@michaelfromyeg/weft-core 1.0.0

package/dist/index.js

@@ -0,0 +1,998 @@
+import { existsSync, statSync, mkdirSync, writeFileSync, readFileSync, mkdtempSync, cpSync, rmSync, readdirSync } from 'fs';
+import { join, isAbsolute, resolve, dirname, relative } from 'path';
+import { refOf, kindOf, leafNameOf, fqid, targetsOf, ALL_TARGETS, loadPlugin, loadManifest, Marketplace, validate, Lockfile, stringifyDocument } from '@michaelfromyeg/weft-schema';
+import { parseFrontmatter } from '@michaelfromyeg/weft-adapter-kit';
+import semver from 'semver';
+import { homedir, tmpdir } from 'os';
+import { createHash, generateKeyPairSync, sign, verify } from 'crypto';
+import { execa } from 'execa';
+
+// src/api.ts
+
+// src/diagnostics.ts
+var Diagnostics = class {
+  items = [];
+  error(where, message) {
+    this.items.push({ severity: "error", where, message });
+  }
+  warn(where, message) {
+    this.items.push({ severity: "warning", where, message });
+  }
+  info(where, message) {
+    this.items.push({ severity: "info", where, message });
+  }
+  get hasErrors() {
+    return this.items.some((d) => d.severity === "error");
+  }
+  get errors() {
+    return this.items.filter((d) => d.severity === "error");
+  }
+};
+var CompileError = class extends Error {
+  constructor(message, diagnostics) {
+    super(message);
+    this.diagnostics = diagnostics;
+    this.name = "CompileError";
+  }
+  diagnostics;
+};
+
+// src/namespace.ts
+function resolveAliases(components) {
+  const byLeaf = /* @__PURE__ */ new Map();
+  for (const c of components) {
+    const ids = byLeaf.get(c.leaf) ?? [];
+    ids.push(c.id);
+    byLeaf.set(c.leaf, ids);
+  }
+  const aliases = {};
+  const collisions = [];
+  for (const [leaf, ids] of byLeaf) {
+    if (ids.length === 1) aliases[leaf] = ids[0];
+    else collisions.push({ leaf, ids: [...ids].sort() });
+  }
+  return { aliases, collisions };
+}
+function validatePlugin(fb, diags) {
+  fb.plugin.components.forEach((component, i) => {
+    const where = `components[${i}]`;
+    const ref = refOf(component);
+    const abs = join(fb.root, ref);
+    if (!existsSync(abs)) {
+      diags.error(where, `referenced path "${ref}" does not exist`);
+      return;
+    }
+    switch (kindOf(component)) {
+      case "skill":
+        validateSkill(fb, ref, abs, where, diags);
+        break;
+      case "mcp":
+        validateMcp(fb, ref, abs, where, diags);
+        break;
+      case "agent":
+        validateMarkdownComponent(fb, ref, abs, where, diags);
+        break;
+    }
+  });
+}
+function validateSkill(fb, ref, abs, where, diags) {
+  if (!statSync(abs).isDirectory()) {
+    diags.error(where, `skill "${ref}" must be a directory containing SKILL.md`);
+    return;
+  }
+  const skillMd = join(abs, "SKILL.md");
+  if (!existsSync(skillMd)) {
+    diags.error(where, `skill "${ref}" is missing SKILL.md`);
+    return;
+  }
+  const { data } = parseFrontmatter(fb.read(join(ref, "SKILL.md")).toString("utf8"));
+  if (!data.name) diags.error(`${where}.skill`, "SKILL.md frontmatter is missing `name`");
+  checkDescription(`${where}.skill`, data.description, diags);
+}
+function validateMcp(fb, ref, abs, where, diags) {
+  if (!statSync(abs).isDirectory()) {
+    diags.error(where, `mcp "${ref}" must be a directory containing server.json`);
+    return;
+  }
+  const serverJsonPath = join(abs, "server.json");
+  if (!existsSync(serverJsonPath)) {
+    diags.error(where, `mcp "${ref}" is missing server.json`);
+    return;
+  }
+  let server;
+  try {
+    server = JSON.parse(fb.read(join(ref, "server.json")).toString("utf8"));
+  } catch (err) {
+    diags.error(`${where}.mcp`, `server.json is not valid JSON: ${err.message}`);
+    return;
+  }
+  if (!server.name) diags.error(`${where}.mcp`, "server.json is missing `name`");
+  const hasRunnable = server.packages || server.remotes || server.command;
+  if (!hasRunnable) {
+    diags.warn(`${where}.mcp`, "server.json declares no `packages`, `remotes`, or `command`");
+  }
+  checkDescription(`${where}.mcp`, server.description, diags);
+}
+function validateMarkdownComponent(fb, ref, abs, where, diags) {
+  if (statSync(abs).isDirectory()) return;
+  const { data } = parseFrontmatter(fb.read(ref).toString("utf8"));
+  if (!data.name) diags.warn(`${where}.agent`, "agent frontmatter is missing `name`");
+  checkDescription(`${where}.agent`, data.description, diags);
+}
+function checkDescription(where, description, diags) {
+  if (!description) {
+    diags.error(where, "missing `description` (required for discovery + the tested badge)");
+    return;
+  }
+  if (String(description).trim().length < 16) {
