@modularcore/registry 0.2.0

package/dist/build-registry.d.ts

@@ -0,0 +1,19 @@
+import type { RegistryIndexEntry } from './schema.js';
+export interface BuildRegistryOptions {
+    packagesRoot: string;
+    outputDir: string;
+}
+export interface BuildRegistrySummary {
+    outputDir: string;
+    publicIndex: RegistryIndexEntry[];
+    componentNames: string[];
+}
+/**
+ * Scans `packages/*\/modularcore.json`, validates each descriptor, reads its `files[]`
+ * content, and emits `index.json` + `{name}.json` + `{name}.tar.gz` per component.
+ * `internal` components are built (so the local spike can read them) but excluded from
+ * `index.json` (FMA2). Output is staged in a temp dir and moved into place with a single
+ * `rename` (FMA6) so partial builds are never visible at `outputDir`.
+ */
+export declare function buildRegistry({ packagesRoot, outputDir, }: BuildRegistryOptions): Promise<BuildRegistrySummary>;
+//# sourceMappingURL=build-registry.d.ts.map

package/dist/build-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-registry.d.ts","sourceRoot":"","sources":["../src/build-registry.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAA0C,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE9F,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,kBAAkB,EAAE,CAAC;IAClC,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAyHD;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,EAClC,YAAY,EACZ,SAAS,GACV,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoDtD"}

