nuclie 1.0.0

package/dist/plugins/signer.js

@@ -0,0 +1,109 @@
+/**
+ * Nuclie v2.0 Zero-Trust Signing System
+ * Implementation: ECDSA P-256 via WebCrypto (Node.js)
+ * Day 9: WebCrypto Signing System Lock
+ */
+import { webcrypto } from 'crypto';
+const { subtle } = webcrypto;
+export class PluginSigner {
+    /**
+     * Generate a new ECDSA P-256 Key Pair
+     */
+    static async generateKeyPair() {
+        return await subtle.generateKey({
+            name: "ECDSA",
+            namedCurve: "P-256",
+        }, true, ["sign", "verify"]);
+    }
+    /**
+     * Export Key to PEM/Base64 format for storage
+     */
+    static async exportKey(key) {
+        const exported = await subtle.exportKey(key.type === 'public' ? 'spki' : 'pkcs8', key);
+        return Buffer.from(exported).toString('base64');
+    }
+    /**
+     * Import Key from PEM/Base64 format
+     */
+    static async importKey(base64Key, type) {
+        const buffer = Buffer.from(base64Key, 'base64');
+        return await subtle.importKey(type === 'public' ? 'spki' : 'pkcs8', buffer, {
+            name: "ECDSA",
+            namedCurve: "P-256",
+        }, true, type === 'public' ? ['verify'] : ['sign']);
+    }
+    /**
+     * Calculate SHA-256 Hash of the binary
+     */
+    static async calculateHash(data) {
+        const hashBuffer = await subtle.digest('SHA-256', data);
+        return Buffer.from(hashBuffer).toString('hex');
+    }
+    /**
+     * Sign a plugin binary
+     * Returns the Base64 signature
+     */
+    static async sign(data, privateKey) {
+        const hash = await this.calculateHash(data); // Sign the HASH, not the binary (efficiency)
+        // Actually, ECDSA typically signs the data digest. 
+        // Subtle.sign will hash it internally if we specify hash algorithm in params, 
+        // OR we can sign the raw bytes. Signing raw bytes is standard for 'sign'.
+        // BUT for huge files, better to hash first? 
+        // WebCrypto ECDSA params usually require hash specification: { name: "ECDSA", hash: "SHA-256" }
+        // So we pass the DATA, it hashes and signs.
+        const sig = await subtle.sign({
+            name: "ECDSA",
+            hash: { name: "SHA-256" },
+        }, privateKey, data);
+        return Buffer.from(sig).toString('base64');
+    }
+    /**
+     * Verify a plugin signature
+     */
+    static async verify(data, signatureBase64, publicKey) {
+        const sigBuffer = Buffer.from(signatureBase64, 'base64');
+        return await subtle.verify({
+            name: "ECDSA",
+            hash: { name: "SHA-256" },
+        }, publicKey, sigBuffer, data);
+    }
+    /**
+     * Create a complete Signed Manifest
+     */
+    static async createManifest(meta, wasmBytes, keyPair) {
+        const hash = await this.calculateHash(wasmBytes);
+        const signature = await this.sign(wasmBytes, keyPair.privateKey);
+        const publicKey = await this.exportKey(keyPair.publicKey);
+        return {
+            ...meta,
+            hash,
+            signature,
+            publicKey,
+            permissions: meta.permissions || {}
+        };
+    }
+    /**
+     * Verify integrity of a Plugin + Manifest
+     */
+    static async verifyManifest(manifest, wasmBytes) {
+        // 1. Check Hash
+        const calcHash = await this.calculateHash(wasmBytes);
+        if (calcHash !== manifest.hash) {
+            console.error(`Hash mismatch: Expected ${manifest.hash}, got ${calcHash}`);
+            return false;
+        }
+        // 2. Check Signature
+        try {
+            const publicKey = await this.importKey(manifest.publicKey, 'public');
+            const valid = await this.verify(wasmBytes, manifest.signature, publicKey);
+            if (!valid) {
+                console.error('Signature verification failed');
+            }
+            return valid;
+        }
+        catch (e) {
+            console.error('Key import failed:', e);
+            return false;
+        }
+    }
+}

package/dist/plugins/static.d.ts

@@ -0,0 +1,2 @@
+import { NucliePlugin } from '../core/plugins/types.js';
+export declare function createStaticPlugin(rootDir: string, outDir: string): NucliePlugin;

