@prompd/core 0.5.0-beta.15 → 0.5.0-beta.18

package/dist/index.d.cts

@@ -22,9 +22,11 @@ interface IFileSystem {
 /**
  * Extract a `.pdpkg` (ZIP) buffer to a flat map of entry-relative path -> UTF-8
  * content. The SINGLE ZIP-extraction primitive shared by package ingestion
- * (MemoryFileSystem.addPackage) and skill install — so hosts never hand-roll their
- * own jszip pass. Directories and binary assets are skipped (the consumers store
- * text only).
+ * (MemoryFileSystem.addPackage), the installer, and skill install — so hosts never
+ * hand-roll their own jszip pass. Directories and binary assets are skipped (the
+ * consumers store text only). Enforces the same archive-security checks as the CLI:
+ * rejects null bytes, path traversal, symlinks, and oversized / decompression-bomb
+ * archives.
  */
 declare function extractPdpkg(buffer: Uint8Array): Promise<Map<string, string>>;
 /**
@@ -670,6 +672,13 @@ declare class MemoryPackageResolver implements IPackageResolver {
     resolvePackage(packageRef: string, options: ResolvePackageOptions): Promise<string>;
 }
 
+/** Deploy an installed skill into a tool-native dir (e.g. ~/.claude/skills). Host-only
+ *  (Node fs); the browser omits it. Injected so core stays Node-free. */
+type ToolDeployHook = (opts: {
+    installedPath: string;
+    name: string;
+    tool: string;
+}) => void | Promise<void>;
 /**
  * A writable sink the host injects so installPackage stays FS-/Node-agnostic.
  * Browser: an adapter over the workspace FileService; CLI/sidecar: over Node fs.
@@ -677,30 +686,36 @@ declare class MemoryPackageResolver implements IPackageResolver {
 interface PackageStore {
     /** Write a UTF-8 file, creating parent directories as needed. */
     writeFile(path: string, content: string): void | Promise<void>;
-    /** Remove a directory and its contents if present, for a clean reinstall. */
+    /** Write raw bytes — required for node-templates (stored as the raw .pdpkg). */
+    writeBytes?(path: string, bytes: Uint8Array): void | Promise<void>;
+    /** Remove a directory and its contents if present. */
     removeDir?(path: string): void | Promise<void>;
-    /** Read a UTF-8 file, or null if absent — used to merge the workspace prompd.json
-     *  dependency list. When omitted, dependency tracking is skipped (non-fatal). */
+    /** Remove a single file if present (node-template .pdpkg uninstall). */
+    removeFile?(path: string): void | Promise<void>;
+    /** Read a UTF-8 file, or null if absent — used to merge the workspace prompd.json. */
     readFile?(path: string): Promise<string | null> | string | null;
+    /** Read raw bytes — used to match a node-template .pdpkg by its manifest on uninstall. */
+    readBytes?(path: string): Promise<Uint8Array> | Uint8Array;
+    /** List a directory's entry names — used to find a node-template .pdpkg to uninstall. */
+    readdir?(path: string): Promise<string[]> | string[];
 }
 interface InstallPackageOptions {
     /** "@scope/name@version" or "@scope/name" (defaults to latest). */
     ref: string;
-    /** Artifact type — selects the .prompd subdir (packages/skills/workflows/templates). */
-    type: PackageType;
-    /**
-     * Install root the caller chose: the open workspace folder (browser/local) or the
-     * home dir for a global install (sidecar/CLI). installPackage NEVER computes '~'
-     * itself — core stays Node-free.
-     */
+    /** Type HINT. The package's own manifest `type` wins; this is the fallback. */
+    type?: PackageType;
+    /** Install root: the open workspace (local) or the home dir (global). */
     root: string;
     /** Writable sink for the chosen host. */
     store: PackageStore;
-    /**
-     * Fetch the .pdpkg bytes for a (name, version). Injected: the registry client in
-     * the browser, a Node fetch in the CLI. May resolve 'latest' to a concrete version.
-     */
+    /** Fetch the .pdpkg bytes for a (name, version). May resolve 'latest'. */
     download: PackageDownloader;
+    /** Global install — skips the workspace prompd.json dependency record (CLI parity). */
+    global?: boolean;
+    /** Deploy the installed skill to these tools (skills only), via deployTool. */
+    tools?: string[];
+    /** Host hook performing the per-tool deploy. Required when `tools` is set. */
+    deployTool?: ToolDeployHook;
 }
 interface InstalledPackage {
     /** Full scoped name (manifest-authoritative when present), e.g. "@prompd/core". */
@@ -708,41 +723,42 @@ interface InstalledPackage {
     /** Resolved version (from the package manifest when present). */
     version: string;
     scope?: string;
-    /** Install dir written to: <root>/.prompd/<typeDir>/<name>. */
+    /** Resolved type (from the package manifest when present). */
+    type: PackageType;
+    /** Where it was written: the version dir, or the .pdpkg path for node-templates. */
     installedPath: string;
-    /** Entry-relative paths written under installedPath. */
+    /** Entry-relative paths written (empty for node-templates). */
     files: string[];
 }
 /**
- * Install a registry artifact into <root>/.prompd/<typeDir>/<name>/, replacing any
- * prior install (idempotent). The host injects the writable `store` and the
- * `download` fetcher, so the same install runs in the browser and the CLI/sidecar.
- * Returns the resolved name/version (manifest-authoritative when present) and the
- * files written. Rejects entries that escape the install directory (zip-slip) and
- * archives over the size cap.