package/dist/build-registry.js

@@ -0,0 +1,166 @@
+import { randomUUID } from 'node:crypto';
+import { mkdir, mkdtemp, readFile, readdir, realpath, rename, rm, stat, writeFile, } from 'node:fs/promises';
+import { dirname, join, resolve, sep } from 'node:path';
+import { registryDescriptorSchema } from './schema.zod.js';
+import { buildTarball } from './tarball.js';
+async function findComponentDirs(packagesRoot) {
+    const entries = await readdir(packagesRoot, { withFileTypes: true });
+    const dirs = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        const descriptorPath = join(packagesRoot, entry.name, 'modularcore.json');
+        try {
+            await stat(descriptorPath);
+            dirs.push(join(packagesRoot, entry.name));
+        }
+        catch {
+            // No descriptor in this package: it is a plain package, not a registry component.
+        }
+    }
+    return dirs;
+}
+async function loadDescriptor(componentDir) {
+    const descriptorPath = join(componentDir, 'modularcore.json');
+    const raw = await readFile(descriptorPath, 'utf8');
+    let json;
+    try {
+        json = JSON.parse(raw);
+    }
+    catch (error) {
+        throw new Error(`Invalid JSON in ${descriptorPath}: ${error.message}`);
+    }
+    const parsed = registryDescriptorSchema.safeParse(json);
+    if (!parsed.success) {
+        throw new Error(`Invalid descriptor ${descriptorPath}: ${parsed.error.message}`);
+    }
+    return parsed.data;
+}
+/**
+ * SA1: the zod schema already rejects ".." and absolute paths, but a symlink inside the
+ * package could still resolve outside it. This resolves the real path and re-asserts
+ * containment before any file content is read into the public registry output.
+ */
+async function assertSafeSourcePath(componentRealDir, filePath) {
+    const candidate = resolve(componentRealDir, filePath);
+    let real;
+    try {
+        real = await realpath(candidate);
+    }
+    catch (error) {
+        throw new Error(`File not found or unreadable: ${candidate} (${error.message})`);
+    }
+    const prefix = componentRealDir.endsWith(sep) ? componentRealDir : componentRealDir + sep;
+    if (real !== componentRealDir && !real.startsWith(prefix)) {
+        throw new Error(`Refusing to read outside package root: "${filePath}" escapes ${componentRealDir}`);
+    }
+    return real;
+}
+/**
+ * AD3: `encoding` is author-declared, not trusted blindly. If a file is declared `utf8`
+ * but its bytes don't round-trip losslessly through UTF-8 (i.e. it's actually binary),
+ * `Buffer.toString('utf8')` would silently replace invalid sequences with U+FFFD instead
+ * of failing — corrupting the registry output without any build error. Detect that case
+ * and fail loud instead of guessing.
+ */
+function isValidUtf8(buffer) {
+    return buffer.equals(Buffer.from(buffer.toString('utf8'), 'utf8'));
+}
+async function readEntryFile(componentRealDir, file) {
+    const realFilePath = await assertSafeSourcePath(componentRealDir, file.path);
+    const buffer = await readFile(realFilePath);
+    if (file.encoding === 'utf8' && !isValidUtf8(buffer)) {
+        throw new Error(`File "${file.path}" is declared encoding:"utf8" but contains binary/invalid UTF-8 content. ` +
+            `Declare it as encoding:"base64" in modularcore.json instead.`);
+    }
+    const content = file.encoding === 'base64' ? buffer.toString('base64') : buffer.toString('utf8');
+    return { ...file, content };
+}
+async function buildEntry(descriptor, componentDir) {
+    const componentRealDir = await realpath(componentDir);
+    const files = [];
+    for (const file of descriptor.files) {
+        files.push(await readEntryFile(componentRealDir, file));
+    }
+    return { ...descriptor, files };
+}
+function toIndexEntry(descriptor) {
+    return {
+        name: descriptor.name,
+        title: descriptor.title,
+        category: descriptor.category,
+        version: descriptor.version,
+        frameworks: descriptor.frameworks,
+        description: descriptor.description,
+    };
+}
+/**
+ * FMA6: cross-checks every emitted component (public AND internal — internal entries are
+ * still read locally by the inject spike / future CLI dev flows) has a non-empty
+ * `{name}.json` and `{name}.tar.gz`.
+ */
+async function validateBuildOutput(dir, componentNames) {
+    for (const name of componentNames) {
+        const jsonPath = join(dir, `${name}.json`);
+        const tarPath = join(dir, `${name}.tar.gz`);
+        const [jsonStat, tarStat] = await Promise.all([stat(jsonPath), stat(tarPath)]);
+        if (jsonStat.size === 0)
+            throw new Error(`Post-build validation failed: ${jsonPath} is empty`);
+        if (tarStat.size === 0)
+            throw new Error(`Post-build validation failed: ${tarPath} is empty`);
+    }
+}
+/**
+ * Scans `packages/*\/modularcore.json`, validates each descriptor, reads its `files[]`
+ * content, and emits `index.json` + `{name}.json` + `{name}.tar.gz` per component.
+ * `internal` components are built (so the local spike can read them) but excluded from
+ * `index.json` (FMA2). Output is staged in a temp dir and moved into place with a single
+ * `rename` (FMA6) so partial builds are never visible at `outputDir`.
+ */
+export async function buildRegistry({ packagesRoot, outputDir, }) {
+    const componentDirs = await findComponentDirs(packagesRoot);
+    if (componentDirs.length === 0) {
+        throw new Error(`No components with modularcore.json found under ${packagesRoot}`);
+    }
+    const entries = [];
+    const seenNames = new Set();
+    for (const componentDir of componentDirs) {
+        const descriptor = await loadDescriptor(componentDir);
+        if (seenNames.has(descriptor.name)) {
+            throw new Error(`Duplicate component name "${descriptor.name}" across packages/*`);
+        }
+        seenNames.add(descriptor.name);
+        entries.push(await buildEntry(descriptor, componentDir));
+    }
+    // Stage on the same filesystem/volume as `outputDir` (not the OS tmpdir): the final
+    // `rename` must be an atomic same-device move, and cross-device renames (EXDEV) fail
+    // outright — a real risk here since the project can live on a different volume than /tmp.
+    const outputParent = dirname(outputDir);
+    await mkdir(outputParent, { recursive: true });
+    const tmpRoot = await mkdtemp(join(outputParent, `.modularcore-registry-${randomUUID()}-`));
+    try {
+        const publicIndex = [];
+        for (const entry of entries) {
+            await writeFile(join(tmpRoot, `${entry.name}.json`), JSON.stringify(entry, null, 2), 'utf8');
+            const tarball = await buildTarball(entry.files);
+            await writeFile(join(tmpRoot, `${entry.name}.tar.gz`), tarball);
+            if (entry.visibility === 'public') {
+                publicIndex.push(toIndexEntry(entry));
+            }
+        }
+        await writeFile(join(tmpRoot, 'index.json'), JSON.stringify(publicIndex, null, 2), 'utf8');
+        await validateBuildOutput(tmpRoot, entries.map((entry) => entry.name));
+        await rm(outputDir, { recursive: true, force: true });
+        await rename(tmpRoot, outputDir);
+        return {
+            outputDir,
+            publicIndex,
+            componentNames: entries.map((entry) => entry.name),
+        };
+    }
+    catch (error) {
+        await rm(tmpRoot, { recursive: true, force: true });
+        throw error;
+    }
+}
+//# sourceMappingURL=build-registry.js.map

