@prompd/core 0.5.0-beta.11 → 0.5.0-beta.13

package/dist/index.cjs

@@ -3366,6 +3366,62 @@ var HybridFileSystem = class {
   }
 };
 
+// src/lib/compiler/install.ts
+var MAX_PACKAGE_SIZE = 50 * 1024 * 1024;
+function joinPosix3(...parts) {
+  const joined = parts.filter((p) => p && p !== ".").join("/").replace(/\/{2,}/g, "/");
+  return joined.replace(/\/+$/, "") || "/";
+}
+function normalizeSegments(p) {
+  const out = [];
+  for (const seg of p.split("/")) {
+    if (!seg || seg === ".") continue;
+    if (seg === "..") {
+      out.pop();
+      continue;
+    }
+    out.push(seg);
+  }
+  return out.join("/");
+}
+async function installPackage(opts) {
+  const { ref, type, root, store, download } = opts;
+  const parsed = parsePackageReference(ref);
+  const bytes = await download(parsed.name, parsed.version);
+  if (bytes.length > MAX_PACKAGE_SIZE) {
+    throw new Error(`Package too large: ${bytes.length} bytes (max ${MAX_PACKAGE_SIZE})`);
+  }
+  const files = await extractPdpkg(bytes);
+  if (files.size === 0) {
+    throw new Error(`Package "${parsed.name}" contains no installable files.`);
+  }
+  let name = parsed.name;
+  let version = parsed.version;
+  const manifest = files.get("manifest.json") ?? files.get("prompd.json");
+  if (manifest) {
+    try {
+      const m = JSON.parse(manifest);
+      if (typeof m.name === "string" && m.name) name = m.name;
+      if (typeof m.version === "string" && m.version) version = m.version;
+    } catch {
+    }
+  }
+  const installedPath = joinPosix3(root, ".prompd", getInstallDirForType(type), name);
+  const baseSegments = normalizeSegments(installedPath);
+  await store.removeDir?.(installedPath);
+  const written = [];
+  for (const [rel, content] of files) {
+    const dest = joinPosix3(installedPath, rel);
+    const destSegments = normalizeSegments(dest);
+    if (destSegments !== baseSegments && !destSegments.startsWith(baseSegments + "/")) {
+      throw new Error(`Security violation: extracted path escapes install directory: ${rel}`);
+    }
+    await store.writeFile(dest, content);
+    written.push(rel);
+  }
+  return { name, version, scope: parsed.scope, installedPath, files: written };
+}
+
 // src/lib/compiler/index.ts
 function createCoreStages() {
   return [
@@ -4809,6 +4865,7 @@ exports.getExecutionOrder = getExecutionOrder;
 exports.getInstallDirForType = getInstallDirForType;
 exports.getLanguageAliasesForExtension = getLanguageAliasesForExtension;
 exports.getLanguageForExtension = getLanguageForExtension;
+exports.installPackage = installPackage;
 exports.isAbsolutePosix = isAbsolutePosix;
 exports.isPrompdFile = isPrompdFile;
 exports.isValidPackageReference = isValidPackageReference;