package/dist/plugins/static.js

@@ -0,0 +1,47 @@
+import fs from 'fs/promises';
+import path from 'path';
+import { log } from '../utils/logger.js';
+export function createStaticPlugin(rootDir, outDir) {
+    return {
+        manifest: {
+            name: 'nuclie:static',
+            version: '1.0.0',
+            engineVersion: '1.0.0',
+            type: 'js',
+            hooks: ['buildEnd'],
+            permissions: { fs: 'read' }
+        },
+        id: 'nuclie:static',
+        async runHook(hook, data) {
+            if (hook !== 'buildEnd')
+                return data;
+            const publicDir = path.join(rootDir, 'public');
+            try {
+                const stats = await fs.stat(publicDir);
+                if (stats.isDirectory()) {
+                    log.info(`Copying public directory from ${publicDir} to ${outDir}`);
+                    await fs.mkdir(outDir, { recursive: true });
+                    await copyDir(publicDir, outDir);
+                }
+            }
+            catch (e) {
+                // Public dir doesn't exist, skip
+            }
+            return data;
+        }
+    };
+}
+async function copyDir(src, dest) {
+    await fs.mkdir(dest, { recursive: true });
+    const entries = await fs.readdir(src, { withFileTypes: true });
+    for (const entry of entries) {
+        const srcPath = path.join(src, entry.name);
+        const destPath = path.join(dest, entry.name);
+        if (entry.isDirectory()) {
+            await copyDir(srcPath, destPath);
+        }
+        else {
+            await fs.copyFile(srcPath, destPath);
+        }
+    }
+}

package/dist/plugins/svelte.d.ts

@@ -0,0 +1,7 @@
+import { Plugin } from './index.js';
+export declare class SveltePlugin implements Plugin {
+    name: string;
+    root: string;
+    constructor(root: string);
+    transform(code: string, id: string): Promise<string | void>;
+}

package/dist/plugins/svelte.js

@@ -0,0 +1,27 @@
+import path from 'path';
+import { createRequire } from 'module';
+export class SveltePlugin {
+    constructor(root) {
+        this.name = 'svelte-plugin';
+        this.root = root;
+    }
+    async transform(code, id) {
+        if (!id.endsWith('.svelte'))
+            return;
+        try {
+            const require = createRequire(path.join(this.root, 'package.json'));
+            const svelte = require('svelte/compiler');
+            const result = svelte.compile(code, {
+                filename: id,
+                generate: 'dom', // Client-side DOM
+                dev: true, // Dev mode (better warnings)
+                css: 'injected' // Inject CSS automatically
+            });
+            return result.js.code;
+        }
+        catch (e) {
+            console.error('Svelte Compilation Error:', e);
+            return;
+        }
+    }
+}

package/dist/plugins/testSandbox.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/plugins/testSandbox.js

@@ -0,0 +1,14 @@
+import { PluginSandbox } from './sandbox.js';
+async function run() {
+    const sb = new PluginSandbox(2);
+    try {
+        console.log('[test] running sandbox transform');
+        const src = `console.log('hello');\n`;
+        const out = await sb.runTransform(src, 'test-1');
+        console.log('[test] transform output:\n', out);
+    }
+    finally {
+        sb.stop();
+    }
+}
+run().catch((e) => console.error(e));

package/dist/plugins/verify.d.ts

@@ -0,0 +1,3 @@
+export declare function verifyPluginSignature(pluginPath: string, keysDir?: string): Promise<boolean>;
+export default verifyPluginSignature;
+export declare function verifyBundle(pluginPath: string, keysDir?: string): Promise<boolean>;

