@shard-for-obsidian/cli 0.2.0

package/dist/index.js

@@ -0,0 +1,1998 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { parseArgs } from "node:util";
+
+// ../shard-lib/dist/parsing/IndexParser.js
+var DEFAULT_INDEX_NAME = "docker.io";
+var DEFAULT_INDEX_URL = "https://registry-1.docker.io";
+var DEFAULT_LOGIN_SERVERNAME = "https://index.docker.io/v1/";
+function parseIndex(arg) {
+  if (!arg || arg === DEFAULT_LOGIN_SERVERNAME) {
+    return {
+      scheme: "https",
+      name: DEFAULT_INDEX_NAME,
+      official: true
+    };
+  }
+  let indexName;
+  let scheme = "https";
+  const protoSepIdx = arg.indexOf("://");
+  if (protoSepIdx !== -1) {
+    const foundScheme = arg.slice(0, protoSepIdx);
+    if (foundScheme !== "http" && foundScheme !== "https") {
+      throw new Error('invalid index scheme, must be "http" or "https": ' + arg);
+    }
+    scheme = foundScheme;
+    indexName = arg.slice(protoSepIdx + 3);
+  } else {
+    scheme = isLocalhost(arg) ? "http" : "https";
+    indexName = arg;
+  }
+  if (!indexName) {
+    throw new Error("invalid index, empty host: " + arg);
+  } else if (indexName.indexOf(".") === -1 && indexName.indexOf(":") === -1 && indexName !== "localhost") {
+    throw new Error(`invalid index, "${indexName}" does not look like a valid host: ${arg}`);
+  } else {
+    if (indexName[indexName.length - 1] === "/") {
+      indexName = indexName.slice(0, indexName.length - 1);
+    }
+    if (indexName.indexOf("/") !== -1) {
+      throw new Error("invalid index, trailing repo: " + arg);
+    }
+  }
+  if (indexName === "index." + DEFAULT_INDEX_NAME) {
+    indexName = DEFAULT_INDEX_NAME;
+  }
+  const index = {
+    name: indexName,
+    official: indexName === DEFAULT_INDEX_NAME,
+    scheme
+  };
+  if (index.official && index.scheme === "http") {
+    throw new Error("invalid index, plaintext HTTP to official index is disallowed: " + arg);
+  }
+  return index;
+}
+function urlFromIndex(index, scheme) {
+  if (index.official) {
+    if (scheme != null && scheme !== "https")
+      throw new Error(`Unencrypted communication with docker.io is not allowed`);
+    return DEFAULT_INDEX_URL;
+  } else {
+    if (scheme != null && scheme !== "https" && scheme !== "http")
+      throw new Error(`Non-HTTP communication with docker registries is not allowed`);
+    return `${scheme ?? index.scheme}://${index.name}`;
+  }
+}
+function isLocalhost(host) {
+  const lead = host.split(":")[0];
+  if (lead === "localhost" || lead === "127.0.0.1" || host.includes("::1")) {
+    return true;
+  } else {
+    return false;
+  }
+}
+
+// ../shard-lib/dist/utils/ValidationUtils.js
+function splitIntoTwo(str, sep) {
+  const slashIdx = str.indexOf(sep);
+  return slashIdx == -1 ? [str] : [str.slice(0, slashIdx), str.slice(slashIdx + 1)];
+}
+
+// ../shard-lib/dist/parsing/RepoParser.js
+var DEFAULT_TAG = "latest";
+var VALID_NS = /^[a-z0-9._-]*$/;
+var VALID_REPO = /^[a-z0-9_/.-]*$/;
+function parseRepo(arg, defaultIndex) {
+  let index;
+  let remoteNameRaw;
+  const protoSepIdx = arg.indexOf("://");
+  if (protoSepIdx !== -1) {
+    const slashIdx = arg.indexOf("/", protoSepIdx + 3);
+    if (slashIdx === -1) {
+      throw new Error('invalid repository name, no "/REPO" after hostame: ' + arg);
+    }
+    const indexName = arg.slice(0, slashIdx);
+    remoteNameRaw = arg.slice(slashIdx + 1);
+    index = parseIndex(indexName);
+  } else {
+    const parts = splitIntoTwo(arg, "/");
+    if (parts.length === 1 || /* or if parts[0] doesn't look like a hostname or IP */
+    parts[0].indexOf(".") === -1 && parts[0].indexOf(":") === -1 && parts[0] !== "localhost") {
+      if (defaultIndex === void 0) {
+        index = parseIndex();
+      } else if (typeof defaultIndex === "string") {
+        index = parseIndex(defaultIndex);
+      } else {
+        index = defaultIndex;
+      }
+      remoteNameRaw = arg;
+    } else {
+      index = parseIndex(parts[0]);
+      remoteNameRaw = parts[1];
+    }
+  }
+  const nameParts = splitIntoTwo(remoteNameRaw, "/");
+  let ns = "", name;
+  if (nameParts.length === 2) {
+    name = nameParts[1];
+    ns = nameParts[0];
+    if (ns.length < 2 || ns.length > 255) {
+      throw new Error("invalid repository namespace, must be between 2 and 255 characters: " + ns);
+    }
+    if (!VALID_NS.test(ns)) {
+      throw new Error("invalid repository namespace, may only contain [a-z0-9._-] characters: " + ns);
+    }
+    if (ns[0] === "-" && ns[ns.length - 1] === "-") {
+      throw new Error("invalid repository namespace, cannot start or end with a hypen: " + ns);
+    }
+    if (ns.indexOf("--") !== -1) {
+      throw new Error("invalid repository namespace, cannot contain consecutive hyphens: " + ns);
+    }
+  } else {
+    name = remoteNameRaw;
+    if (index.official) {
+      ns = "library";
+    }
+  }
+  if (!VALID_REPO.test(name)) {
+    throw new Error("invalid repository name, may only contain [a-z0-9_/.-] characters: " + name);
+  }
+  const isLibrary = index.official && ns === "library";
+  const remoteName = ns ? `${ns}/${name}` : name;
+  const localName = index.official ? isLibrary ? name : remoteName : `${index.name}/${remoteName}`;
+  const canonicalName = index.official ? `${parseIndex().name}/${localName}` : localName;
+  return {
+    index,
+    official: isLibrary,
+    remoteName,
+    localName,
+    canonicalName
+  };
+}
+function parseRepoAndRef(arg, defaultIndex) {
+  let digest = null;
+  let tag = null;
+  const atIdx = arg.lastIndexOf("@");
+  if (atIdx !== -1) {
+    digest = arg.slice(atIdx + 1);
+    arg = arg.slice(0, atIdx);
+  } else {
+    tag = DEFAULT_TAG;
+  }
+  const colonIdx = arg.lastIndexOf(":");
+  const slashIdx = arg.lastIndexOf("/");
+  if (colonIdx !== -1 && colonIdx > slashIdx) {
+    tag = arg.slice(colonIdx + 1);
+    arg = arg.slice(0, colonIdx);
+  }
+  const repo = parseRepo(arg, defaultIndex);
+  return {
+    ...repo,
+    digest,
+    tag,
+    canonicalRef: [
+      repo.canonicalName,
+      tag ? `:${tag}` : "",
+      digest ? `@${digest}` : ""
+    ].join("")
+  };
+}
+
+// ../shard-lib/dist/utils/DigestUtils.js
+function encodeHex(data) {
+  return [...new Uint8Array(data)].map((x) => x.toString(16).padStart(2, "0")).join("");
+}
+async function digestFromManifestStr(manifestStr) {
+  let manifest;
+  try {
+    manifest = JSON.parse(manifestStr);
+  } catch (thrown) {
+    const err = thrown;
+    throw new Error(`could not parse manifest: ${err.message}
+${manifestStr}`);
+  }
+  if (manifest.schemaVersion === 1) {
+    throw new Error(`schemaVersion 1 is not supported by /x/docker_registry_client.`);
+  }
+  const hash = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(manifestStr));
+  return `sha256:${encodeHex(hash)}`;
+}
+
+// ../shard-lib/dist/types/ManifestTypes.js
+var MEDIATYPE_MANIFEST_V2 = "application/vnd.docker.distribution.manifest.v2+json";
+var MEDIATYPE_MANIFEST_LIST_V2 = "application/vnd.docker.distribution.manifest.list.v2+json";
+var MEDIATYPE_OCI_MANIFEST_V1 = "application/vnd.oci.image.manifest.v1+json";
+var MEDIATYPE_OCI_MANIFEST_INDEX_V1 = "application/vnd.oci.image.index.v1+json";
+var MEDIATYPE_OBSIDIAN_PLUGIN_CONFIG_V1 = "application/vnd.obsidianmd.plugin-manifest.v1+json";
+
+// ../shard-lib/dist/ghcr/GhcrConstants.js
+var REALM = "https://ghcr.io/token";
+var SERVICE = "ghcr.io";
+
+// ../shard-lib/dist/errors/RegistryErrors.js
+var ApiError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = new.target.name;
+    Error.captureStackTrace?.(this, new.target);
+  }
+};
+var BadDigestError = class extends ApiError {
+  name = "BadDigestError";
+};
+var BlobReadError = class extends ApiError {
+  name = "BlobReadError";
+};
+var TooManyRedirectsError = class extends ApiError {
+  name = "TooManyRedirectsError";
+};
+
+// ../shard-lib/dist/parsing/LinkHeaderParser.js
+var linkRegex = /^<([^>]+)>(?:\s*;\s*(.+))?$/;
+function parseLinkHeader(rawHeader) {
+  if (!rawHeader)
+    return [];
+  return rawHeader.split(",").slice(0, 5).flatMap((piece) => {
