@prompd/core 0.5.0-beta.10 → 0.5.0-beta.12

package/dist/index.cjs

@@ -3,6 +3,7 @@
 var yaml = require('yaml');
 var semver = require('semver');
 var nunjucks = require('nunjucks');
+var JSZip = require('jszip');
 
 function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
 
@@ -27,6 +28,7 @@ function _interopNamespace(e) {
 var yaml__namespace = /*#__PURE__*/_interopNamespace(yaml);
 var semver__default = /*#__PURE__*/_interopDefault(semver);
 var nunjucks__namespace = /*#__PURE__*/_interopNamespace(nunjucks);
+var JSZip__default = /*#__PURE__*/_interopDefault(JSZip);
 
 // src/lib/parser.ts
 var PrompdParser = class {
@@ -572,6 +574,30 @@ function resolvePackageFile(packagePath, filePath) {
   }
   return resolvedPath;
 }
+function isPackageCapable(fs) {
+  const f = fs;
+  return !!f && typeof f.getPackagePath === "function" && typeof f.addPackage === "function" && typeof f.isDirectory === "function";
+}
+var MemoryPackageResolver = class {
+  constructor(download) {
+    this.download = download;
+  }
+  async resolvePackage(packageRef, options) {
+    const fs = options.fileSystem;
+    if (!isPackageCapable(fs)) {
+      throw new Error("MemoryPackageResolver requires a package-capable in-memory file system (MemoryFileSystem or HybridFileSystem)");
+    }
+    if (!isValidPackageReference(packageRef)) {
+      throw new SecurityError(`Invalid package reference format: ${packageRef}`);
+    }
+    const { name, version } = parsePackageReference(packageRef);
+    const packagePath = fs.getPackagePath(name, version);
+    if (await fs.isDirectory(packagePath)) return packagePath;
+    const buffer = await this.download(name, version);
+    await fs.addPackage(name, version, buffer);
+    return packagePath;
+  }
+};
 