package/dist/build-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-registry.js","sourceRoot":"","sources":["../src/build-registry.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACL,KAAK,EACL,OAAO,EACP,QAAQ,EACR,OAAO,EACP,QAAQ,EACR,MAAM,EACN,EAAE,EACF,IAAI,EACJ,SAAS,GACV,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAExD,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAgB5C,KAAK,UAAU,iBAAiB,CAAC,YAAoB;IACnD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,SAAS;QACnC,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;QAC1E,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,cAAc,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,kFAAkF;QACpF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,YAAoB;IAChD,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;IAC9D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mBAAmB,cAAc,KAAM,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACpF,CAAC;IACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CAAC,sBAAsB,cAAc,KAAK,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAAC,gBAAwB,EAAE,QAAgB;IAC5E,MAAM,SAAS,GAAG,OAAO,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,KAAM,KAAe,CAAC,OAAO,GAAG,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,GAAG,GAAG,CAAC;IAC1F,IAAI,IAAI,KAAK,gBAAgB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,KAAK,CACb,2CAA2C,QAAQ,aAAa,gBAAgB,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,MAAc;IACjC,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,gBAAwB,EACxB,IAA+C;IAE/C,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,CAAC,IAAI,2EAA2E;YAC3F,8DAA8D,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjG,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,UAAoC,EACpC,YAAoB;IAEpB,MAAM,gBAAgB,GAAG,MAAM,QAAQ,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,KAAK,GAA8B,EAAE,CAAC;IAC5C,KAAK,MAAM,IAAI,IAAI,UAAU,CAAC,KAAK,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,GAAG,UAAU,EAAE,KAAK,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,YAAY,CAAC,UAAoC;IACxD,OAAO;QACL,IAAI,EAAE,UAAU,CAAC,IAAI;QACrB,KAAK,EAAE,UAAU,CAAC,KAAK;QACvB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,OAAO,EAAE,UAAU,CAAC,OAAO;QAC3B,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,WAAW,EAAE,UAAU,CAAC,WAAW;KACpC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,GAAW,EAAE,cAAwB;IACtE,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,SAAS,CAAC,CAAC;QAC5C,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,QAAQ,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,QAAQ,WAAW,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,OAAO,WAAW,CAAC,CAAC;IAC/F,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAClC,YAAY,EACZ,SAAS,GACY;IACrB,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,mDAAmD,YAAY,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,6BAA6B,UAAU,CAAC,IAAI,qBAAqB,CAAC,CAAC;QACrF,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,oFAAoF;IACpF,qFAAqF;IACrF,0FAA0F;IAC1F,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,yBAAyB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC;QACH,MAAM,WAAW,GAAyB,EAAE,CAAC;QAC7C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,OAAO,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7F,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAChD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;YAChE,IAAI,KAAK,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;gBAClC,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;QACD,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QAE3F,MAAM,mBAAmB,CACvB,OAAO,EACP,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CACnC,CAAC;QAEF,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAEjC,OAAO;YACL,SAAS;YACT,WAAW;YACX,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;SACnD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,9 @@
+export type { ComponentType, EnvVariableDescriptor, FileEncoding, RegistryDescriptor, RegistryEntry, RegistryFileDescriptor, RegistryFileWithContent, RegistryIndexEntry, SupportedFramework, Visibility, } from './schema.js';
+export { envVariableSchema, fileEncodingSchema, registryDescriptorSchema, registryEntrySchema, registryFileSchema, registryFileWithContentSchema, registryIndexEntrySchema, visibilitySchema, } from './schema.zod.js';
+export type { RegistryDescriptorInput, RegistryDescriptorParsed } from './schema.zod.js';
+export { buildRegistry } from './build-registry.js';
+export type { BuildRegistryOptions, BuildRegistrySummary } from './build-registry.js';
+export { buildTarball } from './tarball.js';
+export { resolveWriteTargetPath, writeRegistryEntryFiles } from './resolve-write.js';
+export type { WriteResult } from './resolve-write.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,aAAa,EACb,qBAAqB,EACrB,YAAY,EACZ,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,kBAAkB,EAClB,kBAAkB,EAClB,UAAU,GACX,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAEzF,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,YAAY,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEtF,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AACrF,YAAY,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,5 @@
+export { envVariableSchema, fileEncodingSchema, registryDescriptorSchema, registryEntrySchema, registryFileSchema, registryFileWithContentSchema, registryIndexEntrySchema, visibilitySchema, } from './schema.zod.js';
+export { buildRegistry } from './build-registry.js';
+export { buildTarball } from './tarball.js';
+export { resolveWriteTargetPath, writeRegistryEntryFiles } from './resolve-write.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAaA,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,wBAAwB,EACxB,mBAAmB,EACnB,kBAAkB,EAClB,6BAA6B,EAC7B,wBAAwB,EACxB,gBAAgB,GACjB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/resolve-write.d.ts