+    const matches = piece.trim().match(linkRegex);
+    if (!matches)
+      return [];
+    const { rel, ...params } = matches[2]?.split(";").map((param) => param.trim().split("=")).reduce((acc, [key, value]) => {
+      if (!value)
+        return acc;
+      if (value.startsWith('"') && value.endsWith('"')) {
+        value = value.slice(1, -1);
+      }
+      acc[key] = value;
+      return acc;
+    }, {}) ?? {};
+    if (!rel)
+      return [];
+    return [
+      {
+        rel,
+        url: matches[1],
+        params
+      }
+    ];
+  });
+}
+
+// ../shard-lib/dist/client/OciRegistryClient.js
+var DEFAULT_USERAGENT = `open-obsidian-plugin-spec/0.1.0`;
+var getCrypto = () => {
+  if (!globalThis.crypto) {
+    throw new Error("crypto API not available. This library requires Node.js 18+ or a modern browser environment.");
+  }
+  return globalThis.crypto;
+};
+function _setAuthHeaderFromAuthInfo(headers, authInfo) {
+  if (authInfo?.type === "Bearer") {
+    headers["authorization"] = "Bearer " + authInfo.token;
+  } else if (authInfo?.type === "Basic") {
+    const credentials = `${authInfo.username ?? ""}:${authInfo.password ?? ""}`;
+    headers["authorization"] = "Basic " + btoa(credentials);
+  } else {
+    delete headers["authorization"];
+  }
+  return headers;
+}
+function _getRegistryErrorMessage(err) {
+  const e = err;
+  if (e.body && typeof e.body === "object" && e.body !== null) {
+    const body = e.body;
+    if (Array.isArray(body.errors) && body.errors[0]) {
+      return body.errors[0].message;
+    } else if (body.details) {
+      return body.details;
+    }
+  }
+  if (Array.isArray(e.errors) && e.errors[0]) {
+    return e.errors[0].message;
+  } else if (e.message) {
+    return e.message;
+  } else if (e.details) {
+    return e.details;
+  }
+  return String(err);
+}
+function _makeAuthScope(resource, name, actions) {
+  return `${resource}:${name}:${actions.join(",")}`;
+}
+function _parseDockerContentDigest(dcd) {
+  if (!dcd)
+    throw new BadDigestError('missing "Docker-Content-Digest" header');
+  const errPre = `could not parse Docker-Content-Digest header "${dcd}": `;
+  const parts = splitIntoTwo(dcd, ":");
+  if (parts.length !== 2)
+    throw new BadDigestError(errPre + JSON.stringify(dcd));
+  if (parts[0] !== "sha256")
+    throw new BadDigestError(errPre + "Unsupported hash algorithm " + JSON.stringify(parts[0]));
+  return {
+    raw: dcd,
+    algorithm: parts[0],
+    expectedDigest: parts[1],
+    async validate(buffer) {
+      switch (this.algorithm) {
+        case "sha256": {
+          const hashBuffer = await getCrypto().subtle.digest("SHA-256", buffer);
+          const digest = encodeHex(hashBuffer);
+          if (this.expectedDigest !== digest) {
+            throw new BadDigestError(`Docker-Content-Digest mismatch (expected: ${this.expectedDigest}, got: ${digest})`);
+          }
+          return;
+        }
+        default:
+          throw new BadDigestError(`Unsupported hash algorithm ${this.algorithm}`);
+      }
+    }
+  };
+}
+var OciRegistryClient = class {
+  version = 2;
+  insecure;
+  repo;
+  acceptOCIManifests;
+  acceptManifestLists;
+  username;
+  password;
+  scopes;
+  _loggedIn;
+  _loggedInScope;
+  _authInfo;
+  _headers;
+  _url;
+  _userAgent;
+  _adapter;
+  /**
+   * Create a new GHCR client for a particular repository.
+   *
+   * @param opts.insecure {Boolean} Optional. Default false. Set to true
+   *      to *not* fail on an invalid or this-signed server certificate.
+   * @param opts.adapter {FetchAdapter} Required. HTTP adapter for making requests.
+   * ... TODO: lots more to document
+   *
+   */
+  constructor(opts) {
+    this.insecure = Boolean(opts.insecure);
+    if (opts.repo) {
+      this.repo = opts.repo;
+    } else if (opts.name) {
+      this.repo = parseRepo(opts.name);
+    } else
+      throw new Error(`name or repo required`);
+    this.acceptOCIManifests = opts.acceptOCIManifests ?? true;
+    this.acceptManifestLists = opts.acceptManifestLists ?? false;
+    this.username = opts.username;
+    this.password = opts.password;
+    this.scopes = opts.scopes ?? ["pull"];
+    this._loggedIn = false;
+    this._loggedInScope = null;
+    this._authInfo = null;
+    this._headers = {};
+    if (opts.token) {
+      _setAuthHeaderFromAuthInfo(this._headers, {
+        type: "Bearer",
+        token: opts.token
+      });
+    } else if (opts.username || opts.password) {
+      _setAuthHeaderFromAuthInfo(this._headers, {
+        type: "Basic",
+        username: opts.username ?? "",
+        password: opts.password ?? ""
+      });
+    } else {
+      _setAuthHeaderFromAuthInfo(this._headers, {
+        type: "None"
+      });
+    }
+    this._url = urlFromIndex(this.repo.index, opts.scheme);
+    this._userAgent = opts.userAgent || DEFAULT_USERAGENT;
+    this._adapter = opts.adapter;
+  }
+  /**
+   * Login V2
+   *
+   * Typically one does not need to call this function directly because most
+   * methods of a `GHCRClient` will automatically login as necessary.
+   *
+   * @param opts {Object}
+   *      - opts.scope {String} Optional. A scope string passed in for
+   *        bearer/token auth. If this is just a login request where the token
+   *        won't be used, then the empty string (the default) is sufficient.
+   *        // JSSTYLED
+   *        See <https://github.com/docker/distribution/blob/master/docs/spec/auth/token.md#requesting-a-token>
+   * @return an object with authentication info
+   */
+  async performLogin(opts) {
+    return {
+      type: "Bearer",
+      token: await this._getToken({
+        realm: REALM,
+        service: SERVICE,
+        scopes: opts.scope ? [opts.scope] : []
+      })
+    };
+  }
+  /**
+   * Get an auth token.
+   *
+   * See: docker/docker.git:registry/token.go
+   */
+  async _getToken(opts) {
+    let tokenUrl = opts.realm;
+    const match = /^(\w+):\/\//.exec(tokenUrl);
+    if (!match) {
+      tokenUrl = (this.insecure ? "http" : "https") + "://" + tokenUrl;
+    } else if (match[1] && ["http", "https"].indexOf(match[1]) === -1) {
+      throw new Error(`unsupported scheme for WWW-Authenticate realm "${opts.realm}": "${match[1]}"`);
+    }
+    const headers = {};
+    const query = new URLSearchParams();
+    if (opts.service) {
+      query.set("service", opts.service);
+    }
+    if (opts.scopes && opts.scopes.length) {
+      for (const scope of opts.scopes) {
+        query.append("scope", scope);
+      }
+    }
+    if (this.username) {
+      query.set("account", this.username);
+      _setAuthHeaderFromAuthInfo(headers, {
+        type: "Basic",
+        username: this.username,
+        password: this.password ?? ""
+      });
+    }
+    if (query.toString()) {
+      tokenUrl += "?" + query.toString();
+    }
+    headers["user-agent"] = this._userAgent;
+    const resp = await this._adapter.fetch(tokenUrl, {
+      method: "GET",
+      headers
+    });
+    if (resp.status === 401) {
+      const body2 = await resp.json();
+      const errMsg = _getRegistryErrorMessage(body2);
+      throw new Error(`Registry auth failed: ${errMsg}`);
+    }
+    if (resp.status !== 200) {
+      throw new Error(`Unexpected HTTP ${resp.status} from ${tokenUrl}`);
+    }
+    const body = await resp.json();
+    if (typeof body?.token !== "string") {
+      console.error("TODO: auth resp:", body);
+      throw new Error("authorization server did not include a token in the response");
+    }
+    return body.token;
+  }
+  /**
+   * Get a registry session (i.e. login to the registry).
+   *
+   * Typically one does not need to call this method directly because most
+   * methods of a client will automatically login as necessary.
+   *
+   * @param opts {Object} Optional.
+   *      - opts.scope {String} Optional. Scope to use in the auth Bearer token.
+   *
+   * Side-effects:
+   * - On success, all of `this._loggedIn*`, `this._authInfo`, and
+   *   `this._headers.authorization` are set.