+ * Install a registry artifact, matching the CLI. Resolves the type from the package's
+ * own manifest (the `type` option is only a fallback). Standard types extract to
+ * <root>/.prompd/<typeDir>/<name>/<version>/ with a `.prmdmeta`; node-templates are
+ * stored as the raw .pdpkg. Installs the package's own dependencies recursively,
+ * records the dependency in the workspace prompd.json (local installs only), and
+ * deploys to any requested tools. Idempotent per version.
  */
 declare function installPackage(opts: InstallPackageOptions): Promise<InstalledPackage>;
 interface UninstallPackageOptions {
-    /** "@scope/name" (a version suffix is accepted but ignored — one install per name). */
+    /** "@scope/name" (a version suffix is accepted but ignored). */
     ref: string;
-    /** Artifact type — selects the .prompd subdir. */
-    type: PackageType;
-    /** Install root the caller chose (the open workspace, or '~' for a global install). */
+    /** Install root the caller chose. */
     root: string;
-    /** Writable sink for the chosen host; removeDir is required to uninstall. */
+    /** Writable sink for the chosen host. */
     store: PackageStore;
+    /** Global uninstall — skips the workspace prompd.json dependency removal. */
+    global?: boolean;
 }
 interface UninstalledPackage {
     name: string;
     scope?: string;
-    /** The directory that was removed: <root>/.prompd/<typeDir>/<name>. */
-    installedPath: string;
+    /** Dirs/files removed. */
+    removed: string[];
 }
 /**
- * Uninstall an artifact: remove <root>/.prompd/<typeDir>/<name>/ via the injected
- * store. The symmetric inverse of installPackage, sharing the same install-dir
- * computation. Idempotent — removing an absent install is a no-op (the host's
- * removeDir should swallow not-found). Throws if the store can't remove directories.
+ * Uninstall by name, matching the CLI: scan EVERY type dir under <root>/.prompd/ and
+ * remove the package's dir (all versions); for node-templates, find the .pdpkg whose
+ * manifest name matches and remove it. Drops the prompd.json dependency. Idempotent.
  */
 declare function uninstallPackage(opts: UninstallPackageOptions): Promise<UninstalledPackage>;
 
@@ -3039,4 +3055,4 @@ declare function validateWorkflow(workflow: WorkflowFile): ValidationResult;
  */
 declare function validateWorkflowQuick(workflow: WorkflowFile): Pick<ValidationResult, 'isValid'>;
 
-export { type AgentCheckpointEvent, type AgentCheckpointEventType, type AgentIterationRecord, type AgentNodeData, type AgentTool, AnthropicFormatter, type ApiNodeData, type AsyncFileBackend, BUILTIN_COMMAND_EXECUTABLES, type BaseNodeData, CODE_EXTENSIONS, CONTENT_TYPES, type CallbackNodeData, type ChatAgentCheckpointConfig, type ChatAgentNodeData, type ClaudeCodeNodeData, CodeGenerationStage, type CodeNodeData, type CommandNodeData, CompilationContext, type CompilationDiagnostic, CompilationError, type CompilationOptions, CompilationStage, type CompiledPrompt, CompilerPipeline, type CompilerStage, type CompleteEventData, type ConditionBranch, type ConditionNodeData, type Config, type CustomCommandConfig, type CustomConnectionConfig, type CustomProvider, DEFAULT_SECURITY_CONFIG, DOCKABLE_HANDLES, DOCKABLE_NODE_TYPES, type DatabaseConnectionConfig, type DatabaseQueryNodeData, DependencyResolutionStage, EXTENSION_TO_LANGUAGE, EXTENSION_TO_LANGUAGE_ALIASES, type ErrorEventData, type ErrorHandlerNodeData, type ErrorHandlingConfig, type ExecuteOptions, type ExecutionConfig, type GitHubConnectionConfig, type GuardrailNodeData, type HttpApiConnectionConfig, HybridFileSystem, type IFileSystem, type IPackageResolver, type InstallPackageOptions, type InstalledPackage, type IterationEventData, type JsonSchema, type LLMResponse, LexicalAnalysisStage, type LoopNodeData, MEMORY_OPERATIONS_BY_MODE, MarkdownFormatter, type McpServerConnectionConfig, type McpToolNodeData, MemoryFileSystem, type MemoryNodeData, type MemoryOperation, MemoryPackageResolver, type MergeNodeData, type NodeExecutionState, type NodeExecutionStatus, OpenAIFormatter, type OutputFormatter, type OutputNodeData, PACKAGE_TYPE_DIRS, PROMPD_EXTENSIONS, type PackageAlias, type PackageDownloader, type PackageStore, type PackageType, type ParallelBranch, type ParallelNodeData, ParseError, type ParsedWorkflow, PrompdCompiler, PrompdError, type PrompdFile, PrompdLoader, type PrompdMetadata, type PrompdParameter, PrompdParser, type PromptNodeData, type ProviderConfig, type ProviderNodeData, type RegistryConfig, type ResolvePackageOptions, type ResolvedPackage, type RetryPolicy, type SSHConnectionConfig, type SectionInfo, SectionOverrideProcessor, type SecurityConfig, SecurityError, SemanticAnalysisStage, type SlackConnectionConfig, TOOL_DEPLOY_DIRS, TemplateProcessingStage, type ThinkingEventData, type ToolCallEventData, type ToolCallParserNodeData, type ToolCallRouterNodeData, type ToolNodeData, type TransformerNodeData, type TriggerNodeData, type UninstallPackageOptions, type UninstalledPackage, type UserInputNodeData, type UsingPackage, VALID_PACKAGE_TYPES, ValidationError, type ValidationIssue, type ValidationResult, type WebSearchNodeData, type WebSocketConnectionConfig, type WorkflowConnection, type WorkflowConnectionConfig, type