@@ -0,0 +1,17 @@
+import type { RegistryEntry } from './schema.js';
+export interface WriteResult {
+    target: string;
+    bytesWritten: number;
+}
+/**
+ * Shared by the spike injector (`scripts/inject-spike.mjs`) and the future CLI (Phase 3),
+ * so path-clamp and decoding logic has a single source of truth instead of being
+ * reimplemented per consumer.
+ */
+export declare function resolveWriteTargetPath(projectRoot: string, fileTarget: string): string;
+/**
+ * Writes every `files[]` entry of a validated registry entry into `projectRoot`, honoring
+ * each file's `target` and `encoding`. Pure I/O helper: no fetch, no CLI concerns.
+ */
+export declare function writeRegistryEntryFiles(entry: Pick<RegistryEntry, 'files'>, projectRoot: string): Promise<WriteResult[]>;
+//# sourceMappingURL=resolve-write.d.ts.map

package/dist/resolve-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-write.d.ts","sourceRoot":"","sources":["../src/resolve-write.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAA2B,MAAM,aAAa,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAatF;AAQD;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EACnC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,EAAE,CAAC,CAUxB"}

package/dist/resolve-write.js

@@ -0,0 +1,40 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, isAbsolute, resolve } from 'node:path';
+/**
+ * Shared by the spike injector (`scripts/inject-spike.mjs`) and the future CLI (Phase 3),
+ * so path-clamp and decoding logic has a single source of truth instead of being
+ * reimplemented per consumer.
+ */
+export function resolveWriteTargetPath(projectRoot, fileTarget) {
+    if (isAbsolute(fileTarget)) {
+        throw new Error(`Refusing to write outside target root: "${fileTarget}" is an absolute path`);
+    }
+    const root = resolve(projectRoot);
+    const resolved = resolve(root, fileTarget);
+    const rootWithSep = root.endsWith('/') ? root : `${root}/`;
+    if (resolved !== root && !resolved.startsWith(rootWithSep)) {
+        throw new Error(`Refusing to write outside target root: "${fileTarget}" escapes "${projectRoot}"`);
+    }
+    return resolved;
+}
+function decodeFileContent(file) {
+    return file.encoding === 'base64'
+        ? Buffer.from(file.content, 'base64')
+        : Buffer.from(file.content, 'utf8');
+}
+/**
+ * Writes every `files[]` entry of a validated registry entry into `projectRoot`, honoring
+ * each file's `target` and `encoding`. Pure I/O helper: no fetch, no CLI concerns.
+ */
+export async function writeRegistryEntryFiles(entry, projectRoot) {
+    const results = [];
+    for (const file of entry.files) {
+        const destination = resolveWriteTargetPath(projectRoot, file.target);
+        const content = decodeFileContent(file);
+        await mkdir(dirname(destination), { recursive: true });
+        await writeFile(destination, content);
+        results.push({ target: destination, bytesWritten: content.byteLength });
+    }
+    return results;
+}
+//# sourceMappingURL=resolve-write.js.map