+   */
+  async login(opts = {}) {
+    const scope = opts.scope || _makeAuthScope("repository", this.repo.remoteName, this.scopes);
+    if (this._loggedIn && this._loggedInScope === scope) {
+      return;
+    }
+    const authInfo = await this.performLogin({
+      scope
+    });
+    this._loggedIn = true;
+    this._loggedInScope = scope;
+    this._authInfo = authInfo;
+    _setAuthHeaderFromAuthInfo(this._headers, authInfo);
+  }
+  async listTags(props = {}) {
+    const searchParams = new URLSearchParams();
+    if (props.pageSize != null)
+      searchParams.set("n", `${props.pageSize}`);
+    if (props.startingAfter != null)
+      searchParams.set("last", props.startingAfter);
+    await this.login();
+    const url = new URL(`/v2/${encodeURI(this.repo.remoteName)}/tags/list`, this._url);
+    url.search = searchParams.toString();
+    const headers = { ...this._headers, "user-agent": this._userAgent };
+    const resp = await this._adapter.fetch(url.toString(), {
+      method: "GET",
+      headers
+    });
+    if (!resp.ok) {
+      throw new Error(`Unexpected HTTP ${resp.status} from ${url.toString()}`);
+    }
+    return await resp.json();
+  }
+  async listAllTags(props = {}) {
+    const pages = [];
+    for await (const page of this.listTagsPaginated(props)) {
+      pages.push(page);
+    }
+    const firstPage = pages.shift();
+    for (const nextPage of pages) {
+      firstPage.tags = [...firstPage.tags, ...nextPage.tags];
+    }
+    return firstPage;
+  }
+  async *listTagsPaginated(props = {}) {
+    await this.login();
+    let path4 = `/v2/${encodeURI(this.repo.remoteName)}/tags/list`;
+    if (props.pageSize != null) {
+      path4 += `?n=${props.pageSize}`;
+    }
+    while (path4) {
+      const url = new URL(path4, this._url);
+      const headers = { ...this._headers, "user-agent": this._userAgent };
+      const resp = await this._adapter.fetch(url.toString(), {
+        method: "GET",
+        headers
+      });
+      if (!resp.ok) {
+        throw new Error(`Unexpected HTTP ${resp.status} from ${url.toString()}`);
+      }
+      const linkHeader = resp.headers.get("link");
+      const links = parseLinkHeader(linkHeader ?? null);
+      const nextLink = links.find((x) => x.rel == "next");
+      path4 = nextLink?.url ?? null;
+      yield await resp.json();
+    }
+  }
+  /*
+   * Get an image manifest. `ref` is either a tag or a digest.
+   * <https://docs.docker.com/registry/spec/api/#pulling-an-image-manifest>
+   *
+   * Note that docker-content-digest header can be undefined, so if you
+   * need a manifest digest, use the `digestFromManifestStr` function.
+   */
+  async getManifest(opts) {
+    const acceptOCIManifests = opts.acceptOCIManifests ?? this.acceptOCIManifests;
+    const acceptManifestLists = opts.acceptManifestLists ?? this.acceptManifestLists;
+    await this.login();
+    const headers = {
+      ...this._headers,
+      "user-agent": this._userAgent
+    };
+    const acceptTypes = [MEDIATYPE_MANIFEST_V2];
+    if (acceptManifestLists) {
+      acceptTypes.push(MEDIATYPE_MANIFEST_LIST_V2);
+    }
+    if (acceptOCIManifests) {
+      acceptTypes.push(MEDIATYPE_OCI_MANIFEST_V1);
+      if (acceptManifestLists) {
+        acceptTypes.push(MEDIATYPE_OCI_MANIFEST_INDEX_V1);
+      }
+    }
+    headers["accept"] = acceptTypes.join(", ");
+    const url = new URL(`/v2/${encodeURI(this.repo.remoteName ?? "")}/manifests/${encodeURI(opts.ref)}`, this._url);
+    const resp = await this._adapter.fetch(url.toString(), {
+      method: "GET",
+      headers,
+      redirect: opts.followRedirects == false ? "manual" : "follow"
+    });
+    if (resp.status === 401) {
+      const body = await resp.json();
+      const errMsg = _getRegistryErrorMessage(body);
+      throw new Error(`Manifest ${JSON.stringify(opts.ref)} Not Found: ${errMsg}`);
+    }
+    if (!resp.ok) {
+      throw new Error(`Unexpected HTTP ${resp.status} from ${url.toString()}`);
+    }
+    const manifest = await resp.json();
+    if (manifest.schemaVersion === 1) {
+      throw new Error(`schemaVersion 1 is not supported by /x/docker_registry_client.`);
+    }
+    return { resp, manifest };
+  }
+  /**
+   * Makes a http request to the given url, following any redirects, then fires
+   * the callback(err, req, responses) with the result.
+   *
+   * Note that 'responses' is an *array* of Response objects, with
+   * the last response being at the end of the array. When there is more than
+   * one response, it means a redirect has been followed.
+   */
+  async _makeHttpRequest(opts) {
+    const followRedirects = opts.followRedirects ?? true;
+    const maxRedirects = opts.maxRedirects ?? 3;
+    let numRedirs = 0;
+    const req = {
+      path: opts.path,
+      headers: opts.headers
+    };
+    const ress = new Array();
+    while (numRedirs < maxRedirects) {
+      numRedirs += 1;
+      const url = new URL(req.path, this._url);
+      const headers = {
+        ...req.headers,
+        "user-agent": this._userAgent
+      };
+      const resp = await this._adapter.fetch(url.toString(), {
+        method: opts.method,
+        headers,
+        redirect: "manual"
+      });
+      ress.push(resp);
+      if (!followRedirects)
+        return ress;
+      if (!(resp.status === 302 || resp.status === 307))
+        return ress;
+      const location = resp.headers.get("location");
+      if (!location)
+        return ress;
+      const loc = new URL(location, url);
+      req.path = loc.toString();
+      req.headers = {};
+    }
+    throw new TooManyRedirectsError(`maximum number of redirects (${maxRedirects}) hit`);
+  }
+  async _headOrGetBlob(method, digest) {
+    await this.login();
+    return await this._makeHttpRequest({
+      method,
+      path: `/v2/${encodeURI(this.repo.remoteName ?? "")}/blobs/${encodeURI(digest)}`,
+      headers: this._headers
+    });
+  }
+  /*
+   * Get an image file blob -- just the headers. See `getBlob`.
+   *
+   * <https://docs.docker.com/registry/spec/api/#get-blob>
+   * <https://docs.docker.com/registry/spec/api/#pulling-an-image-manifest>
+   *
+   * This endpoint can return 3xx redirects. The first response often redirects
+   * to an object CDN, which would then return the raw data.
+   *
+   * Interesting headers:
+   * - `ress[0].headers.get('docker-content-digest')` is the digest of the
+   *   content to be downloaded
+   * - `ress[-1].headers.get('content-length')` is the number of bytes to download
+   * - `ress[-1].headers[*]` as appropriate for HTTP caching, range gets, etc.
+   */
+  async headBlob(opts) {
+    const resp = await this._headOrGetBlob("HEAD", opts.digest);
+    return resp;
+  }
+  /**
+   * Download a blob and return its ArrayBuffer.
+   * <https://docs.docker.com/registry/spec/api/#get-blob>
+   *
+   * @return
+   *      The `buffer` is the blob's content as an ArrayBuffer.
+   *      `ress` (plural of 'res') is an array of responses
+   *      after following redirects. The full set of responses are returned mainly because
+   *      headers on both the first, e.g. 'Docker-Content-Digest', and last,
+   *      e.g. 'Content-Length', might be interesting.
+   */
+  async downloadBlob(opts) {
+    const ress = await this._headOrGetBlob("GET", opts.digest);
+    const lastResp = ress[ress.length - 1];
+    if (!lastResp) {
+      throw new BlobReadError(`No response available for blob ${opts.digest}`);
+    }
+    const buffer = await lastResp.arrayBuffer();
+    const dcdHeader = ress[0]?.headers.get("docker-content-digest");
+    if (dcdHeader) {
+      const dcdInfo = _parseDockerContentDigest(dcdHeader);
+      if (dcdInfo.raw !== opts.digest) {
+        throw new BadDigestError(`Docker-Content-Digest header, ${dcdInfo.raw}, does not match given digest, ${opts.digest}`);
+      }
+      await dcdInfo.validate(buffer);
+    }
+    return { ress, buffer };
+  }
+  /**
+   * Upload a blob using POST then PUT workflow.
+   * <https://github.com/opencontainers/distribution-spec/blob/main/spec.md#post-then-put>
+   *
+   * @param opts.data The blob data as ArrayBuffer or Uint8Array
+   * @param opts.digest Optional digest. If not provided, it will be calculated.