package/dist/plugins/verify.js

@@ -0,0 +1,113 @@
+import fs from 'fs/promises';
+import path from 'path';
+import crypto from 'crypto';
+export async function verifyPluginSignature(pluginPath, keysDir) {
+    try {
+        const sigPath = pluginPath + '.sig';
+        const manifestPath = pluginPath + '.manifest.json';
+        const [sigBuf, dataBuf, manifestBuf] = await Promise.all([
+            fs.readFile(sigPath).catch(() => null),
+            fs.readFile(pluginPath),
+            fs.readFile(manifestPath).catch(() => null),
+        ]);
+        if (!sigBuf)
+            return false;
+        const sig = Buffer.from(sigBuf.toString().trim(), 'base64');
+        const keysFolder = keysDir || path.resolve(process.cwd(), 'config', 'plugin_keys');
+        let targetKeys = [];
+        if (manifestBuf) {
+            try {
+                const manifest = JSON.parse(manifestBuf.toString());
+                if (manifest && manifest.keyId) {
+                    targetKeys = [manifest.keyId + '.pem'];
+                }
+            }
+            catch (e) {
+                // malformed manifest -> fall back to scanning all keys
+            }
+        }
+        if (targetKeys.length === 0) {
+            targetKeys = await fs.readdir(keysFolder).catch(() => []);
+        }
+        // consult truststore if present - restrict to trusted keys
+        const trustPath = path.resolve(process.cwd(), 'config', 'trust.json');
+        const trust = await fs.readFile(trustPath).then((b) => JSON.parse(b.toString())).catch(() => null);
+        if (trust && Array.isArray(trust.keys) && trust.keys.length > 0) {
+            const keysArr = trust.keys;
+            const active = keysArr.filter((x) => !x.revoked).map((x) => x.keyId);
+            targetKeys = targetKeys.filter((k) => active.includes(k.replace(/\.pem$/, '')));
+        }
+        for (const e of targetKeys) {
+            if (!e.endsWith('.pem'))
+                continue;
+            const pub = await fs.readFile(path.join(keysFolder, e), 'utf8').catch(() => null);
+            if (!pub)
+                continue;
+            const verifier = crypto.createVerify('sha256');
+            verifier.update(dataBuf);
+            verifier.end();
+            try {
+                if (verifier.verify(pub, sig))
+                    return true;
+            }
+            catch (err) {
+                // ignore and try next key
+            }
+        }
+        return false;
+    }
+    catch (e) {
+        return false;
+    }
+}
+export default verifyPluginSignature;
+export async function verifyBundle(pluginPath, keysDir) {
+    try {
+        const manifestPath = pluginPath + '.manifest.json';
+        const manifestSigPath = pluginPath + '.manifest.sig';
+        const [manifestBuf, manifestSigBuf, dataBuf] = await Promise.all([
+            fs.readFile(manifestPath).catch(() => null),
+            fs.readFile(manifestSigPath).catch(() => null),
+            fs.readFile(pluginPath),
+        ]);
+        if (!manifestBuf || !manifestSigBuf)
+            return false;
+        const manifest = JSON.parse(manifestBuf.toString());
+        const manifestSig = Buffer.from(manifestSigBuf.toString().trim(), 'base64');
+        // ensure signing key is present in truststore and not revoked
+        const trustPath = path.resolve(process.cwd(), 'config', 'trust.json');
+        const trust = await fs.readFile(trustPath).then((b) => JSON.parse(b.toString())).catch(() => null);
+        if (!trust || !Array.isArray(trust.keys))
+            return false;
+        const keyEntry = trust.keys.find((k) => k.keyId === manifest.keyId);
+        if (!keyEntry || keyEntry.revoked)
+            return false;
+        if (manifest.publisherId && keyEntry.publisherId && manifest.publisherId !== keyEntry.publisherId)
+            return false;
+        // find public key file
+        const keysFolder = keysDir || path.resolve(process.cwd(), 'config', 'plugin_keys');
+        const keyFile = path.join(keysFolder, manifest.keyId + '.pem');
+        const pub = await fs.readFile(keyFile, 'utf8').catch(() => null);
+        if (!pub)
+            return false;
+        // verify manifest signature
+        const verifier = crypto.createVerify('sha256');
+        verifier.update(JSON.stringify(manifest, null, 2));
+        verifier.end();
+        if (!verifier.verify(pub, manifestSig))
+            return false;
+        // verify checksum matches
+        const hash = crypto.createHash('sha256').update(dataBuf).digest('hex');
+        if (manifest.checksum !== hash)
+            return false;
+        // optionally verify plugin internal signature if present (not required)
+        // manifest signature + checksum are the primary source of truth
+        // we attempted plugin internal signature verification for extra assurance but do not require it
+        // (if you want to require it, change this to `return pluginSigOk`)
+        // const pluginSigOk = await verifyPluginSignature(pluginPath, keysDir).catch(() => false)
+        return true;
+    }
+    catch (e) {
+        return false;
+    }
+}

package/dist/plugins/vue.d.ts

@@ -0,0 +1,7 @@
+import { Plugin } from './index.js';
+export declare class VuePlugin implements Plugin {
+    name: string;
+    root: string;
+    constructor(root: string);
+    transform(code: string, id: string): Promise<string | void>;
+}