package/dist/resolve-write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-write.js","sourceRoot":"","sources":["../src/resolve-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AASzD;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,WAAmB,EAAE,UAAkB;IAC5E,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,2CAA2C,UAAU,uBAAuB,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IAClC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC;IAC3D,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,2CAA2C,UAAU,cAAc,WAAW,GAAG,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA6B;IACtD,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ;QAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;QACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC,EACnC,WAAmB;IAEnB,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,WAAW,GAAG,sBAAsB,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/schema.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Descriptor types for a ModularCore registry component (`modularcore.json`).
+ * Runtime validation lives in `schema.zod.ts`; keep both in sync.
+ */
+/** Extensible component kind. New kinds (e.g. `agent-tool`) can be added without breaking existing descriptors. */
+export type ComponentType = 'frontend-component' | 'headless-core' | 'snippet' | (string & {});
+export type SupportedFramework = 'react' | 'svelte' | (string & {});
+/** `internal` components are built and locally resolvable but excluded from the public `index.json`. */
+export type Visibility = 'public' | 'internal';
+export type FileEncoding = 'utf8' | 'base64';
+export interface EnvVariableDescriptor {
+    key: string;
+    description: string;
+    required: boolean;
+}
+export interface RegistryFileDescriptor {
+    /** Path to the source file, relative to the component's package root (e.g. `packages/{name}/`). */
+    path: string;
+    /** Path (relative to the consumer project root) where the file should be written when injected. */
+    target: string;
+    /** File kind, informational for consumers (e.g. `component`, `hook`, `style`). */
+    type: string;
+    encoding: FileEncoding;
+}
+export interface RegistryDescriptor {
+    name: string;
+    version: string;
+    title: string;
+    type: ComponentType;
+    category: string;
+    frameworks: SupportedFramework[];
+    visibility: Visibility;
+    /** Semver ranges keyed by peer framework, e.g. `{ "react": ">=18" }`. Gates `add` (Phase 3) before writing runes/hooks. */
+    peerDependencies: Record<string, string>;
+    dependencies: string[];
+    registryDependencies: string[];
+    envVariables: EnvVariableDescriptor[];
+    files: RegistryFileDescriptor[];
+    description?: string;
+}
+/** A file descriptor plus its resolved content, as embedded inline into `{name}.json`. */
+export interface RegistryFileWithContent extends RegistryFileDescriptor {
+    content: string;
+}
+/** Full descriptor as served at `/registry/{name}.json`. */
+export interface RegistryEntry extends Omit<RegistryDescriptor, 'files'> {
+    files: RegistryFileWithContent[];
+}
+/** Summarized entry as served at `/registry/index.json`. Excludes `visibility: internal` entries. */
+export interface RegistryIndexEntry {
+    name: string;
+    title: string;
+    category: string;
+    version: string;
+    frameworks: SupportedFramework[];
+    description?: string;
+}
+//# sourceMappingURL=schema.d.ts.map

package/dist/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,mHAAmH;AACnH,MAAM,MAAM,aAAa,GAAG,oBAAoB,GAAG,eAAe,GAAG,SAAS,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAE/F,MAAM,MAAM,kBAAkB,GAAG,OAAO,GAAG,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAEpE,wGAAwG;AACxG,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE/C,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,QAAQ,CAAC;AAE7C,MAAM,WAAW,qBAAqB;IACpC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,sBAAsB;IACrC,mGAAmG;IACnG,IAAI,EAAE,MAAM,CAAC;IACb,mGAAmG;IACnG,MAAM,EAAE,MAAM,CAAC;IACf,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,YAAY,CAAC;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,UAAU,EAAE,UAAU,CAAC;IACvB,2HAA2H;IAC3H,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,YAAY,EAAE,qBAAqB,EAAE,CAAC;IACtC,KAAK,EAAE,sBAAsB,EAAE,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,0FAA0F;AAC1F,MAAM,WAAW,uBAAwB,SAAQ,sBAAsB;IACrE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,4DAA4D;AAC5D,MAAM,WAAW,aAAc,SAAQ,IAAI,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACtE,KAAK,EAAE,uBAAuB,EAAE,CAAC;CAClC;AAED,qGAAqG;AACrG,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,kBAAkB,EAAE,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/dist/schema.js