+   * @returns Object with digest and size of the uploaded blob
+   */
+  async pushBlob(opts) {
+    await this.login();
+    const buffer = opts.data instanceof Uint8Array ? new Uint8Array(opts.data).buffer : opts.data;
+    const hashBuffer = await getCrypto().subtle.digest("SHA-256", buffer);
+    const digest = `sha256:${encodeHex(hashBuffer)}`;
+    const postUrl = new URL(`/v2/${encodeURI(this.repo.remoteName)}/blobs/uploads/`, this._url);
+    const postHeaders = {
+      ...this._headers,
+      "user-agent": this._userAgent,
+      "content-length": "0"
+    };
+    const postResp = await this._adapter.fetch(postUrl.toString(), {
+      method: "POST",
+      headers: postHeaders
+    });
+    if (postResp.status !== 202) {
+      throw new Error(`Failed to initiate blob upload: HTTP ${postResp.status}`);
+    }
+    const uploadLocation = postResp.headers.get("location");
+    if (!uploadLocation) {
+      throw new Error("No Location header in POST response");
+    }
+    const uploadUrl = new URL(uploadLocation, this._url);
+    uploadUrl.searchParams.set("digest", digest);
+    const putHeaders = {
+      ...this._headers,
+      "user-agent": this._userAgent,
+      "content-type": "application/octet-stream",
+      "content-length": buffer.byteLength.toString()
+    };
+    const putResp = await this._adapter.fetch(uploadUrl.toString(), {
+      method: "PUT",
+      headers: putHeaders,
+      body: buffer
+    });
+    if (putResp.status !== 201) {
+      throw new Error(`Failed to upload blob: HTTP ${putResp.status}`);
+    }
+    const returnedDigest = putResp.headers.get("docker-content-digest");
+    if (returnedDigest && returnedDigest !== digest) {
+      throw new BadDigestError(`Digest mismatch: expected ${digest}, got ${returnedDigest}`);
+    }
+    return { digest, size: buffer.byteLength };
+  }
+  /**
+   * Upload an image manifest.
+   * <https://github.com/opencontainers/distribution-spec/blob/main/spec.md#pushing-manifests>
+   *
+   * @param opts.ref The tag or digest to push to
+   * @param opts.manifest The manifest object to upload
+   * @param opts.mediaType Optional media type (defaults to OCI manifest type)
+   * @returns Object with digest and size of the uploaded manifest
+   */
+  async pushManifest(opts) {
+    await this.login();
+    const manifestStr = JSON.stringify(opts.manifest);
+    const manifestBuffer = new TextEncoder().encode(manifestStr);
+    const digest = await digestFromManifestStr(manifestStr);
+    const url = new URL(`/v2/${encodeURI(this.repo.remoteName)}/manifests/${encodeURI(opts.ref)}`, this._url);
+    const headers = {
+      ...this._headers,
+      "user-agent": this._userAgent,
+      "content-type": opts.mediaType || "application/vnd.oci.image.manifest.v1+json",
+      "content-length": manifestBuffer.byteLength.toString()
+    };
+    const resp = await this._adapter.fetch(url.toString(), {
+      method: "PUT",
+      headers,
+      body: manifestBuffer
+    });
+    if (resp.status !== 201) {
+      throw new Error(`Failed to push manifest: HTTP ${resp.status}`);
+    }
+    const returnedDigest = resp.headers.get("docker-content-digest");
+    if (returnedDigest && returnedDigest !== digest) {
+      throw new BadDigestError(`Digest mismatch: expected ${digest}, got ${returnedDigest}`);
+    }
+    return { digest, size: manifestBuffer.byteLength };
+  }
+  /**
+   * Push a plugin manifest as a config blob and create an OCI manifest.
+   * This follows the OCI spec where the Obsidian manifest is stored as the config.
+   *
+   * @param opts.ref The tag or digest to push to
+   * @param opts.pluginManifest The Obsidian plugin manifest
+   * @param opts.layers The layer descriptors (main.js, styles.css, etc.)
+   * @param opts.annotations Optional annotations for the OCI manifest
+   * @returns Object with digest, configDigest, and the created manifest
+   */
+  async pushPluginManifest(opts) {
+    const manifestStr = JSON.stringify(opts.pluginManifest);
+    const manifestBuffer = new TextEncoder().encode(manifestStr);
+    const configResult = await this.pushBlob({
+      data: manifestBuffer
+    });
+    const manifest = {
+      schemaVersion: 2,
+      mediaType: MEDIATYPE_OCI_MANIFEST_V1,
+      artifactType: "application/vnd.obsidian.plugin.v1+json",
+      config: {
+        mediaType: MEDIATYPE_OBSIDIAN_PLUGIN_CONFIG_V1,
+        digest: configResult.digest,
+        size: configResult.size
+      },
+      layers: opts.layers,
+      annotations: opts.annotations
+    };
+    const manifestResult = await this.pushManifest({
+      ref: opts.ref,
+      manifest,
+      mediaType: MEDIATYPE_OCI_MANIFEST_V1
+    });
+    return {
+      digest: manifestResult.digest,
+      configDigest: configResult.digest,
+      manifest
+    };
+  }
+  /**
+   * Pull a plugin manifest by extracting it from the OCI config blob.
+   * This follows the OCI spec where the Obsidian manifest is stored as the config.
+   *
+   * @param opts.ref The tag or digest to pull
+   * @returns Object with the plugin manifest, OCI manifest, and digests
+   */
+  async pullPluginManifest(opts) {
+    const manifestResult = await this.getManifest({ ref: opts.ref });
+    const manifest = manifestResult.manifest;
+    if (!("config" in manifest) || !manifest.config) {
+      throw new Error("Manifest does not contain a config");
+    }
+    const ociManifest = manifest;
+    const manifestDigest = manifestResult.resp.headers.get("docker-content-digest") || "";
+    const { buffer: configBuffer } = await this.downloadBlob({
+      digest: ociManifest.config.digest
+    });
+    const configText = new TextDecoder().decode(configBuffer);
+    const pluginManifest = JSON.parse(configText);
+    return {
+      pluginManifest,
+      manifest: ociManifest,
+      manifestDigest,
+      configDigest: ociManifest.config.digest
+    };
+  }
+};
+
+// src/lib/plugin.ts
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+async function discoverPlugin(directory) {
+  const absDirectory = path.resolve(directory);
+  try {
+    const stat3 = await fs.stat(absDirectory);
+    if (!stat3.isDirectory()) {
+      throw new Error(`Not a directory: ${directory}`);
+    }
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+      throw new Error(`Directory not found: ${directory}`);
+    }
+    throw err;
+  }
+  const manifestPath = path.join(absDirectory, "manifest.json");
+  let manifestContent;
+  let manifestParsed;
+  try {
+    const buffer = await fs.readFile(manifestPath);
+    manifestContent = buffer.buffer.slice(
+      buffer.byteOffset,
+      buffer.byteOffset + buffer.byteLength
+    );
+    const text = new TextDecoder().decode(manifestContent);
+    const parsed = JSON.parse(text);
+    if (!parsed.version || typeof parsed.version !== "string") {
+      throw new Error('manifest.json missing required "version" field');
+    }
+    if (!parsed.id || typeof parsed.id !== "string") {
+      throw new Error('manifest.json missing required "id" field');
+    }
+    if (!parsed.name || typeof parsed.name !== "string") {
+      throw new Error('manifest.json missing required "name" field');
+    }
+    if (!parsed.minAppVersion || typeof parsed.minAppVersion !== "string") {
+      throw new Error('manifest.json missing required "minAppVersion" field');
+    }
+    if (!parsed.description || typeof parsed.description !== "string") {
+      throw new Error('manifest.json missing required "description" field');
+    }
+    if (!parsed.author || typeof parsed.author !== "string") {
+      throw new Error('manifest.json missing required "author" field');
+    }
+    manifestParsed = parsed;
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+      throw new Error(`manifest.json not found in ${directory}`);
+    }
+    if (err instanceof SyntaxError) {
+      throw new Error(`Could not parse manifest.json: ${err.message}`);
+    }
+    throw err;
+  }
+  const mainJsPath = path.join(absDirectory, "main.js");
+  let mainJsContent;
+  try {
+    const buffer = await fs.readFile(mainJsPath);
+    mainJsContent = buffer.buffer.slice(
+      buffer.byteOffset,
+      buffer.byteOffset + buffer.byteLength
+    );
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+      throw new Error(`main.js not found in ${directory}`);
+    }
+    throw err;
+  }
+  const stylesCssPath = path.join(absDirectory, "styles.css");
+  let stylesCssContent;
+  try {
+    const buffer = await fs.readFile(stylesCssPath);
+    stylesCssContent = buffer.buffer.slice(
+      buffer.byteOffset,
+      buffer.byteOffset + buffer.byteLength
+    );
+  } catch (err) {
+    if (err && typeof err === "object" && "code" in err && err.code === "ENOENT") {
+      stylesCssContent = void 0;
+    } else {
+      throw err;
+    }
+  }
+  return {
+    directory: absDirectory,
+    manifest: {