WorkflowConnectionStatus, type WorkflowConnectionType, type WorkflowEdge, type WorkflowExecutionError, type WorkflowExecutionState, type WorkflowExecutionStatus, type WorkflowFile, type WorkflowMetadata, type WorkflowNode, type WorkflowNodeData, type WorkflowNodeType, type WorkflowParameter, type WorkflowResult, type WorkflowValidationError, type WorkflowValidationWarning, type WorkflowVariable, basenamePosix, compile, createCoreStages, createEmptyWorkflow, createPrompdEnvironment, createWorkflowNode, dirnamePosix, extname, extractPdpkg, getContentType, getExecutionOrder, getInstallDirForType, getLanguageAliasesForExtension, getLanguageForExtension, installPackage, isAbsolutePosix, isPrompdFile, isValidPackageReference, isValidPackageType, joinPosix, needsFrontmatterProtection, normalizePosix, parsePackageReference, parsePackageReferenceWithPath, parseWorkflow, resolvePackageFile, resolvePosix, serializeWorkflow, stripFilePath, uninstallPackage, validateWorkflow, validateWorkflowQuick };
+export { type AgentCheckpointEvent, type AgentCheckpointEventType, type AgentIterationRecord, type AgentNodeData, type AgentTool, AnthropicFormatter, type ApiNodeData, type AsyncFileBackend, BUILTIN_COMMAND_EXECUTABLES, type BaseNodeData, CODE_EXTENSIONS, CONTENT_TYPES, type CallbackNodeData, type ChatAgentCheckpointConfig, type ChatAgentNodeData, type ClaudeCodeNodeData, CodeGenerationStage, type CodeNodeData, type CommandNodeData, CompilationContext, type CompilationDiagnostic, CompilationError, type CompilationOptions, CompilationStage, type CompiledPrompt, CompilerPipeline, type CompilerStage, type CompleteEventData, type ConditionBranch, type ConditionNodeData, type Config, type CustomCommandConfig, type CustomConnectionConfig, type CustomProvider, DEFAULT_SECURITY_CONFIG, DOCKABLE_HANDLES, DOCKABLE_NODE_TYPES, type DatabaseConnectionConfig, type DatabaseQueryNodeData, DependencyResolutionStage, EXTENSION_TO_LANGUAGE, EXTENSION_TO_LANGUAGE_ALIASES, type ErrorEventData, type ErrorHandlerNodeData, type ErrorHandlingConfig, type ExecuteOptions, type ExecutionConfig, type GitHubConnectionConfig, type GuardrailNodeData, type HttpApiConnectionConfig, HybridFileSystem, type IFileSystem, type IPackageResolver, type InstallPackageOptions, type InstalledPackage, type IterationEventData, type JsonSchema, type LLMResponse, LexicalAnalysisStage, type LoopNodeData, MEMORY_OPERATIONS_BY_MODE, MarkdownFormatter, type McpServerConnectionConfig, type McpToolNodeData, MemoryFileSystem, type MemoryNodeData, type MemoryOperation, MemoryPackageResolver, type MergeNodeData, type NodeExecutionState, type NodeExecutionStatus, OpenAIFormatter, type OutputFormatter, type OutputNodeData, PACKAGE_TYPE_DIRS, PROMPD_EXTENSIONS, type PackageAlias, type PackageDownloader, type PackageStore, type PackageType, type ParallelBranch, type ParallelNodeData, ParseError, type ParsedWorkflow, PrompdCompiler, PrompdError, type PrompdFile, PrompdLoader, type PrompdMetadata, type PrompdParameter, PrompdParser, type PromptNodeData, type ProviderConfig, type ProviderNodeData, type RegistryConfig, type ResolvePackageOptions, type ResolvedPackage, type RetryPolicy, type SSHConnectionConfig, type SectionInfo, SectionOverrideProcessor, type SecurityConfig, SecurityError, SemanticAnalysisStage, type SlackConnectionConfig, TOOL_DEPLOY_DIRS, TemplateProcessingStage, type ThinkingEventData, type ToolCallEventData, type ToolCallParserNodeData, type ToolCallRouterNodeData, type ToolDeployHook, type ToolNodeData, type TransformerNodeData, type TriggerNodeData, type UninstallPackageOptions, type UninstalledPackage, type UserInputNodeData, type UsingPackage, VALID_PACKAGE_TYPES, ValidationError, type ValidationIssue, type ValidationResult, type WebSearchNodeData, type WebSocketConnectionConfig, type WorkflowConnection, type WorkflowConnectionConfig, type WorkflowConnectionStatus, type WorkflowConnectionType, type WorkflowEdge, type WorkflowExecutionError, type WorkflowExecutionState, type WorkflowExecutionStatus, type WorkflowFile, type WorkflowMetadata, type WorkflowNode, type WorkflowNodeData, type WorkflowNodeType, type WorkflowParameter, type WorkflowResult, type WorkflowValidationError, type WorkflowValidationWarning, type WorkflowVariable, basenamePosix, compile, createCoreStages, createEmptyWorkflow, createPrompdEnvironment, createWorkflowNode, dirnamePosix, extname, extractPdpkg, getContentType, getExecutionOrder, getInstallDirForType, getLanguageAliasesForExtension, getLanguageForExtension, installPackage, isAbsolutePosix, isPrompdFile, isValidPackageReference, isValidPackageType, joinPosix, needsFrontmatterProtection, normalizePosix, parsePackageReference, parsePackageReferenceWithPath, parseWorkflow, resolvePackageFile, resolvePosix, serializeWorkflow, stripFilePath, uninstallPackage, validateWorkflow, validateWorkflowQuick };

package/dist/index.d.ts

@@ -22,9 +22,11 @@ interface IFileSystem {
 /**
  * Extract a `.pdpkg` (ZIP) buffer to a flat map of entry-relative path -> UTF-8
  * content. The SINGLE ZIP-extraction primitive shared by package ingestion
- * (MemoryFileSystem.addPackage) and skill install — so hosts never hand-roll their
- * own jszip pass. Directories and binary assets are skipped (the consumers store
- * text only).