@@ -0,0 +1,6 @@
+/**
+ * Descriptor types for a ModularCore registry component (`modularcore.json`).
+ * Runtime validation lives in `schema.zod.ts`; keep both in sync.
+ */
+export {};
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/schema.zod.d.ts

@@ -0,0 +1,118 @@
+import { z } from 'zod';
+export declare const envVariableSchema: z.ZodObject<{
+    key: z.ZodString;
+    description: z.ZodString;
+    required: z.ZodBoolean;
+}, z.core.$strip>;
+export declare const fileEncodingSchema: z.ZodEnum<{
+    utf8: "utf8";
+    base64: "base64";
+}>;
+export declare const registryFileSchema: z.ZodObject<{
+    path: z.ZodString;
+    target: z.ZodString;
+    type: z.ZodString;
+    encoding: z.ZodEnum<{
+        utf8: "utf8";
+        base64: "base64";
+    }>;
+}, z.core.$strip>;
+export declare const componentTypeSchema: z.ZodUnion<readonly [z.ZodEnum<{
+    "frontend-component": "frontend-component";
+    "headless-core": "headless-core";
+    snippet: "snippet";
+}>, z.ZodString]>;
+export declare const visibilitySchema: z.ZodDefault<z.ZodEnum<{
+    public: "public";
+    internal: "internal";
+}>>;
+export declare const registryDescriptorSchema: z.ZodObject<{
+    name: z.ZodString;
+    version: z.ZodString;
+    title: z.ZodString;
+    type: z.ZodUnion<readonly [z.ZodEnum<{
+        "frontend-component": "frontend-component";
+        "headless-core": "headless-core";
+        snippet: "snippet";
+    }>, z.ZodString]>;
+    category: z.ZodString;
+    frameworks: z.ZodArray<z.ZodString>;
+    visibility: z.ZodDefault<z.ZodEnum<{
+        public: "public";
+        internal: "internal";
+    }>>;
+    peerDependencies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    dependencies: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    registryDependencies: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    envVariables: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        description: z.ZodString;
+        required: z.ZodBoolean;
+    }, z.core.$strip>>>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        target: z.ZodString;
+        type: z.ZodString;
+        encoding: z.ZodEnum<{
+            utf8: "utf8";
+            base64: "base64";
+        }>;
+    }, z.core.$strip>>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type RegistryDescriptorInput = z.input<typeof registryDescriptorSchema>;
+export type RegistryDescriptorParsed = z.output<typeof registryDescriptorSchema>;
+export declare const registryFileWithContentSchema: z.ZodObject<{
+    path: z.ZodString;
+    target: z.ZodString;
+    type: z.ZodString;
+    encoding: z.ZodEnum<{
+        utf8: "utf8";
+        base64: "base64";
+    }>;
+    content: z.ZodString;
+}, z.core.$strip>;
+export declare const registryEntrySchema: z.ZodObject<{
+    type: z.ZodUnion<readonly [z.ZodEnum<{
+        "frontend-component": "frontend-component";
+        "headless-core": "headless-core";
+        snippet: "snippet";
+    }>, z.ZodString]>;
+    description: z.ZodOptional<z.ZodString>;
+    visibility: z.ZodDefault<z.ZodEnum<{
+        public: "public";
+        internal: "internal";
+    }>>;
+    name: z.ZodString;
+    version: z.ZodString;
+    title: z.ZodString;
+    category: z.ZodString;
+    frameworks: z.ZodArray<z.ZodString>;
+    peerDependencies: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodString>>;
+    dependencies: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    registryDependencies: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    envVariables: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        key: z.ZodString;
+        description: z.ZodString;
+        required: z.ZodBoolean;
+    }, z.core.$strip>>>;
+    files: z.ZodArray<z.ZodObject<{
+        path: z.ZodString;
+        target: z.ZodString;
+        type: z.ZodString;
+        encoding: z.ZodEnum<{
+            utf8: "utf8";
+            base64: "base64";
+        }>;
+        content: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const registryIndexEntrySchema: z.ZodObject<{
+    name: z.ZodString;
+    title: z.ZodString;
+    category: z.ZodString;
+    version: z.ZodString;
+    frameworks: z.ZodArray<z.ZodString>;
+    description: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+//# sourceMappingURL=schema.zod.d.ts.map