+      path: manifestPath,
+      content: manifestContent,
+      parsed: manifestParsed
+    },
+    mainJs: {
+      path: mainJsPath,
+      content: mainJsContent
+    },
+    ...stylesCssContent && {
+      stylesCss: {
+        path: stylesCssPath,
+        content: stylesCssContent
+      }
+    }
+  };
+}
+
+// src/commands/push.ts
+function deriveGitHubUrl(remoteName) {
+  const parts = remoteName.split("/");
+  if (parts.length < 2) {
+    throw new Error(
+      `Cannot derive GitHub URL from ${remoteName}. Need at least owner/repo format.`
+    );
+  }
+  const owner = parts[0];
+  const repo = parts[1];
+  return `https://github.com/${owner}/${repo}`;
+}
+async function pushCommand(opts) {
+  const { directory, repository, token, logger, adapter } = opts;
+  logger.log(`Discovering plugin files in ${directory}...`);
+  const plugin = await discoverPlugin(directory);
+  const version = plugin.manifest.parsed.version;
+  logger.log(`Found plugin version ${version}`);
+  const fullRef = repository.includes(":") ? repository : `${repository}:${version}`;
+  logger.log(`Pushing to ${fullRef}...`);
+  const ref = parseRepoAndRef(fullRef);
+  const client = new OciRegistryClient({
+    repo: ref,
+    username: "github",
+    password: token,
+    adapter,
+    scopes: ["push", "pull"]
+  });
+  const layers = [];
+  logger.log("Pushing main.js...");
+  const mainJsResult = await client.pushBlob({
+    data: plugin.mainJs.content
+  });
+  layers.push({
+    mediaType: "application/javascript",
+    digest: mainJsResult.digest,
+    size: mainJsResult.size,
+    annotations: {
+      "org.opencontainers.image.title": "main.js"
+    }
+  });
+  logger.log(
+    `Pushed main.js: ${mainJsResult.digest.slice(0, 19)}... (${mainJsResult.size} bytes)`
+  );
+  if (plugin.stylesCss) {
+    logger.log("Pushing styles.css...");
+    const stylesCssResult = await client.pushBlob({
+      data: plugin.stylesCss.content
+    });
+    layers.push({
+      mediaType: "text/css",
+      digest: stylesCssResult.digest,
+      size: stylesCssResult.size,
+      annotations: {
+        "org.opencontainers.image.title": "styles.css"
+      }
+    });
+    logger.log(
+      `Pushed styles.css: ${stylesCssResult.digest.slice(0, 19)}... (${stylesCssResult.size} bytes)`
+    );
+  }
+  const githubUrl = deriveGitHubUrl(ref.remoteName);
+  const manifest = plugin.manifest.parsed;
+  const annotations = {
+    "org.opencontainers.image.created": (/* @__PURE__ */ new Date()).toISOString(),
+    "org.opencontainers.image.source": githubUrl,
+    "org.opencontainers.image.version": manifest.version,
+    "org.opencontainers.image.description": manifest.description,
+    "org.opencontainers.image.authors": manifest.author
+  };
+  if (manifest.authorUrl) {
+    annotations["org.opencontainers.image.url"] = manifest.authorUrl;
+  }
+  logger.log("Pushing plugin manifest...");
+  const manifestPushResult = await client.pushPluginManifest({
+    ref: ref.tag || version,
+    pluginManifest: manifest,
+    layers,
+    annotations
+  });
+  logger.success(`Successfully pushed ${fullRef}`);
+  logger.log(`Manifest digest: ${manifestPushResult.digest}`);
+  logger.log(`GitHub repository: ${githubUrl}`);
+  const totalSize = manifestPushResult.manifest.layers.reduce(
+    (sum, layer) => sum + layer.size,
+    0
+  );
+  return {
+    digest: manifestPushResult.digest,
+    tag: ref.tag || version,
+    size: totalSize,
+    repository: fullRef
+  };
+}
+
+// src/commands/pull.ts
+import * as fs2 from "node:fs/promises";
+import * as path2 from "node:path";
+async function pullCommand(opts) {
+  const { repository, output, token, logger, adapter } = opts;
+  logger.log(`Pulling ${repository}...`);
+  const ref = parseRepoAndRef(repository);
+  if (!ref.tag && !ref.digest) {
+    throw new Error("Repository reference must include tag or digest");
+  }
+  const client = new OciRegistryClient({
+    repo: ref,
+    username: "github",
+    password: token,
+    adapter
+  });
+  logger.log("Fetching manifest...");
+  const refString = ref.tag || ref.digest || "";
+  const pullResult = await client.pullPluginManifest({ ref: refString });
+  const manifest = pullResult.manifest;
+  logger.log(`Manifest digest: ${pullResult.manifestDigest}`);
+  const absOutput = path2.resolve(output);
+  logger.log(`Creating output directory: ${absOutput}`);
+  await fs2.mkdir(absOutput, { recursive: true });
+  const manifestPath = path2.join(absOutput, "manifest.json");
+  const manifestJson = JSON.stringify(pullResult.pluginManifest, null, 2);
+  await fs2.writeFile(manifestPath, manifestJson, "utf-8");
+  logger.log(`Wrote manifest.json (${manifestJson.length} bytes)`);
+  const files = ["manifest.json"];
+  for (const layer of manifest.layers) {
+    const filename = layer.annotations?.["org.opencontainers.image.title"];
+    if (!filename) {
+      throw new Error(
+        `Layer ${layer.digest} missing required filename annotation`
+      );
+    }
+    logger.log(`Downloading ${filename}...`);
+    const blobResult = await client.downloadBlob({
+      digest: layer.digest
+    });
+    const filePath = path2.join(absOutput, filename);
+    const buffer = Buffer.from(blobResult.buffer);
+    await fs2.writeFile(filePath, buffer);
+    logger.log(`Wrote ${filename} (${buffer.length} bytes)`);
+    files.push(filename);
+  }
+  logger.success(`Successfully pulled ${repository}`);
+  logger.log(`Files extracted to: ${absOutput}`);
+  return {
+    files,
+    output: absOutput,
+    digest: pullResult.manifestDigest
+  };
+}
+
+// src/lib/community-plugins.ts
+var COMMUNITY_PLUGINS_URL = "https://raw.githubusercontent.com/obsidianmd/obsidian-releases/refs/heads/master/community-plugins.json";
+
+// src/lib/community-cache.ts
+var CommunityPluginsCache = class {
+  adapter;
+  plugins = null;
+  constructor(adapter) {
+    this.adapter = adapter;
+  }
+  /**
+   * Fetch the list of community plugins.
+   * Results are cached for subsequent calls.
+   *
+   * @returns Array of community plugins
+   * @throws Error if fetch fails
+   */
+  async fetch() {
+    if (this.plugins !== null) {
+      return this.plugins;
+    }
+    const response = await this.adapter.fetch(COMMUNITY_PLUGINS_URL);
+    if (!response.ok) {
+      throw new Error(`Failed to fetch community plugins: ${response.status}`);
+    }
+    const plugins = await response.json();
+    this.plugins = plugins;
+    return plugins;
+  }
+  /**
+   * Find a plugin by ID.
+   * Fetches the plugin list if not already cached.
+   *
+   * @param id - Plugin ID to search for
+   * @returns Plugin if found, undefined otherwise
+   */
+  async findPlugin(id) {
+    const plugins = await this.fetch();
+    return plugins.find((plugin) => plugin.id === id);
+  }
+};
+
+// src/lib/github-release.ts
+var GitHubReleaseFetcher = class {
+  adapter;
+  constructor(adapter) {
+    this.adapter = adapter;
+  }
+  /**
+   * Fetch the latest release from a GitHub repository.
+   *
+   * @param repo - Repository in format "owner/repo"
+   * @param token - Optional GitHub token for authentication
+   * @returns Latest release information
+   * @throws Error if fetch fails
+   */
+  async fetchLatestRelease(repo, token) {
+    const url = `https://api.github.com/repos/${repo}/releases/latest`;
+    const headers = {
+      Accept: "application/vnd.github.v3+json"
+    };
+    if (token) {
+      headers.Authorization = `Bearer ${token}`;
+    }
+    const response = await this.adapter.fetch(url, { headers });
+    if (!response.ok) {
+      throw new Error(`Failed to fetch latest release: ${response.status}`);
+    }
+    return await response.json();
+  }
+  /**
+   * Fetch a specific release by tag from a GitHub repository.
+   *
+   * @param repo - Repository in format "owner/repo"
+   * @param tag - Tag name (e.g., "1.2.3")
+   * @param token - Optional GitHub token for authentication
+   * @returns Release information
+   * @throws Error if fetch fails
+   */
+  async fetchReleaseByTag(repo, tag, token) {
+    const url = `https://api.github.com/repos/${repo}/releases/tags/${tag}`;
+    const headers = {
+      Accept: "application/vnd.github.v3+json"
+    };
+    if (token) {
+      headers.Authorization = `Bearer ${token}`;
+    }
+    const response = await this.adapter.fetch(url, { headers });
+    if (!response.ok) {
+      throw new Error(`Failed to fetch release ${tag}: ${response.status}`);
+    }
+    return await response.json();
+  }
+};
+
+// src/lib/converter.ts
+var PluginConverter = class {
+  adapter;
+  communityCache;
+  releaseFetcher;
+  constructor(adapter) {
+    this.adapter = adapter;
+    this.communityCache = new CommunityPluginsCache(adapter);
+    this.releaseFetcher = new GitHubReleaseFetcher(adapter);
+  }
+  /**
+   * Convert a plugin from GitHub releases to OCI format.