+    diags.warn(where, "description is very short; harnesses route on it -- make it specific");
+  }
+}
+var WEFT_VERSION = "1.0.0";
+function checkMinVersion(min) {
+  if (!min) return null;
+  const cleaned = semver.valid(semver.coerce(min) ?? min);
+  if (!cleaned) return `weft_min_version "${min}" is not a valid semver`;
+  if (semver.lt(WEFT_VERSION, cleaned)) {
+    return `plugin requires Weft >= ${min}, but this is ${WEFT_VERSION}`;
+  }
+  return null;
+}
+
+// src/compile.ts
+function synthMarketplace(plugin) {
+  return {
+    name: plugin.name,
+    owner: plugin.owner,
+    ...plugin.description ? { description: plugin.description } : {},
+    entries: [
+      {
+        name: plugin.name,
+        source: `./plugins/${plugin.name}`,
+        ...plugin.description ? { description: plugin.description } : {},
+        version: plugin.version
+      }
+    ]
+  };
+}
+function staticPass(fb) {
+  const diagnostics = new Diagnostics();
+  const { plugin } = fb;
+  const id = `${plugin.owner.namespace}/${plugin.name}`;
+  const minErr = checkMinVersion(plugin.weft_min_version);
+  if (minErr) diagnostics.error("weft_min_version", minErr);
+  validatePlugin(fb, diagnostics);
+  const resolved = plugin.components.map((component) => ({
+    id: fqid(plugin.owner.namespace, plugin.name, leafNameOf(component)),
+    leaf: leafNameOf(component),
+    kind: kindOf(component),
+    component
+  }));
+  const { aliases, collisions } = resolveAliases(resolved);
+  for (const c of collisions) {
+    diagnostics.error(
+      `components.${c.leaf}`,
+      `ambiguous component name "${c.leaf}": ${c.ids.join(" vs ")}; qualify or choose which keeps the bare alias`
+    );
+  }
+  return { id, diagnostics, aliases, resolved };
+}
+function compile(fb, opts) {
+  const { plugin } = fb;
+  const pass = staticPass(fb);
+  const { id, diagnostics } = pass;
+  const onlySet = opts.only && opts.only.length > 0 ? new Set(opts.only) : null;
+  if (onlySet) {
+    for (const leaf of onlySet) {
+      if (!pass.resolved.some((rc) => rc.leaf === leaf)) {
+        diagnostics.error(
+          "only",
+          `component "${leaf}" not found; available: ${pass.resolved.map((r) => r.leaf).join(", ")}`
+        );
+      }
+    }
+  }
+  const selected = onlySet ? pass.resolved.filter((rc) => onlySet.has(rc.leaf)) : pass.resolved;
+  const effectivePlugin = onlySet ? { ...plugin, components: selected.map((rc) => rc.component) } : plugin;
+  const aliases = onlySet ? Object.fromEntries(
+    Object.entries(pass.aliases).filter(([, cid]) => selected.some((rc) => rc.id === cid))
+  ) : pass.aliases;
+  const reverseAlias = new Map(Object.entries(aliases).map(([leaf, cid]) => [cid, leaf]));
+  const requested = opts.targets ?? opts.registry.targets;
+  const targets = [];
+  for (const target of requested) {
+    const adapter = opts.registry.get(target);
+    if (!adapter) {
+      if (opts.targets) diagnostics.warn(target, `no adapter registered for target "${target}"`);
+      continue;
+    }
+    const ctx = {
+      plugin: effectivePlugin,
+      read: fb.read,
+      list: fb.list,
+      aliasFor: (componentId) => reverseAlias.get(componentId) ?? componentId
+    };
+    const pluginArtifacts = [];
+    for (const rc of selected) {
+      if (!targetsOf(rc.component, ALL_TARGETS).includes(target)) continue;
+      for (const a of adapter.transform(rc.component, ctx)) {
+        pluginArtifacts.push({ componentId: rc.id, artifact: a });
+      }
+    }
+    for (const a of adapter.emitManifest(effectivePlugin, ctx)) {
+      pluginArtifacts.push({ componentId: id, artifact: a });
+    }
+    targets.push({ target, adapter, artifacts: pluginArtifacts });
+  }
+  return { fb, id, components: selected, aliases, diagnostics, targets };
+}
+function configVarsOf(component) {
+  return "config" in component && component.config ? component.config : [];
+}
+function resolveConfig(plugin, cwd, env = process.env) {
+  const resolved = [];
+  const values = {};
+  for (const component of plugin.components) {
+    for (const v of configVarsOf(component)) {
+      const fromEnv = env[v.env];
+      if (fromEnv !== void 0) {
+        values[v.env] = fromEnv;
+        resolved.push({ env: v.env, source: "env", secret: v.secret });
+      } else if (v.default === void 0) {
+        resolved.push({ env: v.env, source: "missing", secret: v.secret });
+      } else {
+        values[v.env] = v.default;
+        resolved.push({ env: v.env, source: "default", secret: v.secret });
+      }
+    }
+  }
+  if (Object.keys(values).length === 0) return { resolved, path: null };
+  const dir = join(cwd, ".weft");