+ * (MemoryFileSystem.addPackage), the installer, and skill install — so hosts never
+ * hand-roll their own jszip pass. Directories and binary assets are skipped (the
+ * consumers store text only). Enforces the same archive-security checks as the CLI:
+ * rejects null bytes, path traversal, symlinks, and oversized / decompression-bomb
+ * archives.
  */
 declare function extractPdpkg(buffer: Uint8Array): Promise<Map<string, string>>;
 /**
@@ -670,6 +672,13 @@ declare class MemoryPackageResolver implements IPackageResolver {
     resolvePackage(packageRef: string, options: ResolvePackageOptions): Promise<string>;
 }
 
+/** Deploy an installed skill into a tool-native dir (e.g. ~/.claude/skills). Host-only
+ *  (Node fs); the browser omits it. Injected so core stays Node-free. */
+type ToolDeployHook = (opts: {
+    installedPath: string;
+    name: string;
+    tool: string;
+}) => void | Promise<void>;
 /**
  * A writable sink the host injects so installPackage stays FS-/Node-agnostic.
  * Browser: an adapter over the workspace FileService; CLI/sidecar: over Node fs.
@@ -677,30 +686,36 @@ declare class MemoryPackageResolver implements IPackageResolver {
 interface PackageStore {
     /** Write a UTF-8 file, creating parent directories as needed. */
     writeFile(path: string, content: string): void | Promise<void>;
-    /** Remove a directory and its contents if present, for a clean reinstall. */
+    /** Write raw bytes — required for node-templates (stored as the raw .pdpkg). */
+    writeBytes?(path: string, bytes: Uint8Array): void | Promise<void>;
+    /** Remove a directory and its contents if present. */
     removeDir?(path: string): void | Promise<void>;
-    /** Read a UTF-8 file, or null if absent — used to merge the workspace prompd.json
-     *  dependency list. When omitted, dependency tracking is skipped (non-fatal). */
+    /** Remove a single file if present (node-template .pdpkg uninstall). */
+    removeFile?(path: string): void | Promise<void>;
+    /** Read a UTF-8 file, or null if absent — used to merge the workspace prompd.json. */
     readFile?(path: string): Promise<string | null> | string | null;
+    /** Read raw bytes — used to match a node-template .pdpkg by its manifest on uninstall. */
+    readBytes?(path: string): Promise<Uint8Array> | Uint8Array;
+    /** List a directory's entry names — used to find a node-template .pdpkg to uninstall. */
+    readdir?(path: string): Promise<string[]> | string[];
 }
 interface InstallPackageOptions {
     /** "@scope/name@version" or "@scope/name" (defaults to latest). */
     ref: string;
-    /** Artifact type — selects the .prompd subdir (packages/skills/workflows/templates). */
-    type: PackageType;
-    /**
-     * Install root the caller chose: the open workspace folder (browser/local) or the
-     * home dir for a global install (sidecar/CLI). installPackage NEVER computes '~'
-     * itself — core stays Node-free.
-     */
+    /** Type HINT. The package's own manifest `type` wins; this is the fallback. */
+    type?: PackageType;
+    /** Install root: the open workspace (local) or the home dir (global). */
     root: string;
     /** Writable sink for the chosen host. */
     store: PackageStore;
-    /**
-     * Fetch the .pdpkg bytes for a (name, version). Injected: the registry client in
-     * the browser, a Node fetch in the CLI. May resolve 'latest' to a concrete version.
-     */
+    /** Fetch the .pdpkg bytes for a (name, version). May resolve 'latest'. */
     download: PackageDownloader;
+    /** Global install — skips the workspace prompd.json dependency record (CLI parity). */
+    global?: boolean;
+    /** Deploy the installed skill to these tools (skills only), via deployTool. */
+    tools?: string[];
+    /** Host hook performing the per-tool deploy. Required when `tools` is set. */
+    deployTool?: ToolDeployHook;
 }
 interface InstalledPackage {
     /** Full scoped name (manifest-authoritative when present), e.g. "@prompd/core". */
@@ -708,41 +723,42 @@ interface InstalledPackage {
     /** Resolved version (from the package manifest when present). */
     version: string;
     scope?: string;
-    /** Install dir written to: <root>/.prompd/<typeDir>/<name>. */
+    /** Resolved type (from the package manifest when present). */
+    type: PackageType;
+    /** Where it was written: the version dir, or the .pdpkg path for node-templates. */
     installedPath: string;
-    /** Entry-relative paths written under installedPath. */
+    /** Entry-relative paths written (empty for node-templates). */
     files: string[];
 }
 /**
- * Install a registry artifact into <root>/.prompd/<typeDir>/<name>/, replacing any
- * prior install (idempotent). The host injects the writable `store` and the
- * `download` fetcher, so the same install runs in the browser and the CLI/sidecar.