+   *
+   * @param options - Conversion options
+   * @returns Conversion result with plugin data
+   * @throws Error if plugin not found or conversion fails
+   */
+  async convertPlugin(options) {
+    const { pluginId, version, repository, token } = options;
+    const plugin = await this.communityCache.findPlugin(pluginId);
+    if (!plugin) {
+      throw new Error(`Plugin "${pluginId}" not found in community plugins`);
+    }
+    const release = version ? await this.releaseFetcher.fetchReleaseByTag(plugin.repo, version, token) : await this.releaseFetcher.fetchLatestRelease(plugin.repo, token);
+    const manifestAsset = release.assets.find(
+      (a) => a.name === "manifest.json"
+    );
+    const mainJsAsset = release.assets.find((a) => a.name === "main.js");
+    const stylesCssAsset = release.assets.find((a) => a.name === "styles.css");
+    if (!manifestAsset) {
+      throw new Error("manifest.json not found in release");
+    }
+    if (!mainJsAsset) {
+      throw new Error("main.js not found in release");
+    }
+    const manifestResponse = await this.adapter.fetch(
+      manifestAsset.browser_download_url
+    );
+    if (!manifestResponse.ok) {
+      throw new Error(
+        `Failed to download manifest.json: ${manifestResponse.status}`
+      );
+    }
+    const manifestJson = await manifestResponse.text();
+    const manifest = JSON.parse(manifestJson);
+    const mainJsResponse = await this.adapter.fetch(
+      mainJsAsset.browser_download_url
+    );
+    if (!mainJsResponse.ok) {
+      throw new Error(`Failed to download main.js: ${mainJsResponse.status}`);
+    }
+    const mainJs = await mainJsResponse.text();
+    let stylesCss;
+    if (stylesCssAsset) {
+      const stylesCssResponse = await this.adapter.fetch(
+        stylesCssAsset.browser_download_url
+      );
+      if (!stylesCssResponse.ok) {
+        throw new Error(
+          `Failed to download styles.css: ${stylesCssResponse.status}`
+        );
+      }
+      stylesCss = await stylesCssResponse.text();
+    }
+    const fullRepository = repository.includes(":") ? repository : `${repository}:${release.tag_name}`;
+    return {
+      pluginId,
+      version: release.tag_name,
+      repository: fullRepository,
+      githubRepo: plugin.repo,
+      manifest,
+      mainJs,
+      stylesCss
+    };
+  }
+  /**
+   * Push plugin data to OCI registry.
+   *
+   * @param options - Push options
+   * @returns Push result
+   * @throws Error if push fails
+   */
+  async pushToRegistry(options) {
+    const { repository, githubRepo, token, pluginData } = options;
+    const ref = parseRepoAndRef(repository);
+    const client = new OciRegistryClient({
+      repo: ref,
+      username: "github",
+      password: token,
+      adapter: this.adapter,
+      scopes: ["push", "pull"]
+    });
+    const layers = [];
+    const mainJsResult = await client.pushBlob({
+      data: new TextEncoder().encode(pluginData.mainJs)
+    });
+    layers.push({
+      mediaType: "application/javascript",
+      digest: mainJsResult.digest,
+      size: mainJsResult.size,
+      annotations: {
+        "org.opencontainers.image.title": "main.js"
+      }
+    });
+    if (pluginData.stylesCss) {
+      const stylesCssResult = await client.pushBlob({
+        data: new TextEncoder().encode(pluginData.stylesCss)
+      });
+      layers.push({
+        mediaType: "text/css",
+        digest: stylesCssResult.digest,
+        size: stylesCssResult.size,
+        annotations: {
+          "org.opencontainers.image.title": "styles.css"
+        }
+      });
+    }
+    const annotations = {
+      "org.opencontainers.image.created": (/* @__PURE__ */ new Date()).toISOString(),
+      "org.opencontainers.image.source": githubRepo,
+      "org.opencontainers.image.version": pluginData.manifest.version,
+      "org.opencontainers.image.description": pluginData.manifest.description,
+      "org.opencontainers.image.authors": pluginData.manifest.author
+    };
+    if (pluginData.manifest.authorUrl) {
+      annotations["org.opencontainers.image.url"] = pluginData.manifest.authorUrl;
+    }
+    const manifestPushResult = await client.pushPluginManifest({
+      ref: ref.tag || pluginData.manifest.version,
+      pluginManifest: pluginData.manifest,
+      layers,
+      annotations
+    });
+    const totalSize = manifestPushResult.manifest.layers.reduce(
+      (sum, layer) => sum + layer.size,
+      0
+    );
+    return {
+      digest: manifestPushResult.digest,
+      tag: ref.tag || pluginData.manifest.version,
+      size: totalSize,
+      repository
+    };
+  }
+};
+
+// src/commands/convert.ts
+async function convertCommand(opts) {
+  const { pluginId, repository, version, token, logger, adapter } = opts;
+  const converter = new PluginConverter(adapter);
+  logger.log(`Converting plugin "${pluginId}"...`);
+  if (version) {
+    logger.log(`Using specific version: ${version}`);
+  } else {
+    logger.log("Using latest version");
+  }
+  const convertResult = await converter.convertPlugin({
+    pluginId,
+    version,
+    repository,
+    token
+  });
+  logger.log(
+    `Downloaded plugin ${convertResult.pluginId} v${convertResult.version}`
+  );
+  logger.log(`  - manifest.json: ${convertResult.manifest.name}`);
+  logger.log(`  - main.js: ${convertResult.mainJs.length} bytes`);
+  if (convertResult.stylesCss) {
+    logger.log(`  - styles.css: ${convertResult.stylesCss.length} bytes`);
+  }
+  logger.log(`
+Pushing to ${convertResult.repository}...`);
+  const pushResult = await converter.pushToRegistry({
+    repository: convertResult.repository,
+    githubRepo: convertResult.githubRepo,
+    token,
+    pluginData: {
+      manifest: convertResult.manifest,
+      mainJs: convertResult.mainJs,
+      stylesCss: convertResult.stylesCss
+    }
+  });
+  logger.success(
+    `Successfully converted and pushed ${convertResult.pluginId} v${convertResult.version}`
+  );
+  logger.log(`Manifest digest: ${pushResult.digest}`);
+  logger.log(`Repository: ${pushResult.repository}`);
+  return {
+    pluginId: convertResult.pluginId,
+    version: convertResult.version,
+    repository: pushResult.repository,
+    digest: pushResult.digest,
+    size: pushResult.size
+  };
+}
+
+// src/lib/marketplace-client.ts
+var DEFAULT_MARKETPLACE_URL = "https://shard-for-obsidian.github.io/shard/plugins.json";
+var MarketplaceClient = class {
+  constructor(adapter, marketplaceUrl = DEFAULT_MARKETPLACE_URL) {
+    this.adapter = adapter;
+    this.marketplaceUrl = marketplaceUrl;
+  }
+  /**
+   * Fetch all plugins from the marketplace.
+   */
+  async fetchPlugins() {
+    const response = await this.adapter.fetch(this.marketplaceUrl);
+    if (!response.ok) {
+      throw new Error(
+        `Failed to fetch marketplace data: ${response.status} ${response.statusText}`
+      );
+    }
+    const data = await response.json();
+    if (!data.plugins || !Array.isArray(data.plugins)) {
+      throw new Error("Invalid marketplace data format");
+    }
+    return data.plugins;
+  }
+  /**
+   * Find a plugin by ID.
+   */
+  async findPluginById(pluginId) {
+    const plugins = await this.fetchPlugins();
+    return plugins.find((p) => p.id === pluginId) || null;
+  }
+  /**
+   * Search plugins by keyword (searches in name, description, author, tags).
