@oomerevren/tryforge 0.1.2

package/dist/cli/src/core/registry.js

@@ -0,0 +1,137 @@
+import { readFileSync, existsSync } from "fs";
+import { join } from "path";
+import { toSlug } from "./store.js";
+import { maxSatisfying } from "./semver.js";
+import { loadConfig } from "./config.js";
+function registryRoot() {
+    // Epoch 1d: config.registry desteği — uzak index URL'si kullanıcı tarafından belirtilebilir
+    try {
+        const cfg = loadConfig();
+        if (cfg.registry && /^https?:\/\//.test(cfg.registry)) {
+            return cfg.registry;
+        }
+    }
+    catch { }
+    const candidates = [
+        join(import.meta.dirname ?? "./", "../../../registry"),
+        join(import.meta.dirname ?? "./", "../../../../registry"),
+        join(process.cwd(), "registry"),
+    ];
+    for (const c of candidates) {
+        if (existsSync(join(c, "index.json")))
+            return c;
+    }
+    return join(import.meta.dirname ?? "./", "../../../registry");
+}
+export async function loadIndex() {
+    const root = registryRoot();
+    // Epoch 1d: uzak registry URL'si desteği
+    if (/^https?:\/\//.test(root)) {
+        try {
+            const res = await fetch(root + "/index.json");
+            if (!res.ok)
+                throw new Error(`HTTP ${res.status} for ${root}/index.json`);
+            return await res.json();
+        }
+        catch (e) {
+            throw new Error(`Remote registry fetch failed: ${e.message}`);
+        }
+    }
+    const p = join(root, "index.json");
+    if (!existsSync(p))
+        throw new Error(`Registry index not found: ${p}`);
+    return JSON.parse(readFileSync(p, "utf-8"));
+}
+export async function loadPackageDetail(pkg) {
+    const root = registryRoot();
+    const slug = toSlug(pkg);
+    // Epoch 1d: uzak registry URL'si desteği
+    if (/^https?:\/\//.test(root)) {
+        try {
+            const res = await fetch(`${root}/packages/${slug}.json`);
+            if (!res.ok)
+                throw new Error(`HTTP ${res.status} for ${root}/packages/${slug}.json`);
+            return await res.json();
+        }
+        catch (e) {
+            throw new Error(`Package not found: ${pkg} (${e.message})`);
+        }
+    }
+    const p = join(root, "packages", `${slug}.json`);
+    if (!existsSync(p))
+        throw new Error(`Package not found: ${pkg} (${p})`);
+    return JSON.parse(readFileSync(p, "utf-8"));
+}
+export async function resolveVersion(pkg, requested) {
+    const detail = await loadPackageDetail(pkg);
+    if (!requested || requested === "latest" || requested === "*") {
+        const v = detail.latest;
+        const meta = detail.versions[v];
+        if (!meta)
+            throw new Error(`Latest version ${v} not found for ${pkg}`);
+        return { detail, version: v, versionMeta: meta };
+    }
+    // exact version
+    if (detail.versions[requested]) {
+        return { detail, version: requested, versionMeta: detail.versions[requested] };
+    }
+    // semver range (Faz 10: semver.ts tek kaynak) — pick highest satisfying
+    const picked = maxSatisfying(Object.keys(detail.versions), requested);
+    if (!picked)
+        throw new Error(`No version satisfying ${requested} for ${pkg}. Available: ${Object.keys(detail.versions).join(", ")}`);
+    return { detail, version: picked, versionMeta: detail.versions[picked] };
+}
+export function parsePackageArg(arg) {
+    // anthropics/plan@1.2.0  or  anthropics/plan@^1.0.0  or  anthropics/plan
+    const at = arg.lastIndexOf("@");
+    // need to distinguish scope/name@ver vs @ver — scope always contains /
+    // So if arg is "pkg@ver", at > 0 and slash before at
+    if (at > 0 && arg.slice(0, at).includes("/")) {
+        return { name: arg.slice(0, at), version: arg.slice(at + 1) };
+    }
+    return { name: arg };
+}
+// --- semver helpers Faz 10'da semver.ts'e taşındı (tek kaynak) ---
+// Bu dosya geriye dönük uyumluluk için re-export eder.