- * Returns the resolved name/version (manifest-authoritative when present) and the
- * files written. Rejects entries that escape the install directory (zip-slip) and
- * archives over the size cap.
+ * Install a registry artifact, matching the CLI. Resolves the type from the package's
+ * own manifest (the `type` option is only a fallback). Standard types extract to
+ * <root>/.prompd/<typeDir>/<name>/<version>/ with a `.prmdmeta`; node-templates are
+ * stored as the raw .pdpkg. Installs the package's own dependencies recursively,
+ * records the dependency in the workspace prompd.json (local installs only), and
+ * deploys to any requested tools. Idempotent per version.
  */
 declare function installPackage(opts: InstallPackageOptions): Promise<InstalledPackage>;
 interface UninstallPackageOptions {
-    /** "@scope/name" (a version suffix is accepted but ignored — one install per name). */
+    /** "@scope/name" (a version suffix is accepted but ignored). */
     ref: string;
-    /** Artifact type — selects the .prompd subdir. */
-    type: PackageType;
-    /** Install root the caller chose (the open workspace, or '~' for a global install). */
+    /** Install root the caller chose. */
     root: string;
-    /** Writable sink for the chosen host; removeDir is required to uninstall. */
+    /** Writable sink for the chosen host. */
     store: PackageStore;
+    /** Global uninstall — skips the workspace prompd.json dependency removal. */
+    global?: boolean;
 }
 interface UninstalledPackage {
     name: string;
     scope?: string;
-    /** The directory that was removed: <root>/.prompd/<typeDir>/<name>. */
-    installedPath: string;
+    /** Dirs/files removed. */
+    removed: string[];
 }
 /**
- * Uninstall an artifact: remove <root>/.prompd/<typeDir>/<name>/ via the injected
- * store. The symmetric inverse of installPackage, sharing the same install-dir
- * computation. Idempotent — removing an absent install is a no-op (the host's
- * removeDir should swallow not-found). Throws if the store can't remove directories.
+ * Uninstall by name, matching the CLI: scan EVERY type dir under <root>/.prompd/ and
+ * remove the package's dir (all versions); for node-templates, find the .pdpkg whose
+ * manifest name matches and remove it. Drops the prompd.json dependency. Idempotent.
  */
 declare function uninstallPackage(opts: UninstallPackageOptions): Promise<UninstalledPackage>;
 
@@ -3039,4 +3055,4 @@ declare function validateWorkflow(workflow: WorkflowFile): ValidationResult;
  */
 declare function validateWorkflowQuick(workflow: WorkflowFile): Pick<ValidationResult, 'isValid'>;
 
-export { type AgentCheckpointEvent, type AgentCheckpointEventType, type AgentIterationRecord, type AgentNodeData, type AgentTool, AnthropicFormatter, type ApiNodeData, type AsyncFileBackend, BUILTIN_COMMAND_EXECUTABLES, type BaseNodeData, CODE_EXTENSIONS, CONTENT_TYPES, type CallbackNodeData, type ChatAgentCheckpointConfig, type ChatAgentNodeData, type ClaudeCodeNodeData, CodeGenerationStage, type CodeNodeData, type CommandNodeData, CompilationContext, type CompilationDiagnostic, CompilationError, type CompilationOptions, CompilationStage, type CompiledPrompt, CompilerPipeline, type CompilerStage, type CompleteEventData, type ConditionBranch, type ConditionNodeData, type Config, type CustomCommandConfig, type CustomConnectionConfig, type CustomProvider, DEFAULT_SECURITY_CONFIG, DOCKABLE_HANDLES, DOCKABLE_NODE_TYPES, type DatabaseConnectionConfig, type DatabaseQueryNodeData, DependencyResolutionStage, EXTENSION_TO_LANGUAGE, EXTENSION_TO_LANGUAGE_ALIASES, type ErrorEventData, type ErrorHandlerNodeData, type ErrorHandlingConfig, type ExecuteOptions, type ExecutionConfig, type GitHubConnectionConfig, type GuardrailNodeData, type HttpApiConnectionConfig, HybridFileSystem, type IFileSystem, type IPackageResolver, type InstallPackageOptions, type InstalledPackage, type IterationEventData, type JsonSchema, type LLMResponse, LexicalAnalysisStage, type LoopNodeData, MEMORY_OPERATIONS_BY_MODE, MarkdownFormatter, type McpServerConnectionConfig, type McpToolNodeData, MemoryFileSystem, type MemoryNodeData, type MemoryOperation, MemoryPackageResolver, type MergeNodeData, type NodeExecutionState, type NodeExecutionStatus, OpenAIFormatter, type OutputFormatter, type OutputNodeData, PACKAGE_TYPE_DIRS, PROMPD_EXTENSIONS, type PackageAlias, type PackageDownloader, type PackageStore, type PackageType, type ParallelBranch, type ParallelNodeData, ParseError, type ParsedWorkflow, PrompdCompiler, PrompdError, type PrompdFile, PrompdLoader, type PrompdMetadata, type PrompdParameter, PrompdParser, type PromptNodeData, type ProviderConfig, type ProviderNodeData, type RegistryConfig, type ResolvePackageOptions, type ResolvedPackage, type RetryPolicy, type SSHConnectionConfig, type SectionInfo, SectionOverrideProcessor, type SecurityConfig, SecurityError, SemanticAnalysisStage, type