 // src/lib/compiler/path-utils.ts
 function normalizePosix(p) {
@@ -3071,8 +3097,54 @@ var CodeGenerationStage = class {
     return "Code Generation";
   }
 };
-
-// src/lib/compiler/file-system.ts
+var BINARY_ASSET_EXT = /* @__PURE__ */ new Set([
+  "png",
+  "jpg",
+  "jpeg",
+  "gif",
+  "webp",
+  "svg",
+  "ico",
+  "bmp",
+  "tiff",
+  "pdf",
+  "xlsx",
+  "xls",
+  "docx",
+  "doc",
+  "pptx",
+  "ppt",
+  "zip",
+  "pdpkg",
+  "gz",
+  "tar",
+  "wasm",
+  "woff",
+  "woff2",
+  "ttf",
+  "otf",
+  "eot",
+  "mp3",
+  "mp4",
+  "wav",
+  "ogg",
+  "webm",
+  "mov",
+  "avi"
+]);
+function isBinaryAsset(name) {
+  const dot = name.lastIndexOf(".");
+  return dot >= 0 && BINARY_ASSET_EXT.has(name.slice(dot + 1).toLowerCase());
+}
+async function extractPdpkg(buffer) {
+  const zip = await JSZip__default.default.loadAsync(buffer);
+  const out = /* @__PURE__ */ new Map();
+  for (const entry of Object.values(zip.files)) {
+    if (entry.dir || isBinaryAsset(entry.name)) continue;
+    out.set(entry.name, await entry.async("string"));
+  }
+  return out;
+}
 function normalizePosix2(p) {
   const isAbs = p.startsWith("/");
   const out = [];
@@ -3110,7 +3182,7 @@ function toRelKey(filePath) {
   if (n.endsWith("/") && n.length > 1) n = n.substring(0, n.length - 1);
   return n;
 }
-var MemoryFileSystem = class {
+var _MemoryFileSystem = class _MemoryFileSystem {
   constructor(files = {}) {
     this.files = /* @__PURE__ */ new Map();
     for (const [filePath, content] of Object.entries(files)) {
@@ -3177,6 +3249,33 @@ var MemoryFileSystem = class {
   getPackagePath(packageName, version) {
     return `/packages/${packageName}@${version}`;
   }
+  /**
+   * Extract a `.pdpkg` (ZIP) buffer into memory under getPackagePath(name, ver).
+   *
+   * Uses JSZip — isomorphic (browser + Node) — so this is the SINGLE package-ingest
+   * path for every host (replacing the CLI's Node-only adm-zip subclass and the
+   * skill installer's ad-hoc unzip). Text files only: binary assets aren't
+   * representable in the string-backed FS, so they're skipped (a `using:` package's
+   * .prmd/.md/.json/.yaml is what matters for compilation). Validates entry paths
+   * can't escape the package directory.
+   */
+  async addPackage(packageName, version, packageBuffer) {
+    if (packageBuffer.length > _MemoryFileSystem.MAX_PACKAGE_SIZE) {
+      throw new Error(`Package too large: ${packageBuffer.length} bytes (max ${_MemoryFileSystem.MAX_PACKAGE_SIZE})`);
+    }
+    const files = await extractPdpkg(packageBuffer);
+    const packagePath = this.getPackagePath(packageName, version);
+    const packagePrefix = this.normalizePath(packagePath.endsWith("/") ? packagePath : packagePath + "/");
+    const packageRoot = this.normalizePath(packagePath);
+    for (const [rel, content] of files) {
+      const filePath = this.join(packagePath, rel);
+      const normalized = this.normalizePath(filePath);
+      if (!normalized.startsWith(packagePrefix) && normalized !== packageRoot) {
+        throw new Error(`Security violation: extracted path escapes package directory: ${rel}`);
+      }
+      this.addFile(filePath, content);
+    }
+  }
   /** Get all files under an optional base path. */
   getAllFiles(basePath) {
     if (!basePath) {
@@ -3206,6 +3305,9 @@ var MemoryFileSystem = class {
     return toRelKey(filePath);
   }
 };
+/** Cap on an ingested package buffer (defends against a hostile/huge .pdpkg). */
+_MemoryFileSystem.MAX_PACKAGE_SIZE = 50 * 1024 * 1024;
+var MemoryFileSystem = _MemoryFileSystem;
 var HybridFileSystem = class {
   constructor(files = {}, backend) {
     this.mem = new MemoryFileSystem(files);
@@ -3219,6 +3321,15 @@ var HybridFileSystem = class {
   addFiles(files) {
     this.mem.addFiles(files);
   }
+  /** Virtual path where a package's files live (delegates to the memory layer). */
+  getPackagePath(packageName, version) {
+    return this.mem.getPackagePath(packageName, version);
+  }
+  /** Ingest a `.pdpkg` (ZIP) buffer into the in-memory layer, so package files are
+   * served synchronously alongside the workspace sources. */
+  addPackage(packageName, version, packageBuffer) {
+    return this.mem.addPackage(packageName, version, packageBuffer);
+  }
   exists(filePath) {
     if (this.mem.exists(filePath)) return true;
     return this.backend.readFile(this.normalize(filePath)).then((content) => content !== null).catch(() => false);
@@ -4668,6 +4779,7 @@ exports.LexicalAnalysisStage = LexicalAnalysisStage;
 exports.MEMORY_OPERATIONS_BY_MODE = MEMORY_OPERATIONS_BY_MODE;
 exports.MarkdownFormatter = MarkdownFormatter;
 exports.MemoryFileSystem = MemoryFileSystem;
+exports.MemoryPackageResolver = MemoryPackageResolver;
 exports.OpenAIFormatter = OpenAIFormatter;
 exports.PACKAGE_TYPE_DIRS = PACKAGE_TYPE_DIRS;
 exports.PROMPD_EXTENSIONS = PROMPD_EXTENSIONS;
@@ -4691,6 +4803,7 @@ exports.createPrompdEnvironment = createPrompdEnvironment;
 exports.createWorkflowNode = createWorkflowNode;
 exports.dirnamePosix = dirnamePosix;
 exports.extname = extname;
+exports.extractPdpkg = extractPdpkg;
 exports.getContentType = getContentType;
 exports.getExecutionOrder = getExecutionOrder;
 exports.getInstallDirForType = getInstallDirForType;