package/dist/schema.zod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.zod.d.ts","sourceRoot":"","sources":["../src/schema.zod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAoBxB,eAAO,MAAM,iBAAiB;;;;iBAI5B,CAAC;AAEH,eAAO,MAAM,kBAAkB;;;EAA6B,CAAC;AAE7D,eAAO,MAAM,kBAAkB;;;;;;;;iBAK7B,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;iBAG9B,CAAC;AAEH,eAAO,MAAM,gBAAgB;;;GAAmD,CAAC;AAEjF,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiBnC,CAAC;AAEH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAC/E,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAEjF,eAAO,MAAM,6BAA6B;;;;;;;;;iBAExC,CAAC;AAEH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAEmC,CAAC;AAEpE,eAAO,MAAM,wBAAwB;;;;;;;iBAOnC,CAAC"}

package/dist/schema.zod.js

@@ -0,0 +1,70 @@
+import { z } from 'zod';
+/**
+ * SA1 (red-team, Critical): a malicious/misconfigured `files[].path` (e.g. `../../.env`
+ * or an absolute path) must never be accepted at the schema level, so the builder can
+ * trust `path` before doing its own filesystem-level clamp (defense in depth).
+ */
+function isSafeRelativePath(value) {
+    if (value.length === 0)
+        return false;
+    if (value.startsWith('/') || value.startsWith('\\'))
+        return false;
+    // Windows drive letter, e.g. "C:\\..."
+    if (/^[a-zA-Z]:/.test(value))
+        return false;
+    const segments = value.split(/[\\/]/);
+    return !segments.includes('..');
+}
+const safeRelativePathSchema = z.string().refine(isSafeRelativePath, {
+    message: 'Path must be relative and must not contain ".." or an absolute prefix',
+});
+export const envVariableSchema = z.object({
+    key: z.string().min(1),
+    description: z.string().min(1),
+    required: z.boolean(),
+});
+export const fileEncodingSchema = z.enum(['utf8', 'base64']);
+export const registryFileSchema = z.object({
+    path: safeRelativePathSchema,
+    target: safeRelativePathSchema,
+    type: z.string().min(1),
+    encoding: fileEncodingSchema,
+});
+export const componentTypeSchema = z.union([
+    z.enum(['frontend-component', 'headless-core', 'snippet']),
+    z.string().min(1),
+]);
+export const visibilitySchema = z.enum(['public', 'internal']).default('public');
+export const registryDescriptorSchema = z.object({
+    name: z
+        .string()
+        .min(1)
+        .regex(/^[a-z0-9][a-z0-9-]*$/, 'name must be kebab-case'),
+    version: z.string().min(1),
+    title: z.string().min(1),
+    type: componentTypeSchema,
+    category: z.string().min(1),
+    frameworks: z.array(z.string().min(1)).min(1),
+    visibility: visibilitySchema,
+    peerDependencies: z.record(z.string(), z.string()).default({}),
+    dependencies: z.array(z.string()).default([]),
+    registryDependencies: z.array(z.string()).default([]),
+    envVariables: z.array(envVariableSchema).default([]),
+    files: z.array(registryFileSchema).min(1),
+    description: z.string().optional(),
+});
+export const registryFileWithContentSchema = registryFileSchema.extend({
+    content: z.string(),
+});
+export const registryEntrySchema = registryDescriptorSchema
+    .omit({ files: true })
+    .extend({ files: z.array(registryFileWithContentSchema).min(1) });
+export const registryIndexEntrySchema = z.object({
+    name: z.string(),
+    title: z.string(),
+    category: z.string(),
+    version: z.string(),
+    frameworks: z.array(z.string()),
+    description: z.string().optional(),
+});
+//# sourceMappingURL=schema.zod.js.map