+export { parseSemver, compareSemver, satisfiesRange, maxSatisfying, isValidRange } from "./semver.js";
+export async function searchPackages(query, opts = {}) {
+    const index = await loadIndex();
+    const tokens = query.toLowerCase().split(/\s+/).filter(Boolean);
+    if (tokens.length === 0)
+        return [];
+    const scored = [];
+    for (const p of Object.values(index.packages)) {
+        if (opts.type && p.type !== opts.type)
+            continue;
+        const name = p.name.toLowerCase();
+        const desc = (p.description ?? "").toLowerCase();
+        const kw = (p.keywords ?? []).join(" ").toLowerCase();
+        const type = (p.type ?? "").toLowerCase();
+        let score = 0;
+        for (const t of tokens) {
+            if (name === t)
+                score += 50;
+            else if (name.startsWith(t))
+                score += 15;
+            else if (name.includes(t))
+                score += 10;
+            if (kw.split(/\s+/).includes(t))
+                score += 8;
+            else if (kw.includes(t))
+                score += 5;
+            if (type === t)
+                score += 6;
+            if (desc.includes(t))
+                score += 2;
+        }
+        if (score > 0) {
+            // Verified tarballs rank first on ties — first touch should install cleanly.
+            if (p.verified)
+                score += 4;
+            scored.push({ p, score });
+        }
+    }
+    scored.sort((a, b) => b.score - a.score || a.p.name.localeCompare(b.p.name));
+    const out = scored.map((s) => s.p);
+    return typeof opts.limit === "number" ? out.slice(0, opts.limit) : out;
+}

package/dist/cli/src/core/semver.js

@@ -0,0 +1,162 @@
+// cli/src/core/semver.ts — Epoch 1c: tam semver (^ ~ >= > <= < * exact + kompozit + x-range + pre-release)
+// Tek kaynak (single source of truth) — registry.ts ve project.ts burayı kullanır.
+export function parseSemver(v) {
+    const m = v.trim().match(/^(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:[-.]?([a-zA-Z0-9.]+))?/);
+    if (!m)
+        return { major: 0, minor: 0, patch: 0 };
+    return {
+        major: parseInt(m[1], 10),
+        minor: m[2] !== undefined ? parseInt(m[2], 10) : 0,
+        patch: m[3] !== undefined ? parseInt(m[3], 10) : 0,
+        pre: m[4],
+    };
+}
+export function compareSemver(a, b) {
+    const pa = parseSemver(a);
+    const pb = parseSemver(b);
+    if (pa.major !== pb.major)
+        return pa.major - pb.major;
+    if (pa.minor !== pb.minor)
+        return pa.minor - pb.minor;
+    if (pa.patch !== pb.patch)
+        return pa.patch - pb.patch;
+    // Pre-release: 1.2.3-beta < 1.2.3 (SemVer spec)
+    if (pa.pre && !pb.pre)
+        return -1;
+    if (!pa.pre && pb.pre)
+        return 1;
+    if (pa.pre && pb.pre)
+        return pa.pre.localeCompare(pb.pre);
+    return 0;
+}
+export function isValidRange(r) {
+    const t = r.trim();
+    if (t === "*" || t === "" || t === "latest")
+        return true;
+    // Exact: 1.2.0, v1.2.0
+    if (/^v?\d+\.\d+\.\d+/.test(t))
+        return true;
+    // ^ + full semver: ^1.2.0, ^0.2.3
+    if (/^\^v?\d+\.\d+\.\d+/.test(t))
+        return true;
+    // ^ + partial: ^1.2, ^1
+    if (/^\^\d+(\.\d+)?$/.test(t))
+        return true;
+    // ~ + full semver: ~1.2.3, ~0.1.0
+    if (/^~v?\d+\.\d+\.\d+/.test(t))
+        return true;