SlackConnectionConfig, TOOL_DEPLOY_DIRS, TemplateProcessingStage, type ThinkingEventData, type ToolCallEventData, type ToolCallParserNodeData, type ToolCallRouterNodeData, type ToolNodeData, type TransformerNodeData, type TriggerNodeData, type UninstallPackageOptions, type UninstalledPackage, type UserInputNodeData, type UsingPackage, VALID_PACKAGE_TYPES, ValidationError, type ValidationIssue, type ValidationResult, type WebSearchNodeData, type WebSocketConnectionConfig, type WorkflowConnection, type WorkflowConnectionConfig, type WorkflowConnectionStatus, type WorkflowConnectionType, type WorkflowEdge, type WorkflowExecutionError, type WorkflowExecutionState, type WorkflowExecutionStatus, type WorkflowFile, type WorkflowMetadata, type WorkflowNode, type WorkflowNodeData, type WorkflowNodeType, type WorkflowParameter, type WorkflowResult, type WorkflowValidationError, type WorkflowValidationWarning, type WorkflowVariable, basenamePosix, compile, createCoreStages, createEmptyWorkflow, createPrompdEnvironment, createWorkflowNode, dirnamePosix, extname, extractPdpkg, getContentType, getExecutionOrder, getInstallDirForType, getLanguageAliasesForExtension, getLanguageForExtension, installPackage, isAbsolutePosix, isPrompdFile, isValidPackageReference, isValidPackageType, joinPosix, needsFrontmatterProtection, normalizePosix, parsePackageReference, parsePackageReferenceWithPath, parseWorkflow, resolvePackageFile, resolvePosix, serializeWorkflow, stripFilePath, uninstallPackage, validateWorkflow, validateWorkflowQuick };
+export { type AgentCheckpointEvent, type AgentCheckpointEventType, type AgentIterationRecord, type AgentNodeData, type AgentTool, AnthropicFormatter, type ApiNodeData, type AsyncFileBackend, BUILTIN_COMMAND_EXECUTABLES, type BaseNodeData, CODE_EXTENSIONS, CONTENT_TYPES, type CallbackNodeData, type ChatAgentCheckpointConfig, type ChatAgentNodeData, type ClaudeCodeNodeData, CodeGenerationStage, type CodeNodeData, type CommandNodeData, CompilationContext, type CompilationDiagnostic, CompilationError, type CompilationOptions, CompilationStage, type CompiledPrompt, CompilerPipeline, type CompilerStage, type CompleteEventData, type ConditionBranch, type ConditionNodeData, type Config, type CustomCommandConfig, type CustomConnectionConfig, type CustomProvider, DEFAULT_SECURITY_CONFIG, DOCKABLE_HANDLES, DOCKABLE_NODE_TYPES, type DatabaseConnectionConfig, type DatabaseQueryNodeData, DependencyResolutionStage, EXTENSION_TO_LANGUAGE, EXTENSION_TO_LANGUAGE_ALIASES, type ErrorEventData, type ErrorHandlerNodeData, type ErrorHandlingConfig, type ExecuteOptions, type ExecutionConfig, type GitHubConnectionConfig, type GuardrailNodeData, type HttpApiConnectionConfig, HybridFileSystem, type IFileSystem, type IPackageResolver, type InstallPackageOptions, type InstalledPackage, type IterationEventData, type JsonSchema, type LLMResponse, LexicalAnalysisStage, type LoopNodeData, MEMORY_OPERATIONS_BY_MODE, MarkdownFormatter, type McpServerConnectionConfig, type McpToolNodeData, MemoryFileSystem, type MemoryNodeData, type MemoryOperation, MemoryPackageResolver, type MergeNodeData, type NodeExecutionState, type NodeExecutionStatus, OpenAIFormatter, type OutputFormatter, type OutputNodeData, PACKAGE_TYPE_DIRS, PROMPD_EXTENSIONS, type PackageAlias, type PackageDownloader, type PackageStore, type PackageType, type ParallelBranch, type ParallelNodeData, ParseError, type ParsedWorkflow, PrompdCompiler, PrompdError, type PrompdFile, PrompdLoader, type PrompdMetadata, type PrompdParameter, PrompdParser, type PromptNodeData, type ProviderConfig, type ProviderNodeData, type RegistryConfig, type ResolvePackageOptions, type ResolvedPackage, type RetryPolicy, type SSHConnectionConfig, type SectionInfo, SectionOverrideProcessor, type SecurityConfig, SecurityError, SemanticAnalysisStage, type SlackConnectionConfig, TOOL_DEPLOY_DIRS, TemplateProcessingStage, type ThinkingEventData, type ToolCallEventData, type ToolCallParserNodeData, type ToolCallRouterNodeData, type ToolDeployHook, type ToolNodeData, type TransformerNodeData, type TriggerNodeData, type UninstallPackageOptions, type UninstalledPackage, type UserInputNodeData, type UsingPackage, VALID_PACKAGE_TYPES, ValidationError, type ValidationIssue, type ValidationResult, type WebSearchNodeData, type WebSocketConnectionConfig, type WorkflowConnection, type WorkflowConnectionConfig, type WorkflowConnectionStatus, type WorkflowConnectionType, type WorkflowEdge, type WorkflowExecutionError, type WorkflowExecutionState, type WorkflowExecutionStatus, type WorkflowFile, type WorkflowMetadata, type WorkflowNode, type WorkflowNodeData, type WorkflowNodeType, type WorkflowParameter, type WorkflowResult, type WorkflowValidationError, type WorkflowValidationWarning, type WorkflowVariable, basenamePosix, compile, createCoreStages, createEmptyWorkflow, createPrompdEnvironment, createWorkflowNode, dirnamePosix, extname, extractPdpkg, getContentType, getExecutionOrder, getInstallDirForType, getLanguageAliasesForExtension, getLanguageForExtension, installPackage, isAbsolutePosix, isPrompdFile, isValidPackageReference, isValidPackageType, joinPosix, needsFrontmatterProtection, normalizePosix, parsePackageReference, parsePackageReferenceWithPath, parseWorkflow, resolvePackageFile, resolvePosix, serializeWorkflow, stripFilePath, uninstallPackage, validateWorkflow, validateWorkflowQuick };