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, ".gitignore"), "*\n");
+  const path = join(dir, "secrets.local.json");
+  writeFileSync(path, `${JSON.stringify(values, null, 2)}
+`);
+  return { resolved, path };
+}
+function walkFiles(root, dir) {
+  if (!(existsSync(dir) && statSync(dir).isDirectory())) return [];
+  const out = [];
+  for (const entry of readdirSync(dir).sort()) {
+    const abs = join(dir, entry);
+    if (statSync(abs).isDirectory()) out.push(...walkFiles(root, abs));
+    else out.push(relative(root, abs));
+  }
+  return out;
+}
+var MANIFEST_NAMES = ["weft.yaml", "weft.yml", "weft.json5", "weft.json"];
+function fileAccessors(root) {
+  return {
+    read: (relPath) => readFileSync(join(root, relPath)),
+    list: (relDir) => walkFiles(root, join(root, relDir))
+  };
+}
+function loadPluginDir(dir) {
+  const manifestPath = MANIFEST_NAMES.map((n) => join(dir, n)).find((p) => existsSync(p));
+  if (!manifestPath) {
+    return {
+      ok: false,
+      issues: [
+        { path: dir, message: `no plugin manifest found (one of: ${MANIFEST_NAMES.join(", ")})` }
+      ]
+    };
+  }
+  const text = readFileSync(manifestPath, "utf8");
+  const parsed = loadPlugin(text, { filename: manifestPath });
+  if (!parsed.ok) return parsed;
+  return {
+    ok: true,
+    value: { plugin: parsed.value, root: dir, manifestPath, ...fileAccessors(dir) }
+  };
+}
+var MARKETPLACE_NAMES = [
+  "marketplace.yaml",
+  "marketplace.yml",
+  "marketplace.json5",
+  "marketplace.json"
+];
+function hasMarketplaceManifest(dir) {
+  return MARKETPLACE_NAMES.some((n) => existsSync(join(dir, n)));
+}
+function loadMarketplaceDir(dir) {
+  const manifestPath = MARKETPLACE_NAMES.map((n) => join(dir, n)).find((p) => existsSync(p));
+  if (!manifestPath) {
+    return {
+      ok: false,
+      issues: [
+        {
+          path: dir,
+          message: `no marketplace manifest found (one of: ${MARKETPLACE_NAMES.join(", ")})`
+        }
+      ]
+    };
+  }
+  const text = readFileSync(manifestPath, "utf8");
+  const parsed = loadManifest(Marketplace, text, { filename: manifestPath });
+  if (!parsed.ok) return parsed;
+  return { ok: true, value: { marketplace: parsed.value, root: dir, manifestPath } };
+}
+var CACHE_DIR = join(homedir(), ".weft", "cache");
+function splitRefAndSubdir(s) {
+  const hash = s.indexOf("#");
+  const ref = hash >= 0 ? s.slice(hash + 1) : void 0;
+  const head = hash >= 0 ? s.slice(0, hash) : s;
+  const proto = head.match(/^[a-z+]+:\/\//i)?.[0] ?? "";
+  const rest = head.slice(proto.length);
+  const slash = rest.indexOf("//");
+  if (slash === -1) return { base: head, ...ref ? { ref } : {} };
+  return {
+    base: proto + rest.slice(0, slash),
+    subdir: rest.slice(slash + 2),
+    ...ref ? { ref } : {}
+  };
+}
+function parseSource(src) {
+  if (src.startsWith("./") || src.startsWith("../") || isAbsolute(src)) {
+    return { kind: "local", path: src };
+  }
+  if (src.startsWith("npm:")) {
+    const raw = src.slice("npm:".length);
+    const slash = raw.indexOf("//");
+    const subdir2 = slash >= 0 ? raw.slice(slash + 2) : void 0;
+    const spec = slash >= 0 ? raw.slice(0, slash) : raw;
+    const at = spec.lastIndexOf("@");
+    const pkg = at > 0 ? spec.slice(0, at) : spec;
+    const version = at > 0 ? spec.slice(at + 1) : void 0;
+    return { kind: "npm", pkg, ...version ? { version } : {}, ...subdir2 ? { subdir: subdir2 } : {} };
+  }
+  if (src.startsWith("github:")) {
+    const { base: base2, subdir: subdir2, ref: ref2 } = splitRefAndSubdir(src.slice("github:".length));
+    return { kind: "github", repo: base2, ...ref2 ? { ref: ref2 } : {}, ...subdir2 ? { subdir: subdir2 } : {} };
+  }
+  if (src.startsWith("git@") || src.startsWith("git+") || src.startsWith("file://") || /^https?:\/\//.test(src)) {
+    const { base: base2, subdir: subdir2, ref: ref2 } = splitRefAndSubdir(src.replace(/^git\+/, ""));
+    return { kind: "git", url: base2, ...ref2 ? { ref: ref2 } : {}, ...subdir2 ? { subdir: subdir2 } : {} };
+  }
+  const { base, subdir, ref } = splitRefAndSubdir(src);
+  if (/^[\w.-]+\/[\w.-]+$/.test(base)) {
+    return { kind: "github", repo: base, ...ref ? { ref } : {}, ...subdir ? { subdir } : {} };
+  }
+  return { kind: "local", path: src };
+}
+function cacheDirFor(key) {
+  return join(CACHE_DIR, createHash("sha256").update(key).digest("hex").slice(0, 16));
+}
+var SHA_RE = /^[0-9a-f]{40}$/i;
+async function gitFetch(url, ref) {
+  mkdirSync(CACHE_DIR, { recursive: true });
+  const dir = cacheDirFor(`${url}@${ref ?? "default"}`);
+  const isSha = ref !== void 0 && SHA_RE.test(ref);
+  if (existsSync(join(dir, ".git"))) {