+    // x-range: 1.x, 1.2.x, 1.*, 1.2.*
+    if (/^\d+\.(\*|x)$/.test(t))
+        return true;
+    if (/^\d+\.\d+\.(\*|x)$/.test(t))
+        return true;
+    // Kısmi aralıklar: ^1, ~1, ~1.2
+    if (/^\^\d+$/.test(t))
+        return true;
+    if (/^~\d+$/.test(t))
+        return true;
+    if (/^~\d+\.\d+$/.test(t))
+        return true;
+    // Tek operatörler: >=1.0.0, <2.0.0, =1.2.3
+    if (/^(>=|<=|>|<|=)\s*v?\d+\.\d+\.\d+/.test(t))
+        return true;
+    // Kompozit aralıklar: >=1.2.0 <2.0.0
+    if (/^(>=|<=|>|<)\s*v?\d+\.\d+\.\d+\s+(>=|<=|>|<)\s*v?\d+\.\d+\.\d+/.test(t))
+        return true;
+    return false;
+}
+export function satisfiesRange(version, range) {
+    const r = range.trim();
+    if (r === "*" || r === "" || r === "latest")
+        return true;
+    // Kompozit aralık: "op1 ver1 op2 ver2"
+    const composite = r.match(/^(>=|<=|>|<)\s*(v?\d+\.\d+\.\d+)\s+(>=|<=|>|<)\s*(v?\d+\.\d+\.\d+)$/);
+    if (composite) {
+        const [, op1, ver1, op2, ver2] = composite;
+        return applyOp(version, op1, ver1) && applyOp(version, op2, ver2);
+    }
+    // ^ (caret): ^1.2.0, ^0.2.3, ^1.2, ^1
+    if (r.startsWith("^")) {
+        const baseStr = r.slice(1).trim();
+        const base = parseSemver(baseStr);
+        if (compareSemver(version, baseStr) < 0)
+            return false;
+        const pv = parseSemver(version);
+        // ^1 → >=1.0.0 <2.0.0
+        if (baseStr.match(/^\d+$/))
+            return pv.major === base.major;
+        // ^1.2 → >=1.2.0 <2.0.0
+        if (baseStr.match(/^\d+\.\d+$/))
+            return pv.major === base.major && pv.minor === base.minor;
+        // ^1.2.3 → >=1.2.3 <2.0.0
+        if (base.major !== 0)
+            return pv.major === base.major;
+        if (base.minor !== 0)
+            return pv.major === 0 && pv.minor === base.minor;
+        return pv.major === 0 && pv.minor === 0 && pv.patch === base.patch;
+    }
+    // ~ (tilde): ~1.2.3, ~1.2, ~1
+    if (r.startsWith("~")) {
+        const baseStr = r.slice(1).trim();
+        const base = parseSemver(baseStr);
+        if (compareSemver(version, baseStr) < 0)
+            return false;
+        const pv = parseSemver(version);
+        if (baseStr.match(/^\d+\.\d+\.\d+$/)) {
+            // ~1.2.3 → >=1.2.3 <1.3.0
+            return pv.major === base.major && pv.minor === base.minor;
+        }
+        if (baseStr.match(/^\d+\.\d+$/)) {
+            // ~1.2 → >=1.2.0 <1.3.0
+            return pv.major === base.major && pv.minor === base.minor;
+        }
+        // ~1 → >=1.0.0 <2.0.0
+        return pv.major === base.major;
+    }
+    // X-range: 1.x, 1.2.x, 1.*, 1.2.*
+    const xRange = r.match(/^(\d+)(?:\.(\d+))?\.(\*|x)$/);
+    if (xRange) {
+        const [, maj, min] = xRange;
+        const pv = parseSemver(version);
+        if (min === undefined) {
+            // 1.x → major = 1
+            return pv.major === parseInt(maj, 10);
+        }
+        // 1.2.x → major = 1, minor = 2
+        return pv.major === parseInt(maj, 10) && pv.minor === parseInt(min, 10);
+    }
+    // Tek operatörler
+    if (r.startsWith(">="))
+        return applyOp(version, ">=", r.slice(2).trim());
+    if (r.startsWith("<="))
+        return applyOp(version, "<=", r.slice(2).trim());
+    if (r.startsWith(">"))
+        return applyOp(version, ">", r.slice(1).trim());