package/dist/schema.zod.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.zod.js","sourceRoot":"","sources":["../src/schema.zod.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,KAAa;IACvC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,uCAAuC;IACvC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,EAAE;IACnE,OAAO,EAAE,uEAAuE;CACjF,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACtB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9B,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;CACtB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE7D,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,IAAI,EAAE,sBAAsB;IAC5B,MAAM,EAAE,sBAAsB;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACvB,QAAQ,EAAE,kBAAkB;CAC7B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC,CAAC,IAAI,CAAC,CAAC,oBAAoB,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;IAC1D,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAClB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,sBAAsB,EAAE,yBAAyB,CAAC;IAC3D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1B,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,mBAAmB;IACzB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,UAAU,EAAE,gBAAgB;IAC5B,gBAAgB,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC7C,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACrD,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACpD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACzC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC;AAKH,MAAM,CAAC,MAAM,6BAA6B,GAAG,kBAAkB,CAAC,MAAM,CAAC;IACrE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;CACpB,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,wBAAwB;KACxD,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;KACrB,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/C,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;IAChB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE;IACpB,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE;IACnB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC/B,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CACnC,CAAC,CAAC"}

package/dist/tarball.d.ts

@@ -0,0 +1,8 @@
+import type { RegistryFileWithContent } from './schema.js';
+/**
+ * `tar-stream` builds the tar entries in memory (no filesystem round-trip), and
+ * `zlib.gzipSync` (Node builtin) compresses the resulting buffer — avoids depending on a
+ * full `tar` CLI wrapper package just to produce a `.tar.gz` from in-memory content.
+ */
+export declare function buildTarball(files: RegistryFileWithContent[]): Promise<Buffer>;
+//# sourceMappingURL=tarball.d.ts.map

package/dist/tarball.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.d.ts","sourceRoot":"","sources":["../src/tarball.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAE3D;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,KAAK,EAAE,uBAAuB,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBpF"}

package/dist/tarball.js

@@ -0,0 +1,28 @@
+import { gzipSync } from 'node:zlib';
+import { pack } from 'tar-stream';
+/**
+ * `tar-stream` builds the tar entries in memory (no filesystem round-trip), and
+ * `zlib.gzipSync` (Node builtin) compresses the resulting buffer — avoids depending on a
+ * full `tar` CLI wrapper package just to produce a `.tar.gz` from in-memory content.
+ */
+export async function buildTarball(files) {
+    const tarPack = pack();
+    const chunks = [];
+    tarPack.on('data', (chunk) => chunks.push(chunk));
+    const done = new Promise((resolvePromise, rejectPromise) => {
+        tarPack.on('end', () => resolvePromise(Buffer.concat(chunks)));
+        tarPack.on('error', rejectPromise);
+    });
+    for (const file of files) {
+        const content = file.encoding === 'base64'
+            ? Buffer.from(file.content, 'base64')
+            : Buffer.from(file.content, 'utf8');
+        await new Promise((resolveEntry, rejectEntry) => {
+            tarPack.entry({ name: file.target }, content, (error) => error ? rejectEntry(error) : resolveEntry());
+        });
+    }
+    tarPack.finalize();
+    const tarBuffer = await done;
+    return gzipSync(tarBuffer);
+}
+//# sourceMappingURL=tarball.js.map

package/dist/tarball.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.js","sourceRoot":"","sources":["../src/tarball.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAIlC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,KAAgC;IACjE,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1D,MAAM,IAAI,GAAG,IAAI,OAAO,CAAS,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;QACjE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC/D,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GACX,IAAI,CAAC,QAAQ,KAAK,QAAQ;YACxB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;YACrC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,MAAM,IAAI,OAAO,CAAO,CAAC,YAAY,EAAE,WAAW,EAAE,EAAE;YACpD,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACtD,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAC5C,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,QAAQ,EAAE,CAAC;IAEnB,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC;IAC7B,OAAO,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7B,CAAC"}

package/package.json

@@ -0,0 +1,33 @@
+{
+  "name": "@modularcore/registry",
+  "version": "0.2.0",
+  "private": false,
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "dependencies": {
+    "tar-stream": "^3.2.0",
+    "zod": "^4.4.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.13.0",
+    "@types/tar-stream": "^3.1.4"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run"
+  }
+}