+    await execa("git", ["fetch", "origin", ...ref ? [ref] : []], { cwd: dir });
+    await execa("git", ["checkout", ref ?? "FETCH_HEAD"], { cwd: dir, reject: false });
+  } else if (isSha) {
+    await execa("git", ["clone", url, dir]);
+    await execa("git", ["checkout", ref], { cwd: dir });
+  } else {
+    const branchArgs = ref ? ["--branch", ref] : [];
+    await execa("git", ["clone", "--depth", "1", ...branchArgs, url, dir]);
+  }
+  const sha = (await execa("git", ["rev-parse", "HEAD"], { cwd: dir })).stdout.trim();
+  return { dir, sha };
+}
+async function npmFetch(pkg, version) {
+  const spec = version ? `${pkg}@${version}` : pkg;
+  const dir = cacheDirFor(`npm:${spec}`);
+  const pkgDir = join(dir, "package");
+  if (version && existsSync(pkgDir)) return { dir: pkgDir, sha: version };
+  mkdirSync(dir, { recursive: true });
+  const { stdout } = await execa("npm", ["pack", spec, "--pack-destination", dir, "--json"], {
+    cwd: dir
+  });
+  const meta = JSON.parse(stdout);
+  const first = meta[0];
+  if (!first) throw new Error(`npm pack produced no tarball for "${spec}"`);
+  await execa("tar", ["-xzf", join(dir, first.filename), "-C", dir]);
+  return { dir: pkgDir, sha: first.version ?? version ?? "" };
+}
+async function fetchSourceDir(src) {
+  if (src.kind === "github" || src.kind === "git") {
+    const url = src.kind === "github" ? `https://github.com/${src.repo}.git` : src.url;
+    const { dir: dir2, sha: sha2 } = await gitFetch(url, src.ref);
+    return { dir: src.subdir ? join(dir2, src.subdir) : dir2, ref: src.ref ?? "default", sha: sha2 };
+  }
+  const { dir, sha } = await npmFetch(src.pkg, src.version);
+  return { dir: src.subdir ? join(dir, src.subdir) : dir, ref: src.version ?? "latest", sha };
+}
+async function resolvePluginRefFull(source, fromRoot) {
+  const src = parseSource(source);
+  if (src.kind === "local") {
+    const dir2 = isAbsolute(src.path) ? src.path : resolve(fromRoot, src.path);
+    return { fb: loadOrThrow(dir2, source), ref: "local", sha: "" };
+  }
+  const { dir, ref, sha } = await fetchSourceDir(src);
+  return { fb: loadOrThrow(dir, source), ref, sha };
+}
+async function resolveSourceDir(source, fromRoot) {
+  const localGuess = isAbsolute(source) ? source : resolve(fromRoot, source);
+  if (existsSync(localGuess)) return { dir: localGuess, ref: "local", sha: "" };
+  const src = parseSource(source);
+  if (src.kind === "local") return { dir: localGuess, ref: "local", sha: "" };
+  return await fetchSourceDir(src);
+}
+async function resolvePluginRef(source, fromRoot) {
+  return (await resolvePluginRefFull(source, fromRoot)).fb;
+}
+function loadOrThrow(dir, source) {
+  const loaded = loadPluginDir(dir);
+  if (!loaded.ok) {
+    throw new Error(
+      `failed to load "${source}":
+${loaded.issues.map((i) => `  ${i.path}: ${i.message}`).join("\n")}`
+    );
+  }
+  return loaded.value;
+}
+function resolveDependency(dep, fromRoot) {
+  return resolvePluginRefFull(dep.plugin, fromRoot);
+}
+async function gitInfo(dir) {
+  try {
+    const sha = (await execa("git", ["rev-parse", "HEAD"], { cwd: dir })).stdout.trim();
+    let ref = "HEAD";
+    try {
+      ref = (await execa("git", ["describe", "--tags", "--exact-match"], { cwd: dir })).stdout.trim();
+    } catch {
+      try {
+        ref = (await execa("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: dir })).stdout.trim();
+      } catch {
+      }
+    }
+    return { ref, sha };
+  } catch {
+    return { ref: "local", sha: "" };
+  }
+}
+
+// src/deps.ts
+var KIND_KEY = {
+  skill: "skill",
+  mcp: "mcp",
+  agent: "agent",
+  hook: "hook",
+  command: "command",
+  passthrough: "passthrough"
+};
+function rewriteRef(c, newRef) {
+  return { ...c, [KIND_KEY[kindOf(c)]]: newRef };
+}
+var skipGit = (src) => !/\/\.git(\/|$)/.test(src);
+async function resolveDependencies(fb, tmpRoot) {
+  const depends = fb.plugin.depends ?? [];
+  if (depends.length === 0) return { fb, dependencies: [] };
+  const merged = mkdtempSync(join(tmpRoot ?? tmpdir(), "weft-merged-"));
+  cpSync(fb.root, merged, { recursive: true, filter: skipGit });
+  const components = [...fb.plugin.components];
+  const dependencies = [];
+  const seen = /* @__PURE__ */ new Set([`${fb.plugin.owner.namespace}/${fb.plugin.name}`]);
+  for (const dep of depends) {
+    const resolved = await resolveDependency(dep, fb.root);
+    const dp = resolved.fb.plugin;
+    const depId = `${dp.owner.namespace}/${dp.name}`;
+    if (seen.has(depId)) throw new Error(`dependency cycle detected at ${depId}`);
+    seen.add(depId);
+    const want = dep.components;
+    if (want) {
+      const missing = want.filter((leaf) => !dp.components.some((c) => leafNameOf(c) === leaf));