+   */
+  async searchPlugins(keyword) {
+    const plugins = await this.fetchPlugins();
+    const lowerKeyword = keyword.toLowerCase();
+    return plugins.filter(
+      (p) => p.name.toLowerCase().includes(lowerKeyword) || p.description.toLowerCase().includes(lowerKeyword) || p.author.toLowerCase().includes(lowerKeyword) || p.id.toLowerCase().includes(lowerKeyword) || p.tags?.some((tag) => tag.toLowerCase().includes(lowerKeyword))
+    );
+  }
+};
+
+// src/commands/marketplace.ts
+import * as fs3 from "node:fs/promises";
+import * as path3 from "node:path";
+async function marketplaceRegisterCommand(opts) {
+  const { repository, token, logger, adapter } = opts;
+  logger.log(`Fetching plugin metadata from ${repository}...`);
+  const ref = parseRepoAndRef(repository);
+  const client = new OciRegistryClient({
+    repo: ref,
+    username: "github",
+    password: token,
+    adapter,
+    scopes: ["pull"]
+  });
+  const manifestResult = await client.pullPluginManifest({
+    ref: ref.tag || "latest"
+  });
+  const pluginManifest = manifestResult.pluginManifest;
+  const ociManifest = manifestResult.manifest;
+  const pluginId = pluginManifest.id;
+  const name = pluginManifest.name;
+  const author = pluginManifest.author;
+  const description = pluginManifest.description || "";
+  const version = pluginManifest.version;
+  const minObsidianVersion = pluginManifest.minAppVersion;
+  const authorUrl = pluginManifest.authorUrl;
+  let gitHubRepoUrl;
+  if (ociManifest.annotations && ociManifest.annotations["org.opencontainers.image.source"]) {
+    const source = ociManifest.annotations["org.opencontainers.image.source"];
+    if (source.startsWith("http")) {
+      gitHubRepoUrl = source;
+    } else {
+      gitHubRepoUrl = `https://github.com/${source}`;
+    }
+  }
+  const registryUrl = ref.canonicalName;
+  logger.log(`Plugin ID: ${pluginId}`);
+  logger.log(`Name: ${name}`);
+  logger.log(`Author: ${author}`);
+  logger.log(`Version: ${version}`);
+  logger.log(`Registry URL: ${registryUrl}`);
+  if (gitHubRepoUrl) {
+    logger.log(`Repository: ${gitHubRepoUrl}`);
+  }
+  let yamlContent = `id: ${pluginId}
+registryUrl: ${registryUrl}
+name: ${name}
+author: ${author}
+description: ${description}
+version: ${version}
+`;
+  if (gitHubRepoUrl) {
+    yamlContent += `repository: ${gitHubRepoUrl}
+`;
+  }
+  if (minObsidianVersion) {
+    yamlContent += `minObsidianVersion: ${minObsidianVersion}
+`;
+  }
+  if (authorUrl) {
+    yamlContent += `authorUrl: ${authorUrl}
+`;
+  }
+  yamlContent += `updatedAt: ${(/* @__PURE__ */ new Date()).toISOString()}
+`;
+  const marketplacePath = await findMarketplaceDir();
+  const pluginsDir = path3.join(marketplacePath, "plugins");
+  const yamlPath = path3.join(pluginsDir, `${pluginId}.yml`);
+  await fs3.mkdir(pluginsDir, { recursive: true });
+  await fs3.writeFile(yamlPath, yamlContent, "utf-8");
+  logger.success(`Successfully registered plugin to ${yamlPath}`);
+  logger.log(`
+Next steps:`);
+  logger.log(`1. Review the generated YAML file`);
+  logger.log(`2. Commit and push to the marketplace repository`);
+  logger.log(`3. Submit a pull request to add your plugin to the marketplace`);
+  return {
+    pluginId,
+    name,
+    author,
+    description,
+    version,
+    registryUrl,
+    repository: gitHubRepoUrl,
+    minObsidianVersion,
+    authorUrl,
+    yamlPath
+  };
+}
+async function findMarketplaceDir() {
+  let currentDir = process.cwd();
+  const root = path3.parse(currentDir).root;
+  while (currentDir !== root) {
+    const marketplacePath = path3.join(currentDir, "marketplace");
+    try {
+      const stat3 = await fs3.stat(marketplacePath);
+      if (stat3.isDirectory()) {
+        return marketplacePath;
+      }
+    } catch {
+    }
+    currentDir = path3.dirname(currentDir);
+  }
+  throw new Error(
+    "Could not find marketplace directory. Please run this command from within the marketplace repository."
+  );
+}
+async function marketplaceListCommand(opts) {
+  const { logger, adapter, marketplaceUrl } = opts;
+  const client = new MarketplaceClient(adapter, marketplaceUrl);
+  logger.log("Fetching marketplace plugins...");
+  const plugins = await client.fetchPlugins();
+  logger.log(`
+Found ${plugins.length} plugins:
+`);
+  for (const plugin of plugins) {
+    logger.log(`${plugin.name} (${plugin.id})`);
+    logger.log(`  Author: ${plugin.author}`);
+    logger.log(`  Version: ${plugin.version}`);
+    logger.log(`  Registry: ${plugin.registryUrl}`);
+    if (plugin.description) {
+      logger.log(`  Description: ${plugin.description}`);
+    }
+    logger.log("");
+  }
+  return plugins;
+}
+async function marketplaceSearchCommand(opts) {
+  const { keyword, logger, adapter, marketplaceUrl } = opts;
+  const client = new MarketplaceClient(adapter, marketplaceUrl);
+  logger.log(`Searching for "${keyword}"...`);
+  const plugins = await client.searchPlugins(keyword);
+  if (plugins.length === 0) {
+    logger.log(`
+No plugins found matching "${keyword}"`);
+    return [];
+  }
+  logger.log(`
+Found ${plugins.length} matching plugin(s):
+`);
+  for (const plugin of plugins) {
+    logger.log(`${plugin.name} (${plugin.id})`);
+    logger.log(`  Author: ${plugin.author}`);
+    logger.log(`  Version: ${plugin.version}`);
+    logger.log(`  Registry: ${plugin.registryUrl}`);
+    if (plugin.description) {
+      logger.log(`  Description: ${plugin.description}`);
+    }
+    logger.log("");
+  }
+  return plugins;
+}
+async function marketplaceInfoCommand(opts) {
+  const { pluginId, logger, adapter, marketplaceUrl } = opts;
+  const client = new MarketplaceClient(adapter, marketplaceUrl);
+  logger.log(`Fetching plugin "${pluginId}"...`);
+  const plugin = await client.findPluginById(pluginId);
+  if (!plugin) {
+    logger.error(`Plugin "${pluginId}" not found in marketplace`);
+    return null;
+  }
+  logger.log("\n" + "=".repeat(60));
+  logger.log(`Plugin: ${plugin.name}`);
+  logger.log("=".repeat(60) + "\n");
+  logger.log(`ID: ${plugin.id}`);
+  logger.log(`Version: ${plugin.version}`);
+  logger.log(`Author: ${plugin.author}`);
+  if (plugin.authorUrl) {
+    logger.log(`Author URL: ${plugin.authorUrl}`);
+  }
+  logger.log(`Description: ${plugin.description}`);
+  logger.log(`
+Registry URL: ${plugin.registryUrl}`);
+  if (plugin.repository) {
+    logger.log(`Repository: ${plugin.repository}`);
+  }
+  if (plugin.license) {
+    logger.log(`License: ${plugin.license}`);
+  }
+  if (plugin.minObsidianVersion) {
+    logger.log(`Min Obsidian Version: ${plugin.minObsidianVersion}`);
+  }
+  if (plugin.tags && plugin.tags.length > 0) {
+    logger.log(`Tags: ${plugin.tags.join(", ")}`);
+  }
+  logger.log(`Last Updated: ${plugin.updatedAt}`);
+  logger.log("\n" + "=".repeat(60));
+  logger.log("Installation:");
+  logger.log("=".repeat(60) + "\n");
+  logger.log(`shard pull ${plugin.registryUrl}:${plugin.version} --output <path>`);
+  logger.log(
+    `shard marketplace install ${plugin.id}  # (coming soon)`
+  );
+  return plugin;
+}
+async function marketplaceInstallCommand(opts) {
+  const { pluginId, output, version, token, logger, adapter, marketplaceUrl } = opts;
+  const client = new MarketplaceClient(adapter, marketplaceUrl);
+  logger.log(`Looking up plugin "${pluginId}" in marketplace...`);
+  const plugin = await client.findPluginById(pluginId);
+  if (!plugin) {
+    throw new Error(`Plugin "${pluginId}" not found in marketplace`);
+  }
+  logger.log(`Found: ${plugin.name} v${plugin.version} by ${plugin.author}`);
+  const versionToInstall = version || plugin.version;
+  const repository = `${plugin.registryUrl}:${versionToInstall}`;
+  logger.log(`Installing from ${repository}...`);
+  const pullResult = await pullCommand({
+    repository,
+    output,
+    token,
+    logger,
+    adapter
+  });
+  logger.success(
+    `Successfully installed ${plugin.name} v${versionToInstall} to ${output}`
+  );
+  return { plugin, pullResult };
+}
+async function marketplaceUpdateCommand(opts) {
+  const { logger } = opts;
+  logger.log("Updating marketplace entry...");
+  logger.log(
+    "Note: This will overwrite the existing YAML file with fresh metadata from GHCR\n"
+  );
+  return marketplaceRegisterCommand(opts);
+}
+
+// src/lib/auth.ts
+function resolveAuthToken(cliToken) {
+  if (cliToken) {
+    return cliToken;
+  }
+  const githubToken = process.env.GITHUB_TOKEN;
+  if (githubToken) {
+    return githubToken;
+  }
+  const ghToken = process.env.GH_TOKEN;
+  if (ghToken) {
+    return ghToken;
+  }
+  throw new Error(
+    "GitHub token required. Use --token flag or set GITHUB_TOKEN environment variable"
+  );
+}
+
+// src/lib/logger.ts
+var Logger = class {
+  silent;
+  constructor(silent = false) {
+    this.silent = silent;
+  }
+  /**
+   * Log a message to stderr
+   */
+  log(message) {
+    if (!this.silent) {
+      process.stderr.write(message + "\n");
+    }
+  }
+  /**
+   * Log an error message to stderr
+   */
+  error(message) {
+    if (!this.silent) {
+      process.stderr.write(`Error: ${message}
+`);
+    }
+  }
+  /**
+   * Log a success message to stderr
+   */
+  success(message) {
+    if (!this.silent) {
+      process.stderr.write(`Success: ${message}
+`);
+    }
+  }
+};
+
+// src/adapters/node-fetch-adapter.ts
+var NodeFetchAdapter = class {
+  async fetch(input, init) {
+    return fetch(input, init);
+  }
+};
+
+// src/index.ts
+var USAGE = `
+Usage: shard <command> [options]
+
+Commands:
+  push <directory> <repository>     Push a plugin to GHCR