package/dist/index.js

@@ -3109,12 +3109,36 @@ function isBinaryAsset(name) {
   const dot = name.lastIndexOf(".");
   return dot >= 0 && BINARY_ASSET_EXT.has(name.slice(dot + 1).toLowerCase());
 }
+var MAX_FILE_SIZE_IN_ZIP = 10 * 1024 * 1024;
+var MAX_TOTAL_EXTRACTED_SIZE = 500 * 1024 * 1024;
+function isSymlinkEntry(perms) {
+  return typeof perms === "number" && (perms & 61440) === 40960;
+}
+var pdpkgDecoder = new TextDecoder();
 async function extractPdpkg(buffer) {
   const zip = await JSZip.loadAsync(buffer);
   const out = /* @__PURE__ */ new Map();
+  let total = 0;
   for (const entry of Object.values(zip.files)) {
+    if (entry.name.includes("\0")) {
+      throw new Error(`Security violation: null byte in entry name: ${entry.name}`);
+    }
+    if (entry.name.startsWith("/") || /(^|\/)\.\.(\/|$)/.test(entry.name)) {
+      throw new Error(`Security violation: path traversal in entry: ${entry.name}`);
+    }
+    if (isSymlinkEntry(entry.unixPermissions)) {
+      throw new Error(`Security violation: symlink entry in archive: ${entry.name}`);
+    }
     if (entry.dir || isBinaryAsset(entry.name)) continue;
-    out.set(entry.name, await entry.async("string"));
+    const bytes = await entry.async("uint8array");
+    if (bytes.length > MAX_FILE_SIZE_IN_ZIP) {
+      throw new Error(`File too large in package: ${entry.name} (${bytes.length} bytes, max ${MAX_FILE_SIZE_IN_ZIP})`);
+    }
+    total += bytes.length;
+    if (total > MAX_TOTAL_EXTRACTED_SIZE) {
+      throw new Error(`Package total decompressed size exceeds limit (${MAX_TOTAL_EXTRACTED_SIZE} bytes). Possible decompression bomb.`);
+    }
+    out.set(entry.name, pdpkgDecoder.decode(bytes));
   }
   return out;
 }
@@ -3341,28 +3365,18 @@ var HybridFileSystem = class {
 
 // src/lib/compiler/install.ts
 var MAX_PACKAGE_SIZE = 50 * 1024 * 1024;
-function joinPosix3(...parts) {
-  const joined = parts.filter((p) => p && p !== ".").join("/").replace(/\/{2,}/g, "/");
-  return joined.replace(/\/+$/, "") || "/";
+function slugify(name) {
+  return name.toLowerCase().replace(/[@/]+/g, "-").replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
 }
-function normalizeSegments(p) {
-  const out = [];
-  for (const seg of p.split("/")) {
-    if (!seg || seg === ".") continue;
-    if (seg === "..") {
-      out.pop();
-      continue;
-    }
-    out.push(seg);
-  }
-  return out.join("/");
+function resolvePackageDir(root, type, name) {
+  return joinPosix(root, ".prompd", getInstallDirForType(type), name);
 }
-function resolveInstallDir(root, type, name) {
-  return joinPosix3(root, ".prompd", getInstallDirForType(type), name);
+function resolveInstallDir(root, type, name, version) {
+  return joinPosix(resolvePackageDir(root, type, name), version);
 }
 async function addWorkspaceDependency(store, root, name, version) {
   if (!store.readFile) return;
-  const manifestPath = joinPosix3(root, "prompd.json");
+  const manifestPath = joinPosix(root, "prompd.json");
   try {
     const existing = await store.readFile(manifestPath);
     const manifest = existing && existing.trim() ? JSON.parse(existing) : {};
@@ -3374,7 +3388,7 @@ async function addWorkspaceDependency(store, root, name, version) {
 }
 async function removeWorkspaceDependency(store, root, name) {
   if (!store.readFile) return;
-  const manifestPath = joinPosix3(root, "prompd.json");
+  const manifestPath = joinPosix(root, "prompd.json");
   try {
     const existing = await store.readFile(manifestPath);
     if (!existing || !existing.trim()) return;
@@ -3386,8 +3400,20 @@ async function removeWorkspaceDependency(store, root, name) {
   } catch {
   }
 }
+function readManifest(files) {
+  const raw = files.get("manifest.json") ?? files.get("prompd.json");
+  if (!raw) return {};
+  try {
+    return JSON.parse(raw);
+  } catch {
+    return {};
+  }
+}
 async function installPackage(opts) {
-  const { ref, type, root, store, download } = opts;
+  return installInternal(opts, /* @__PURE__ */ new Set());
+}
+async function installInternal(opts, visited) {
+  const { ref, root, store, download, global, tools, deployTool } = opts;
   const parsed = parsePackageReference(ref);
   const bytes = await download(parsed.name, parsed.version);
   if (bytes.length > MAX_PACKAGE_SIZE) {
@@ -3397,43 +3423,81 @@ async function installPackage(opts) {
   if (files.size === 0) {
     throw new Error(`Package "${parsed.name}" contains no installable files.`);
   }
-  let name = parsed.name;
-  let version = parsed.version;
-  const manifest = files.get("manifest.json") ?? files.get("prompd.json");