+      if (missing.length > 0) {
+        throw new Error(`dependency ${depId} has no component(s): ${missing.join(", ")}`);
+      }
+    }
+    const selected = dp.components.filter((c) => !want || want.includes(leafNameOf(c)));
+    const destBase = join("_deps", dp.name);
+    cpSync(resolved.fb.root, join(merged, destBase), { recursive: true, filter: skipGit });
+    for (const c of selected) components.push(rewriteRef(c, join(destBase, refOf(c))));
+    dependencies.push({ id: depId, range: dep.version ?? "*", resolvedSha: resolved.sha });
+  }
+  const plugin = { ...fb.plugin, components };
+  const mergedFb = {
+    plugin,
+    root: merged,
+    manifestPath: join(merged, "weft.yaml"),
+    ...fileAccessors(merged)
+  };
+  return { fb: mergedFb, dependencies };
+}
+function buildLockEntry(input) {
+  const adapters = {};
+  for (const t of input.result.targets) {
+    adapters[t.target] = { version: t.adapter.version, targetSchema: t.adapter.targetSchema };
+  }
+  return {
+    pluginLock: {
+      id: input.result.id,
+      version: input.result.fb.plugin.version,
+      ref: input.ref,
+      sha: input.sha,
+      dependencies: input.dependencies ?? [],
+      aliases: input.result.aliases
+    },
+    artifacts: input.artifacts,
+    adapters
+  };
+}
+function mergeLock(existing, entries, generatedAt) {
+  const replacing = new Set(entries.map((e) => e.pluginLock.id));
+  const plugins = (existing?.plugins ?? []).filter((p) => !replacing.has(p.id));
+  const artifacts = (existing?.artifacts ?? []).filter((a) => !replacing.has(a.plugin));
+  const adapters = { ...existing?.adapters ?? {} };
+  for (const e of entries) {
+    plugins.push(e.pluginLock);
+    artifacts.push(...e.artifacts);
+    Object.assign(adapters, e.adapters);
+  }
+  return { weftVersion: WEFT_VERSION, generatedAt, plugins, artifacts, adapters };
+}
+function lockDirForScope(scope, cwd) {
+  return scope === "user" ? join(homedir(), ".weft") : cwd;
+}
+function serializeLock(lock) {
+  return `${JSON.stringify(lock, null, 2)}
+`;
+}
+function writeLock(dir, lock) {
+  const p = join(dir, "weft.lock");
+  writeFileSync(p, serializeLock(lock));
+  return p;
+}
+function readLock(dir) {
+  try {
+    const text = readFileSync(join(dir, "weft.lock"), "utf8");
+    const res = validate(Lockfile, JSON.parse(text));
+    return res.ok ? res.value : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/managed.ts
+function checkManagedPolicy(policy, ctx) {
+  if (!policy) return null;
+  if (policy.allowNamespaces && !policy.allowNamespaces.includes(ctx.namespace)) {
+    return `namespace "${ctx.namespace}" is not allowlisted (managed mode allows: ${policy.allowNamespaces.join(", ")})`;
+  }
+  if (policy.requireBadges && policy.requireBadges.length > 0) {
+    const have = new Set(ctx.badges ?? []);
+    const missing = policy.requireBadges.filter((b) => !have.has(b));
+    if (missing.length > 0) return `plugin is missing required badge(s): ${missing.join(", ")}`;
+  }
+  return null;
+}
+function sha256(contents) {
+  return createHash("sha256").update(contents).digest("hex");
+}
+
+// src/place.ts
+function writeArtifact(baseDir, relPath, contents) {
+  const abs = join(baseDir, relPath);
+  mkdirSync(dirname(abs), { recursive: true });
+  const buf = typeof contents === "string" ? Buffer.from(contents, "utf8") : contents;
+  writeFileSync(abs, buf);
+  return { abs, hash: sha256(buf) };
+}
+function placePluginArtifacts(target, baseDir, pluginName) {
+  const pluginPrefix = join("plugins", pluginName);
+  return target.artifacts.map(({ artifact }) => {
+    const rel = join(pluginPrefix, artifact.relPath);
+    const { abs, hash } = writeArtifact(baseDir, rel, artifact.contents);
+    return { target: target.target, relPath: rel, abs, hash, kind: artifact.kind };
+  });
+}
+function placeCatalog(adapter, marketplace, baseDir) {
+  return adapter.emitCatalog(marketplace).map((artifact) => {
+    const { abs, hash } = writeArtifact(baseDir, artifact.relPath, artifact.contents);
+    return { target: adapter.target, relPath: artifact.relPath, abs, hash, kind: artifact.kind };
+  });
+}
+function buildToDir(result, outDir) {
+  const written = [];
+  const { plugin } = result.fb;
+  const marketplace = synthMarketplace(plugin);
+  for (const t of result.targets) {
+    const base = join(outDir, t.target);
+    written.push(...placePluginArtifacts(t, base, plugin.name));
+    written.push(...placeCatalog(t.adapter, marketplace, base));
+  }
+  return written;
+}
+function toBuffer(contents) {
+  return typeof contents === "string" ? Buffer.from(contents, "utf8") : contents;
+}