+  pull <repository>                 Pull a plugin from GHCR
+  convert <plugin-id> <repository>  Convert legacy plugin to OCI format
+  marketplace <subcommand>          Manage marketplace plugins
+
+Marketplace Subcommands:
+  list                              List all marketplace plugins
+  search <keyword>                  Search for plugins
+  info <plugin-id>                  Show detailed plugin information
+  install <plugin-id>               Install a plugin by ID
+  register <repository>             Register plugin to marketplace
+  update <repository>               Update marketplace entry
+
+Push Options:
+  <directory>                       Path to plugin build output (e.g., ./dist)
+  <repository>                      GHCR repository (e.g., ghcr.io/user/plugin)
+  --token <pat>                     GitHub Personal Access Token
+  --json                            Output JSON result to stdout
+  --help                            Show help
+
+Pull Options:
+  <repository>                      Full reference with tag (e.g., ghcr.io/user/plugin:1.0.0)
+  --output <dir>                    Where to extract files (required)
+  --token <pat>                     GitHub Personal Access Token
+  --json                            Output JSON result to stdout
+  --help                            Show help
+
+Convert Options:
+  <plugin-id>                       Plugin ID from community list (e.g., obsidian-git)
+  <repository>                      GHCR repository (e.g., ghcr.io/user/plugin)
+  --version <version>               Specific version to convert (defaults to latest)
+  --token <pat>                     GitHub Personal Access Token
+  --json                            Output JSON result to stdout
+  --help                            Show help
+
+Marketplace Options:
+  --output <dir>                    Output directory for install command
+  --version <version>               Specific version to install (defaults to latest)
+  --token <pat>                     GitHub Personal Access Token
+  --json                            Output JSON result to stdout
+  --help                            Show help
+
+Environment Variables:
+  GITHUB_TOKEN                      GitHub token (alternative to --token)
+  GH_TOKEN                          GitHub token (gh CLI compatibility)
+
+Examples:
+  shard push ./dist ghcr.io/user/my-plugin
+  shard pull ghcr.io/user/my-plugin:1.0.0 --output ./plugin
+  shard convert obsidian-git ghcr.io/user/obsidian-git
+  shard convert calendar ghcr.io/user/calendar --version 1.5.3
+  shard marketplace list
+  shard marketplace search "calendar"
+  shard marketplace info obsidian-git
+  shard marketplace install obsidian-git --output ./plugins/obsidian-git
+  shard marketplace register ghcr.io/user/my-plugin:1.0.0
+  shard marketplace update ghcr.io/user/my-plugin:1.0.1
+`;
+async function main() {
+  let args;
+  try {
+    args = parseArgs({
+      options: {
+        token: { type: "string" },
+        json: { type: "boolean", default: false },
+        help: { type: "boolean", default: false },
+        output: { type: "string" },
+        version: { type: "string" }
+      },
+      allowPositionals: true
+    });
+  } catch (err) {
+    console.error(
+      `Error parsing arguments: ${err instanceof Error ? err.message : String(err)}`
+    );
+    console.error(USAGE);
+    process.exit(1);
+  }
+  if (args.values.help || args.positionals.length === 0) {
+    console.log(USAGE);
+    process.exit(0);
+  }
+  const command = args.positionals[0];
+  const logger = new Logger(args.values.json);
+  const adapter = new NodeFetchAdapter();
+  try {
+    if (command === "push") {
+      if (args.positionals.length < 3) {
+        throw new Error("Push command requires <directory> and <repository>");
+      }
+      const directory = args.positionals[1];
+      const repository = args.positionals[2];
+      const token = resolveAuthToken(args.values.token);
+      const result = await pushCommand({
+        directory,
+        repository,
+        token,
+        logger,
+        adapter
+      });
+      if (args.values.json) {
+        console.log(JSON.stringify(result, null, 2));
+      }
+      process.exit(0);
+    } else if (command === "pull") {
+      if (args.positionals.length < 2) {
+        throw new Error("Pull command requires <repository>");
+      }
+      if (!args.values.output) {
+        throw new Error("Pull command requires --output flag");
+      }
+      const repository = args.positionals[1];
+      const output = args.values.output;
+      const token = resolveAuthToken(args.values.token);
+      const result = await pullCommand({
+        repository,
+        output,
+        token,
+        logger,
+        adapter
+      });
+      if (args.values.json) {
+        console.log(JSON.stringify(result, null, 2));
+      }
+      process.exit(0);
+    } else if (command === "convert") {
+      if (args.positionals.length < 3) {
+        throw new Error(
+          "Convert command requires <plugin-id> and <repository>"
+        );
+      }
+      const pluginId = args.positionals[1];
+      const repository = args.positionals[2];
+      const version = args.values.version;
+      const token = resolveAuthToken(args.values.token);
+      const result = await convertCommand({
+        pluginId,
+        repository,
+        version,
+        token,
+        logger,
+        adapter
+      });
+      if (args.values.json) {
+        console.log(JSON.stringify(result, null, 2));
+      }
+      process.exit(0);
+    } else if (command === "marketplace") {
+      const subcommand = args.positionals[1];
+      if (!subcommand) {
+        throw new Error(
+          "Marketplace command requires a subcommand. Available: list, search, info, install, register, update"
+        );
+      }
+      const token = resolveAuthToken(args.values.token);
+      if (subcommand === "list") {
+        const result = await marketplaceListCommand({
+          logger,
+          adapter
+        });
+        if (args.values.json) {
+          console.log(JSON.stringify(result, null, 2));
+        }
+        process.exit(0);
+      } else if (subcommand === "search") {
+        if (args.positionals.length < 3) {
+          throw new Error("Marketplace search command requires <keyword>");
+        }
+        const keyword = args.positionals[2];
+        const result = await marketplaceSearchCommand({
+          keyword,
+          logger,
+          adapter
+        });
+        if (args.values.json) {
+          console.log(JSON.stringify(result, null, 2));
+        }
+        process.exit(0);
+      } else if (subcommand === "info") {
+        if (args.positionals.length < 3) {
+          throw new Error("Marketplace info command requires <plugin-id>");
+        }
+        const pluginId = args.positionals[2];
+        const result = await marketplaceInfoCommand({
+          pluginId,
+          logger,
+          adapter
+        });
+        if (args.values.json) {
+          console.log(JSON.stringify(result, null, 2));
+        }
+        process.exit(0);
+      } else if (subcommand === "install") {
+        if (args.positionals.length < 3) {
+          throw new Error("Marketplace install command requires <plugin-id>");
+        }
+        if (!args.values.output) {
+          throw new Error("Marketplace install command requires --output flag");
+        }
+        const pluginId = args.positionals[2];
+        const output = args.values.output;
+        const version = args.values.version;
+        const result = await marketplaceInstallCommand({
+          pluginId,
+          output,
+          version,
+          token,
+          logger,
+          adapter
+        });
+        if (args.values.json) {
+          console.log(JSON.stringify(result, null, 2));
+        }
+        process.exit(0);
+      } else if (subcommand === "register") {
+        if (args.positionals.length < 3) {
+          throw new Error("Marketplace register command requires <repository>");
+        }
+        const repository = args.positionals[2];
+        const result = await marketplaceRegisterCommand({
+          repository,
+          token,
+          logger,
+          adapter
+        });
+        if (args.values.json) {
+          console.log(JSON.stringify(result, null, 2));
+        }
+        process.exit(0);
+      } else if (subcommand === "update") {
+        if (args.positionals.length < 3) {
+          throw new Error("Marketplace update command requires <repository>");
+        }
+        const repository = args.positionals[2];
+        const result = await marketplaceUpdateCommand({
+          repository,
+          token,
+          logger,
+          adapter
+        });
+        if (args.values.json) {
+          console.log(JSON.stringify(result, null, 2));
+        }
+        process.exit(0);
+      } else {
+        throw new Error(
+          `Unknown marketplace subcommand: ${subcommand}. Available: list, search, info, install, register, update`
+        );
+      }
+    } else {
+      throw new Error(`Unknown command: ${command}`);
+    }
+  } catch (err) {
+    logger.error(err instanceof Error ? err.message : String(err));
+    if (args.values.json) {
+      console.log(
+        JSON.stringify(
+          {
+            error: err instanceof Error ? err.message : String(err)
+          },
+          null,
+          2
+        )
+      );
+    }
+    process.exit(1);
+  }
+}
+void main();
+//# sourceMappingURL=index.js.map