {
-    const rel = relative(resolve(root), resolve(path));
-    if (!rel || rel === "." || rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
-        throw new FloomError("Invalid package path.");
-    }
-    const normalized = rel.split(sep).join("/");
-    validatePackageRelativePath(normalized);
-    return normalized;
-}
-export function validatePackageRelativePath(path) {
-    if (!path || isAbsolute(path) || path.includes("\\") || path.length > 512) {
-        throw new FloomError(`Invalid package file path: ${path}`);
-    }
-    const segments = path.split("/");
-    if (segments.length === 1) {
-        if (ALLOWED_PACKAGE_ROOT_SUPPORT_FILES.has(path) && PACKAGE_SEGMENT_RE.test(path))
-            return;
-        throw new FloomError(`Invalid package file path: ${path}`, "Package root files must be approved support files.");
-    }
-    if (!ALLOWED_PACKAGE_DIRS.has(segments[0] ?? "")) {
-        throw new FloomError(`Invalid package file path: ${path}`, "Package files must be under an approved support directory.");
-    }
-    if (segments.some((segment) => segment === "." || segment === ".." || !PACKAGE_SEGMENT_RE.test(segment))) {
-        throw new FloomError(`Invalid package file path: ${path}`);
-    }
-}
-export function normalizeRemotePackageFiles(input) {
-    if (input === undefined || input === null)
-        return [];
-    if (!Array.isArray(input))
-        throw new FloomError("Invalid skill package response.");
-    if (input.length > PACKAGE_FILE_LIMIT) {
-        throw new FloomError("Skill package response has too many files.");
-    }
-    let totalBytes = 0;
-    const seenPaths = new Set();
-    return input.map((raw) => {
-        if (!raw || typeof raw !== "object")
-            throw new FloomError("Invalid skill package response.");
-        const file = raw;
-        if (typeof file.path !== "string")
-            throw new FloomError("Invalid skill package response.");
-        validatePackageRelativePath(file.path);
-        const pathKey = file.path.toLowerCase();
-        if (seenPaths.has(pathKey))
-            throw new FloomError(`Duplicate package file: ${file.path}`);
-        seenPaths.add(pathKey);
-        let bytes;
-        if (typeof file.content_base64 === "string") {
-            if (file.encoding !== undefined && file.encoding !== "base64") {
-                throw new FloomError(`Invalid package file encoding: ${file.path}`);
-            }
-            if (file.content_base64.length % 4 !== 0 || !BASE64_RE.test(file.content_base64)) {
-                throw new FloomError(`Invalid package file base64: ${file.path}`);
-            }
-            bytes = Buffer.from(file.content_base64, "base64");
-        }
-        else if (typeof file.content === "string") {
-            bytes = Buffer.from(file.content, "utf8");
-        }
-        else {
-            throw new FloomError("Invalid skill package response.");
-        }
-        if (bytes.length > PACKAGE_FILE_BYTES_LIMIT) {
-            throw new FloomError(`Package file is too large: ${file.path}`);
-        }
-        if (typeof file.size_bytes === "number" && file.size_bytes !== bytes.length) {
-            throw new FloomError(`Package file size mismatch: ${file.path}`);
-        }
-        totalBytes += bytes.length;
-        if (totalBytes > PACKAGE_TOTAL_BYTES_LIMIT) {
-            throw new FloomError("Skill package response is too large.");
-        }
-        const hash = sha256Bytes(bytes);
-        if (typeof file.content_base64 === "string" && typeof file.sha256 !== "string") {
-            throw new FloomError(`Package file missing sha256: ${file.path}`);
-        }
-        if (typeof file.sha256 === "string" && file.sha256 !== hash) {
-            throw new FloomError(`Package file hash mismatch: ${file.path}`);
-        }
-        return { path: file.path, bytes, sha256: hash };
-    }).sort((a, b) => a.path.localeCompare(b.path));
-}
-export function packageHash(skillBody, files) {
-    const hash = createHash("sha256");
-    hash.update("SKILL.md\0");
-    hash.update(skillBody);
-    for (const file of files) {
-        hash.update("\0");
-        hash.update(file.path);
-        hash.update("\0");
-        if ("bytes" in file)
-            hash.update(file.bytes);
-        else
-            hash.update(Buffer.from(file.content_base64, "base64"));
-    }
-    return hash.digest("hex");
-}