+function planScopeArtifacts(result, scope, cwd) {
+  const planned = [];
+  const name = result.fb.plugin.name;
+  for (const t of result.targets) {
+    const paths = t.adapter.detect(scope, cwd);
+    const pluginDir = join(paths.plugins, name);
+    for (const { componentId, artifact } of t.artifacts) {
+      const contents = toBuffer(artifact.contents);
+      planned.push({
+        contents,
+        record: {
+          plugin: result.id,
+          component: componentId,
+          target: t.target,
+          scope,
+          path: join(pluginDir, artifact.relPath),
+          hash: sha256(contents),
+          placement: "copy",
+          enabled: artifact.executable !== true
+        }
+      });
+    }
+  }
+  return planned;
+}
+function installToScope(result, scope, cwd) {
+  return planScopeArtifacts(result, scope, cwd).map(({ record, contents }) => {
+    mkdirSync(dirname(record.path), { recursive: true });
+    writeFileSync(record.path, contents);
+    return record;
+  });
+}
+
+// src/api.ts
+function loadResolved(pluginDir) {
+  return resolveDependencies(loadOrThrow2(pluginDir));
+}
+function issuesToDiagnostics(issues) {
+  return issues.map((i) => ({ severity: "error", where: i.path, message: i.message }));
+}
+function loadOrThrow2(pluginDir) {
+  const loaded = loadPluginDir(pluginDir);
+  if (!loaded.ok) {
+    throw new CompileError(
+      `failed to load plugin in ${pluginDir}`,
+      issuesToDiagnostics(loaded.issues)
+    );
+  }
+  return loaded.value;
+}
+function lint(pluginDir) {
+  const fb = loadOrThrow2(pluginDir);
+  const pass = staticPass(fb);
+  return { id: pass.id, plugin: fb.plugin, aliases: pass.aliases, diagnostics: pass.diagnostics };
+}
+async function build(opts) {
+  const { fb } = await loadResolved(opts.pluginDir);
+  const result = compile(fb, { registry: opts.registry, targets: opts.targets });
+  if (result.diagnostics.hasErrors) {
+    throw new CompileError("compile failed", result.diagnostics.errors);
+  }
+  const written = buildToDir(result, opts.outDir);
+  return { result, written };
+}
+async function buildMarketplace(opts) {
+  const loaded = loadMarketplaceDir(opts.marketplaceDir);
+  if (!loaded.ok) {
+    throw new CompileError(
+      `failed to load marketplace in ${opts.marketplaceDir}`,
+      issuesToDiagnostics(loaded.issues)
+    );
+  }
+  const { marketplace, root } = loaded.value;
+  const compiled = [];
+  for (const entry of marketplace.plugins) {
+    let fb;
+    try {
+      fb = (await resolvePluginRefFull(entry.plugin, root)).fb;
+    } catch (err) {
+      throw new CompileError(`marketplace entry "${entry.plugin}" failed`, [
+        { severity: "error", where: "plugins", message: err.message }
+      ]);
+    }
+    if (entry.version) fb = { ...fb, plugin: { ...fb.plugin, version: entry.version } };
+    const merged = (await resolveDependencies(fb)).fb;
+    const result = compile(merged, { registry: opts.registry, targets: opts.targets });
+    if (result.diagnostics.hasErrors) {
+      throw new CompileError(`plugin "${result.id}" failed`, result.diagnostics.errors);
+    }
+    compiled.push({ entry, result });
+  }
+  const targets = opts.targets ?? opts.registry.targets;
+  const written = [];
+  for (const target of targets) {
+    const adapter = opts.registry.get(target);
+    if (!adapter) continue;
+    const base = join(opts.outDir, target);
+    const entries = [];
+    for (const { entry, result } of compiled) {
+      const output = result.targets.find((t) => t.target === target);
+      if (!output) continue;
+      const p = result.fb.plugin;
+      written.push(...placePluginArtifacts(output, base, p.name));
+      entries.push({
+        name: p.name,
+        source: `./plugins/${p.name}`,
+        ...p.description ? { description: p.description } : {},
+        version: entry.version ?? p.version,
+        ...entry.category ? { category: entry.category } : {},
+        ...entry.tags ? { tags: entry.tags } : {}
+      });
+    }
+    const resolved = {
+      name: marketplace.name,
+      owner: marketplace.owner,
+      ...marketplace.description ? { description: marketplace.description } : {},
+      entries
+    };
+    written.push(...placeCatalog(adapter, resolved, base));
+  }
+  return { marketplace, plugins: compiled.map((c) => c.result), written };
+}
+function installResolved(fb, dependencies, opts) {
+  const result = compile(fb, { registry: opts.registry, targets: opts.targets, only: opts.only });
+  if (result.diagnostics.hasErrors) {
+    throw new CompileError("compile failed", result.diagnostics.errors);
+  }
+  const blocked = checkManagedPolicy(opts.managed, {