+    if (r.startsWith("<"))
+        return applyOp(version, "<", r.slice(1).trim());
+    if (r.startsWith("="))
+        return compareSemver(version, r.slice(1).trim()) === 0;
+    // Exact (allow leading v)
+    const norm = r.startsWith("v") ? r.slice(1) : r;
+    const vnorm = version.startsWith("v") ? version.slice(1) : version;
+    if (/^\d+\.\d+\.\d+/.test(norm))
+        return compareSemver(vnorm, norm) === 0;
+    return version === r;
+}
+function applyOp(version, op, target) {
+    const cmp = compareSemver(version, target);
+    switch (op) {
+        case ">=": return cmp >= 0;
+        case "<=": return cmp <= 0;
+        case ">": return cmp > 0;
+        case "<": return cmp < 0;
+        default: return false;
+    }
+}
+export function maxSatisfying(versions, range) {
+    const sat = versions.filter((v) => satisfiesRange(v, range));
+    if (sat.length === 0)
+        return null;
+    sat.sort(compareSemver);
+    return sat[sat.length - 1];
+}

package/dist/cli/src/core/sign.js

@@ -0,0 +1,92 @@
+// cli/src/core/sign.ts — Epoch 1e: paket imzalama/doğrulama
+// RSA key pair ile paket imzalama, verified publisher sistemi
+import { createHash, createSign, createVerify, generateKeyPairSync } from "crypto";
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "fs";
+import { join } from "path";
+import { homedir } from "os";
+const KEY_DIR = join(homedir(), ".forge", "keys");
+const PRIVATE_KEY_PATH = join(KEY_DIR, "forge.key");
+const PUBLIC_KEY_PATH = join(KEY_DIR, "forge.pub");
+/** Generate a new RSA key pair for signing */
+export function generateKeyPair(name) {
+    const { privateKey, publicKey } = generateKeyPairSync("rsa", {
+        modulusLength: 4096,
+        publicKeyEncoding: { type: "spki", format: "pem" },
+        privateKeyEncoding: { type: "pkcs8", format: "pem" },
+    });
+    if (!existsSync(KEY_DIR))
+        mkdirSync(KEY_DIR, { recursive: true });
+    writeFileSync(PRIVATE_KEY_PATH, privateKey);
+    writeFileSync(PUBLIC_KEY_PATH, publicKey);
+    console.log(`[forge] key pair generated for "${name}"`);
+    console.log(`[forge] private: ${PRIVATE_KEY_PATH}`);
+    console.log(`[forge] public:  ${PUBLIC_KEY_PATH}`);
+    return { privateKey, publicKey };
+}
+/** Get or generate key pair */
+export function getKeyPair() {
+    if (existsSync(PRIVATE_KEY_PATH) && existsSync(PUBLIC_KEY_PATH)) {
+        return {
+            privateKey: readFileSync(PRIVATE_KEY_PATH, "utf-8"),
+            publicKey: readFileSync(PUBLIC_KEY_PATH, "utf-8"),
+        };
+    }
+    return generateKeyPair("forge-user");
+}
+/** Sign a buffer and return base64 signature */
+export function signData(data, privateKey) {
+    const sign = createSign("SHA256");
+    sign.update(data);
+    sign.end();
+    return sign.sign(privateKey, "base64");
+}
+/** Verify a signature */
+export function verifySignature(data, signature, publicKey) {
+    const verify = createVerify("SHA256");
+    verify.update(data);
+    verify.end();
+    return verify.verify(publicKey, signature, "base64");
+}
+/** Sign a package tarball */
+export function signPackage(tarballPath) {
+    const { privateKey, publicKey } = getKeyPair();
+    const data = readFileSync(tarballPath);
+    const sha256 = createHash("sha256").update(data).digest("hex");
+    const signature = signData(data, privateKey);
+    return {
+        sha256,
