@prompd/core 0.5.0-beta.17 → 0.5.0-beta.18

package/dist/index.cjs

@@ -3141,6 +3141,7 @@ var MAX_TOTAL_EXTRACTED_SIZE = 500 * 1024 * 1024;
 function isSymlinkEntry(perms) {
   return typeof perms === "number" && (perms & 61440) === 40960;
 }
+var pdpkgDecoder = new TextDecoder();
 async function extractPdpkg(buffer) {
   const zip = await JSZip__default.default.loadAsync(buffer);
   const out = /* @__PURE__ */ new Map();
@@ -3164,7 +3165,7 @@ async function extractPdpkg(buffer) {
     if (total > MAX_TOTAL_EXTRACTED_SIZE) {
       throw new Error(`Package total decompressed size exceeds limit (${MAX_TOTAL_EXTRACTED_SIZE} bytes). Possible decompression bomb.`);
     }
-    out.set(entry.name, new TextDecoder().decode(bytes));
+    out.set(entry.name, pdpkgDecoder.decode(bytes));
   }
   return out;
 }
@@ -3391,34 +3392,18 @@ var HybridFileSystem = class {
 
 // src/lib/compiler/install.ts
 var MAX_PACKAGE_SIZE = 50 * 1024 * 1024;
-function joinPosix3(...parts) {
-  const joined = parts.filter((p) => p && p !== ".").join("/").replace(/\/{2,}/g, "/");
-  return joined.replace(/\/+$/, "") || "/";
-}
-function normalizeSegments(p) {
-  const out = [];
-  for (const seg of p.split("/")) {
-    if (!seg || seg === ".") continue;
-    if (seg === "..") {
-      out.pop();
-      continue;
-    }
-    out.push(seg);
-  }
-  return out.join("/");
-}
 function slugify(name) {
   return name.toLowerCase().replace(/[@/]+/g, "-").replace(/[^a-z0-9-]+/g, "-").replace(/^-+|-+$/g, "");
 }
 function resolvePackageDir(root, type, name) {
-  return joinPosix3(root, ".prompd", getInstallDirForType(type), name);
+  return joinPosix(root, ".prompd", getInstallDirForType(type), name);
 }
 function resolveInstallDir(root, type, name, version) {
-  return joinPosix3(resolvePackageDir(root, type, name), version);
+  return joinPosix(resolvePackageDir(root, type, name), version);
 }
 async function addWorkspaceDependency(store, root, name, version) {
   if (!store.readFile) return;
-  const manifestPath = joinPosix3(root, "prompd.json");
+  const manifestPath = joinPosix(root, "prompd.json");
   try {
     const existing = await store.readFile(manifestPath);
     const manifest = existing && existing.trim() ? JSON.parse(existing) : {};
@@ -3430,7 +3415,7 @@ async function addWorkspaceDependency(store, root, name, version) {
 }
 async function removeWorkspaceDependency(store, root, name) {
   if (!store.readFile) return;
-  const manifestPath = joinPosix3(root, "prompd.json");
+  const manifestPath = joinPosix(root, "prompd.json");
   try {
     const existing = await store.readFile(manifestPath);
     if (!existing || !existing.trim()) return;
@@ -3482,22 +3467,22 @@ async function installInternal(opts, visited) {
     if (!store.writeBytes) {
       throw new Error("Installing a node-template requires a PackageStore with writeBytes (binary). This host does not support it.");
     }
-    const dir = joinPosix3(root, ".prompd", getInstallDirForType("node-template"));
-    installedPath = joinPosix3(dir, `${slugify(name)}-${version}.pdpkg`);
+    const dir = joinPosix(root, ".prompd", getInstallDirForType("node-template"));
+    installedPath = joinPosix(dir, `${slugify(name)}-${version}.pdpkg`);
     await store.writeBytes(installedPath, bytes);
   } else {
     installedPath = resolveInstallDir(root, type, name, version);
-    const base = normalizeSegments(installedPath);
+    const base = normalizePosix(installedPath);
     await store.removeDir?.(installedPath);
     for (const [rel, content] of files) {
-      const dest = joinPosix3(installedPath, rel);
-      if (normalizeSegments(dest) !== base && !normalizeSegments(dest).startsWith(base + "/")) {
+      const dest = joinPosix(installedPath, rel);
+      if (dest !== base && !dest.startsWith(base + "/")) {
         throw new Error(`Security violation: extracted path escapes install directory: ${rel}`);
       }
       await store.writeFile(dest, content);
       written.push(rel);
     }
-    await store.writeFile(joinPosix3(installedPath, ".prmdmeta"), JSON.stringify(m, null, 2) + "\n");
+    await store.writeFile(joinPosix(installedPath, ".prmdmeta"), JSON.stringify(m, null, 2) + "\n");
     if (tools && tools.length > 0) {
       if (type !== "skill") throw new Error(`Tool deploy is only valid for skills, but '${name}' is a ${type}.`);
       if (!deployTool) throw new Error("tools were requested but no deployTool hook was provided.");
@@ -3515,15 +3500,19 @@ async function uninstallPackage(opts) {
   const removed = [];
   for (const type of ["package", "workflow", "skill", "node-template"]) {
     if (type === "node-template") {
-      const dir = joinPosix3(root, ".prompd", getInstallDirForType("node-template"));
-      if (!store.readdir || !store.removeFile) continue;
+      const dir = joinPosix(root, ".prompd", getInstallDirForType("node-template"));
+      if (!store.readdir || !store.removeFile || !store.readBytes) continue;
       try {
-        const prefix = `${slugify(name)}-`;
         for (const entry of await store.readdir(dir)) {
-          if (entry.startsWith(prefix) && entry.endsWith(".pdpkg")) {
-            const p = joinPosix3(dir, entry);
-            await store.removeFile(p);
-            removed.push(p);
+          if (!entry.endsWith(".pdpkg")) continue;
+          const p = joinPosix(dir, entry);
+          try {
+            const m = readManifest(await extractPdpkg(await store.readBytes(p)));
+            if (m.name === name) {
+              await store.removeFile(p);
+              removed.push(p);
+            }
+          } catch {
           }
         }
       } catch {