+    namespace: result.fb.plugin.owner.namespace,
+    badges: opts.badges
+  });
+  if (blocked) {
+    throw new CompileError("install blocked by managed policy", [
+      { severity: "error", where: "managed", message: blocked }
+    ]);
+  }
+  const artifacts = installToScope(result, opts.scope, opts.cwd);
+  const secrets = resolveConfig(result.fb.plugin, opts.cwd);
+  const entry = buildLockEntry({ result, artifacts, dependencies, ref: opts.ref, sha: opts.sha });
+  return { result, entry, secrets };
+}
+function commitLock(scope, cwd, entries, now, lockDirOverride) {
+  const dir = lockDirOverride ?? lockDirForScope(scope, cwd);
+  mkdirSync(dir, { recursive: true });
+  const lockfile = mergeLock(readLock(dir), entries, now ?? (/* @__PURE__ */ new Date()).toISOString());
+  return { lockfile, lockPath: writeLock(dir, lockfile) };
+}
+async function install(opts) {
+  const { fb, dependencies } = await loadResolved(opts.pluginDir);
+  const { ref, sha } = await gitInfo(opts.pluginDir);
+  const pi = installResolved(fb, dependencies, {
+    scope: opts.scope,
+    cwd: opts.cwd,
+    registry: opts.registry,
+    ref,
+    sha,
+    targets: opts.targets,
+    only: opts.only,
+    managed: opts.managed,
+    badges: opts.badges
+  });
+  const { lockfile, lockPath } = commitLock(
+    opts.scope,
+    opts.cwd,
+    [pi.entry],
+    opts.now,
+    opts.lockDir
+  );
+  return { ...pi, lockfile, lockPath };
+}
+async function installMarketplace(opts) {
+  const loaded = loadMarketplaceDir(opts.marketplaceDir);
+  if (!loaded.ok) {
+    throw new CompileError(
+      `failed to load marketplace in ${opts.marketplaceDir}`,
+      issuesToDiagnostics(loaded.issues)
+    );
+  }
+  const { marketplace, root } = loaded.value;
+  const installs = [];
+  for (const entry of marketplace.plugins) {
+    let resolved;
+    try {
+      resolved = await resolvePluginRefFull(entry.plugin, root);
+    } catch (err) {
+      throw new CompileError(`marketplace entry "${entry.plugin}" failed`, [
+        { severity: "error", where: "plugins", message: err.message }
+      ]);
+    }
+    let fb = resolved.fb;
+    if (entry.version) fb = { ...fb, plugin: { ...fb.plugin, version: entry.version } };
+    const { fb: merged, dependencies } = await resolveDependencies(fb);
+    installs.push(
+      installResolved(merged, dependencies, {
+        scope: opts.scope,
+        cwd: opts.cwd,
+        registry: opts.registry,
+        ref: resolved.ref,
+        sha: resolved.sha,
+        targets: opts.targets,
+        managed: opts.managed
+      })
+    );
+  }
+  const { lockfile, lockPath } = commitLock(
+    opts.scope,
+    opts.cwd,
+    installs.map((i) => i.entry),
+    opts.now,
+    opts.lockDir
+  );
+  return { marketplace, lockfile, lockPath, installs };
+}
+function pruneEmptyDirs(paths) {
+  const dirs = new Set(paths.map((p) => dirname(p)));
+  for (const start of dirs) {
+    let d = start;
+    while (d && d !== dirname(d)) {
+      try {
+        if (readdirSync(d).length > 0) break;
+        rmSync(d, { recursive: true, force: true });
+      } catch {
+        break;
+      }
+      d = dirname(d);
+    }
+  }
+}
+function uninstall(opts) {
+  const lock = readLock(opts.dir);
+  if (!lock) {
+    throw new CompileError("nothing to uninstall", [
+      { severity: "error", where: "weft.lock", message: `no weft.lock found in ${opts.dir}` }
+    ]);
+  }
+  const match = opts.plugin;
+  const ids = new Set(
+    (match ? lock.plugins.filter((p) => p.id === match || p.id.endsWith(`/${match}`)) : lock.plugins).map((p) => p.id)
+  );
+  if (match && ids.size === 0) {
+    throw new CompileError(`plugin "${match}" is not installed here`, [
+      { severity: "error", where: "weft.lock", message: `no plugin matching "${match}"` }
+    ]);
+  }
+  const removed = [];
+  for (const a of lock.artifacts) {
+    if (!ids.has(a.plugin)) continue;
+    if (existsSync(a.path)) {
+      rmSync(a.path, { force: true });
+      removed.push(a.path);
+    }
+  }
+  pruneEmptyDirs(removed);
+  const remaining = lock.plugins.filter((p) => !ids.has(p.id));
+  if (remaining.length === 0) {
+    rmSync(join(opts.dir, "weft.lock"), { force: true });
+  } else {
+    writeLock(opts.dir, {
+      ...lock,
+      plugins: remaining,
+      artifacts: lock.artifacts.filter((a) => !ids.has(a.plugin))
+    });
+  }
+  return { removed, plugins: [...ids] };
+}
+async function update(opts) {
+  const lockDir = opts.lockDir ?? lockDirForScope(opts.scope, opts.cwd);
+  const prev = readLock(lockDir);
+  const { fb, dependencies } = await loadResolved(opts.pluginDir);
+  const result = compile(fb, { registry: opts.registry, targets: opts.targets, only: opts.only });