package/dist/plugins/vue.js

@@ -0,0 +1,86 @@
+import path from 'path';
+import { createRequire } from 'module';
+export class VuePlugin {
+    constructor(root) {
+        this.name = 'vue-plugin';
+        this.root = root;
+    }
+    async transform(code, id) {
+        if (!id.endsWith('.vue'))
+            return;
+        console.log(`[VuePlugin] Transforming ${id}`);
+        try {
+            const require = createRequire(path.join(this.root, 'package.json'));
+            // Load vue/compiler-sfc from the project's dependencies
+            const compiler = require('@vue/compiler-sfc');
+            // 1. Parse
+            const { descriptor } = compiler.parse(code, { filename: id });
+            const shortId = path.basename(id); // distinct-ish
+            const scopeId = `data-v-${Math.random().toString(36).substring(2, 9)}`;
+            let scriptContent = 'const script = {}; export default script;';
+            // 2. Script
+            if (descriptor.script || descriptor.scriptSetup) {
+                const compiledScript = compiler.compileScript(descriptor, { id: scopeId });
+                scriptContent = compiledScript.content;
+            }
+            // Robustly find and replace the default export with a variable declaration
+            // so we can attach the render function later.
+            const exportDefaultRegex = /export\s+default\s+/;
+            if (exportDefaultRegex.test(scriptContent)) {
+                scriptContent = scriptContent.replace(exportDefaultRegex, 'const _sfc_main = ');
+            }
+            else {
+                // Fallback if no export default is found (though rare in Vue SFC)
+                scriptContent += '\nconst _sfc_main = {};';
+            }
+            // 3. Template
+            let templateCode = '';
+            if (descriptor.template) {
+                const templateResult = compiler.compileTemplate({
+                    source: descriptor.template.content,
+                    filename: id,
+                    id: scopeId,
+                    scoped: descriptor.styles.some((s) => s.scoped),
+                    slotted: false,
+                    compilerOptions: {
+                        scopeId: descriptor.styles.some((s) => s.scoped) ? scopeId : undefined
+                    }
+                });
+                templateCode = templateResult.code.replace('export function render', 'const _sfc_render = function render');
+            }
+            // 4. Styles
+            let cssCode = '';
+            for (const style of descriptor.styles) {
+                const styleResult = compiler.compileStyle({
+                    source: style.content,
+                    filename: id,
+                    id: scopeId,
+                    scoped: style.scoped
+                });
+                cssCode += styleResult.code;
+            }
+            // 5. Assemble
+            const output = `
+                ${scriptContent}
+                ${templateCode}
+
+                // Inject CSS
+                ${cssCode ? `
+                const style = document.createElement('style');
+                style.innerHTML = ${JSON.stringify(cssCode)};
+                document.head.appendChild(style);
+                ` : ''}
+
+                ${descriptor.styles.some((s) => s.scoped) ? `_sfc_main.__scopeId = "${scopeId}";` : ''}
+                _sfc_main.render = _sfc_render;
+                export default _sfc_main;
+            `;
+            return output;
+        }
+        catch (e) {
+            console.error('[VuePlugin] SFC Compilation Error:', e);
+            // Log warning but don't crash
+            return;
+        }
+    }
+}

package/dist/plugins/wasm-runtime.d.ts

@@ -0,0 +1,15 @@
+import { PluginRuntime } from '../native/wasm.js';
+export { PluginRuntime };
+export declare class WasmPluginHost {
+    private runtime;
+    constructor();
+    /**
+     * Load and verify a plugin from disk
+     */
+    loadPlugin(pluginPath: string): Promise<Buffer>;
+    /**
+     * Run a specific plugin
+     */
+    runPlugin(pluginBytes: Buffer, input: any, timeoutMs?: number): Promise<any>;
+}
+export declare const wasmHost: WasmPluginHost;

package/dist/plugins/wasm-runtime.js

@@ -0,0 +1,33 @@
+import { PluginRuntime } from '../native/wasm.js';
+export { PluginRuntime }; // Re-export for adapter usage
+import * as fs from 'fs/promises';
+export class WasmPluginHost {
+    constructor() {
+        this.runtime = new PluginRuntime();
+    }
+    /**
+     * Load and verify a plugin from disk
+     */
+    async loadPlugin(pluginPath) {
+        const buffer = await fs.readFile(pluginPath);
+        if (!this.runtime.verify(buffer)) {
+            throw new Error(`Invalid WASM plugin: ${pluginPath}`);
+        }
+        return buffer;
+    }
+    /**
+     * Run a specific plugin
+     */
+    async runPlugin(pluginBytes, input, timeoutMs = 100) {
+        const inputStr = JSON.stringify(input);
+        // Use provided timeout
+        const outputStr = this.runtime.execute(pluginBytes, inputStr, timeoutMs);
+        try {
+            return JSON.parse(outputStr || 'null'); // Handle empty/string
+        }
+        catch (e) {
+            return outputStr; // Return raw if not JSON
+        }
+    }
+}
+export const wasmHost = new WasmPluginHost();