+        signature,
+        publicKey,
+        signedAt: new Date().toISOString(),
+        signer: "forge-user",
+    };
+}
+/** Verify a package signature */
+export function verifyPackage(tarballPath, sig) {
+    const data = readFileSync(tarballPath);
+    const sha256 = createHash("sha256").update(data).digest("hex");
+    if (sha256 !== sig.sha256) {
+        return false;
+    }
+    return verifySignature(data, sig.signature, sig.publicKey);
+}
+/** Sign registry index */
+export function signIndex(indexData) {
+    const { privateKey, publicKey } = getKeyPair();
+    const sha256 = createHash("sha256").update(indexData).digest("hex");
+    const signature = signData(indexData, privateKey);
+    return {
+        sha256,
+        signature,
+        publicKey,
+        signedAt: new Date().toISOString(),
+        signer: "forge-user",
+    };
+}
+/** Verify registry index signature */
+export function verifyIndex(indexData, sig) {
+    const sha256 = createHash("sha256").update(indexData).digest("hex");
+    if (sha256 !== sig.sha256)
+        return false;
+    return verifySignature(indexData, sig.signature, sig.publicKey);
+}

package/dist/cli/src/core/store.js

@@ -0,0 +1,71 @@
+import { homedir } from "os";
+import { join } from "path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from "fs";
+export function forgeHome() {
+    return join(homedir(), ".forge");
+}
+export function packagesDir() {
+    return join(forgeHome(), "packages");
+}
+export function cacheDir() {
+    return join(forgeHome(), "cache");
+}
+export function tarballsDir() {
+    return join(cacheDir(), "tarballs");
+}
+export function linksFile() {
+    return join(forgeHome(), "links.json");
+}
+export function ensureForgeDirs() {
+    for (const dir of [forgeHome(), packagesDir(), cacheDir(), tarballsDir()]) {
+        if (!existsSync(dir))
+            mkdirSync(dir, { recursive: true });
+    }
+    if (!existsSync(linksFile())) {
+        writeFileSync(linksFile(), JSON.stringify({}, null, 2));
+    }
+}
+export function readLinks() {
+    ensureForgeDirs();
+    try {
+        return JSON.parse(readFileSync(linksFile(), "utf-8"));
+    }
+    catch {
+        return {};
+    }
+}
+export function writeLinks(links) {
+    ensureForgeDirs();
+    writeFileSync(linksFile(), JSON.stringify(links, null, 2));
+}
+export function packageDir(slug, version) {
+    return join(packagesDir(), `${slug}@${version}`);
+}
+export function isPackageInstalled(slug, version) {
+    return existsSync(packageDir(slug, version));
+}
+export function listInstalledPackages() {
+    ensureForgeDirs();
+    if (!existsSync(packagesDir()))
+        return [];
+    const entries = readdirSync(packagesDir(), { withFileTypes: true });
+    return entries
+        .filter((e) => e.isDirectory())
+        .map((e) => {
+        const at = e.name.lastIndexOf("@");
+        if (at === -1)
+            return null;
+        return { slug: e.name.slice(0, at), version: e.name.slice(at + 1), dir: join(packagesDir(), e.name) };
+    })
+        .filter(Boolean);
+}
+export function toSlug(pkg) {
+    return pkg.replace("/", "-");
+}
+export function fromSlug(slug) {
+    // anthropics-plan -> anthropics/plan (first dash is slash)
+    const idx = slug.indexOf("-");
+    if (idx === -1)
+        return slug;
+    return slug.slice(0, idx) + "/" + slug.slice(idx + 1);
+}