+  if (result.diagnostics.hasErrors) {
+    throw new CompileError("compile failed", result.diagnostics.errors);
+  }
+  const prevHash = new Map(
+    (prev?.artifacts ?? []).filter((a) => a.plugin === result.id).map((a) => [a.path, a.hash])
+  );
+  const planned = planScopeArtifacts(result, opts.scope, opts.cwd);
+  const changed = [];
+  for (const { record, contents } of planned) {
+    if (prevHash.get(record.path) === record.hash) continue;
+    mkdirSync(dirname(record.path), { recursive: true });
+    writeFileSync(record.path, contents);
+    changed.push(record.path);
+  }
+  const { ref, sha } = await gitInfo(opts.pluginDir);
+  const entry = buildLockEntry({
+    result,
+    artifacts: planned.map((p) => p.record),
+    dependencies,
+    ref,
+    sha
+  });
+  mkdirSync(lockDir, { recursive: true });
+  const lockfile = mergeLock(prev, [entry], opts.now ?? (/* @__PURE__ */ new Date()).toISOString());
+  const lockPath = writeLock(lockDir, lockfile);
+  return { id: result.id, lockfile, lockPath, changed };
+}
+function importNativePlugin(opts) {
+  if (!opts.adapter.importNative) {
+    throw new Error(`adapter "${opts.adapter.target}" does not support import`);
+  }
+  const result = opts.adapter.importNative(opts.dir, { namespace: opts.namespace });
+  if (!result) {
+    throw new Error(`no ${opts.adapter.target} plugin or marketplace found in ${opts.dir}`);
+  }
+  mkdirSync(opts.outDir, { recursive: true });
+  if (result.kind === "marketplace") {
+    const manifestPath2 = join(opts.outDir, "marketplace.yaml");
+    writeFileSync(manifestPath2, stringifyDocument(result.marketplace));
+    return {
+      kind: "marketplace",
+      name: result.marketplace.name,
+      outDir: opts.outDir,
+      manifestPath: manifestPath2,
+      fileCount: 0
+    };
+  }
+  const manifestPath = join(opts.outDir, "weft.yaml");
+  writeFileSync(manifestPath, stringifyDocument(result.plugin));
+  for (const f of result.files) {
+    const abs = join(opts.outDir, f.relPath);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(
+      abs,
+      typeof f.contents === "string" ? Buffer.from(f.contents, "utf8") : f.contents
+    );
+  }
+  return {
+    kind: "plugin",
+    name: result.plugin.name,
+    outDir: opts.outDir,
+    manifestPath,
+    fileCount: result.files.length,
+    id: `${result.plugin.owner.namespace}/${result.plugin.name}`
+  };
+}
+
+// src/registry.ts
+var AdapterRegistry = class {
+  adapters = /* @__PURE__ */ new Map();
+  register(adapter) {
+    this.adapters.set(adapter.target, adapter);
+    return this;
+  }
+  get(target) {
+    return this.adapters.get(target);
+  }
+  has(target) {
+    return this.adapters.has(target);
+  }
+  get targets() {
+    return [...this.adapters.keys()];
+  }
+};
+function artifactDigest(lock) {
+  const lines = lock.artifacts.map((a) => `${a.component}	${a.target}	${a.hash}`).sort();
+  return createHash("sha256").update(lines.join("\n")).digest();
+}
+function generateSigningKeys() {
+  return generateKeyPairSync("ed25519");
+}
+function signLock(lock, privateKey) {
+  return sign(null, artifactDigest(lock), privateKey).toString("base64");
+}
+function verifyLockSignature(lock, publicKey, signature) {
+  try {
+    return verify(null, artifactDigest(lock), publicKey, Buffer.from(signature, "base64"));
+  } catch {
+    return false;
+  }
+}
+function verifyArtifacts(lock, publicKey, signature) {
+  const tampered = [];
+  for (const a of lock.artifacts) {
+    if (!existsSync(a.path)) {
+      tampered.push(a.path);
+      continue;
+    }
+    const actual = createHash("sha256").update(readFileSync(a.path)).digest("hex");
+    if (actual !== a.hash) tampered.push(a.path);
+  }
+  return { signatureValid: verifyLockSignature(lock, publicKey, signature), tampered };
+}
+
+export { AdapterRegistry, CACHE_DIR, CompileError, Diagnostics, WEFT_VERSION, artifactDigest, build, buildLockEntry, buildMarketplace, buildToDir, checkManagedPolicy, checkMinVersion, compile, fileAccessors, generateSigningKeys, gitInfo, hasMarketplaceManifest, importNativePlugin, install, installMarketplace, installToScope, lint, loadMarketplaceDir, loadPluginDir, lockDirForScope, mergeLock, parseSource, placeCatalog, placePluginArtifacts, planScopeArtifacts, readLock, resolveAliases, resolveConfig, resolveDependencies, resolveDependency, resolvePluginRef, resolvePluginRefFull, resolveSourceDir, serializeLock, sha256, signLock, staticPass, synthMarketplace, uninstall, update, validatePlugin, verifyArtifacts, verifyLockSignature, writeLock };
+//# sourceMappingURL=index.js.map
+//# sourceMappingURL=index.js.map