-  if (manifest) {
-    try {
-      const m = JSON.parse(manifest);
-      if (typeof m.name === "string" && m.name) name = m.name;
-      if (typeof m.version === "string" && m.version) version = m.version;
-    } catch {
+  const m = readManifest(files);
+  const name = typeof m.name === "string" && m.name ? m.name : parsed.name;
+  const version = typeof m.version === "string" && m.version ? m.version : parsed.version;
+  const type = typeof m.type === "string" && isValidPackageType(m.type) ? m.type : opts.type && isValidPackageType(opts.type) ? opts.type : "package";
+  visited.add(name);
+  if (m.dependencies && typeof m.dependencies === "object") {
+    for (const [depName, depVersion] of Object.entries(m.dependencies)) {
+      if (depName === name || visited.has(depName)) continue;
+      await installInternal({ ...opts, ref: `${depName}@${depVersion}`, type: void 0 }, visited);
     }
   }
-  const installedPath = resolveInstallDir(root, type, name);
-  const baseSegments = normalizeSegments(installedPath);
-  await store.removeDir?.(installedPath);
+  let installedPath;
   const written = [];
-  for (const [rel, content] of files) {
-    const dest = joinPosix3(installedPath, rel);
-    const destSegments = normalizeSegments(dest);
-    if (destSegments !== baseSegments && !destSegments.startsWith(baseSegments + "/")) {
-      throw new Error(`Security violation: extracted path escapes install directory: ${rel}`);
+  if (type === "node-template") {
+    if (!store.writeBytes) {
+      throw new Error("Installing a node-template requires a PackageStore with writeBytes (binary). This host does not support it.");
+    }
+    const dir = joinPosix(root, ".prompd", getInstallDirForType("node-template"));
+    installedPath = joinPosix(dir, `${slugify(name)}-${version}.pdpkg`);
+    await store.writeBytes(installedPath, bytes);
+  } else {
+    installedPath = resolveInstallDir(root, type, name, version);
+    const base = normalizePosix(installedPath);
+    await store.removeDir?.(installedPath);
+    for (const [rel, content] of files) {
+      const dest = joinPosix(installedPath, rel);
+      if (dest !== base && !dest.startsWith(base + "/")) {
+        throw new Error(`Security violation: extracted path escapes install directory: ${rel}`);
+      }
+      await store.writeFile(dest, content);
+      written.push(rel);
+    }
+    await store.writeFile(joinPosix(installedPath, ".prmdmeta"), JSON.stringify(m, null, 2) + "\n");
+    if (tools && tools.length > 0) {
+      if (type !== "skill") throw new Error(`Tool deploy is only valid for skills, but '${name}' is a ${type}.`);
+      if (!deployTool) throw new Error("tools were requested but no deployTool hook was provided.");
+      for (const tool of tools) await deployTool({ installedPath, name, tool });
     }
-    await store.writeFile(dest, content);
-    written.push(rel);
   }
-  await addWorkspaceDependency(store, root, name, version);
-  return { name, version, scope: parsed.scope, installedPath, files: written };
+  if (!global) await addWorkspaceDependency(store, root, name, version);
+  return { name, version, scope: parsed.scope, type, installedPath, files: written };
 }
 async function uninstallPackage(opts) {
-  const { ref, type, root, store } = opts;
-  if (!store.removeDir) {
-    throw new Error("Uninstall requires a PackageStore with removeDir.");
+  const { root, store, global } = opts;
+  if (!store.removeDir) throw new Error("Uninstall requires a PackageStore with removeDir.");
+  const parsed = parsePackageReference(opts.ref);
+  const name = parsed.name;
+  const removed = [];
+  for (const type of ["package", "workflow", "skill", "node-template"]) {
+    if (type === "node-template") {
+      const dir = joinPosix(root, ".prompd", getInstallDirForType("node-template"));
+      if (!store.readdir || !store.removeFile || !store.readBytes) continue;
+      try {
+        for (const entry of await store.readdir(dir)) {
+          if (!entry.endsWith(".pdpkg")) continue;
+          const p = joinPosix(dir, entry);
+          try {
+            const m = readManifest(await extractPdpkg(await store.readBytes(p)));
+            if (m.name === name) {
+              await store.removeFile(p);
+              removed.push(p);
+            }
+          } catch {
+          }
+        }
+      } catch {
+      }
+    } else {
+      const dir = resolvePackageDir(root, type, name);
+      await store.removeDir(dir);
+      removed.push(dir);
+    }
   }
-  const parsed = parsePackageReference(ref);
-  const installedPath = resolveInstallDir(root, type, parsed.name);
-  await store.removeDir(installedPath);
-  await removeWorkspaceDependency(store, root, parsed.name);
-  return { name: parsed.name, scope: parsed.scope, installedPath };
+  if (!global) await removeWorkspaceDependency(store, root, name);
+  return { name, scope: parsed.scope, removed };
 }
 
 // src/lib/compiler/index.ts