package/dist/plugins/wasm.d.ts

@@ -0,0 +1,5 @@
+import { Plugin } from './index.js';
+export declare class WasmPlugin implements Plugin {
+    name: string;
+    setup(build: any): void;
+}

package/dist/plugins/wasm.js

@@ -0,0 +1,44 @@
+import fs from 'fs/promises';
+import path from 'path';
+export class WasmPlugin {
+    constructor() {
+        this.name = 'wasm-plugin';
+    }
+    setup(build) {
+        // Resolve .wasm files
+        build.onResolve({ filter: /\.wasm$/ }, (args) => {
+            if (args.namespace === 'wasm-stub') {
+                return {
+                    path: args.path,
+                    namespace: 'wasm-binary',
+                };
+            }
+            return {
+                path: path.resolve(args.resolveDir, args.path),
+                namespace: 'wasm-stub',
+            };
+        });
+        // Load .wasm files
+        build.onLoad({ filter: /.*/, namespace: 'wasm-stub' }, async (args) => {
+            return {
+                contents: `
+          import wasmUrl from ${JSON.stringify(args.path)};
+          export default async (imports) => {
+            const response = await fetch(wasmUrl);
+            const bytes = await response.arrayBuffer();
+            const { instance } = await WebAssembly.instantiate(bytes, imports);
+            return instance.exports;
+          };
+        `,
+                loader: 'js',
+            };
+        });
+        // Handle the actual binary loading (using file loader to emit asset)
+        build.onLoad({ filter: /.*/, namespace: 'wasm-binary' }, async (args) => {
+            return {
+                contents: await fs.readFile(args.path),
+                loader: 'file', // Emit as asset
+            };
+        });
+    }
+}

package/dist/polyfills/corejs.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Nuclie Legacy Polyfill Injector
+ * Day 25: Legacy Polyfills & Windows Lock
+ */
+export declare const CORE_JS_IMPORT = "import 'core-js/stable'; import 'regenerator-runtime/runtime';";
+export declare class PolyfillInjector {
+    static shouldInject(targets: string[]): boolean;
+    static transform(code: string, targets: string[]): string;
+}

package/dist/polyfills/corejs.js

@@ -0,0 +1,18 @@
+/**
+ * Nuclie Legacy Polyfill Injector
+ * Day 25: Legacy Polyfills & Windows Lock
+ */
+export const CORE_JS_IMPORT = "import 'core-js/stable'; import 'regenerator-runtime/runtime';";
+export class PolyfillInjector {
+    static shouldInject(targets) {
+        // Simple heuristic: if 'ie 11' or 'legacy' is in targets
+        return targets.some(t => t.includes('ie') || t.includes('legacy') || t.includes('es5'));
+    }
+    static transform(code, targets) {
+        if (this.shouldInject(targets)) {
+            // Prepend imports
+            return `${CORE_JS_IMPORT}\n${code}`;
+        }
+        return code;
+    }
+}

package/dist/presets/core.d.ts

@@ -0,0 +1,111 @@
+/**
+ * @nuclie/preset-core
+ *
+ * Opinionated defaults for 80% of applications.
+ * Zero-config experience with smart auto-detection.
+ *
+ * Philosophy:
+ * - Convention over configuration
+ * - Auto-detect framework from package.json
+ * - Smart defaults that "just work"
+ * - Easy to override when needed
+ */
+import { BuildConfig } from '../config/index.js';
+export interface CorePresetOptions {
+    /**
+     * Auto-detect framework from package.json dependencies
+     * @default true
+     */
+    autoDetectFramework?: boolean;
+    /**
+     * Auto-detect entry points from common locations
+     * @default true
+     */
+    autoDetectEntry?: boolean;
+    /**
+     * Auto-enable HMR in development
+     * @default true
+     */
+    autoEnableHMR?: boolean;
+    /**
+     * Auto-configure CSS handling
+     * @default true
+     */
+    autoConfigureCSS?: boolean;
+    /**
+     * Auto-configure asset handling
+     * @default true
+     */
+    autoConfigureAssets?: boolean;
+    /**
+     * Port selection strategy
+     * @default 'auto' - Try 5173, fallback to next available
+     */
+    portStrategy?: 'auto' | 'fixed' | number;
+    /**
+     * Output directory
+     * @default 'dist'
+     */
+    outDir?: string;
+    /**
+     * Public directory for static assets
+     * @default 'public'
+     */
+    publicDir?: string;
+    /**
+     * Source directory
+     * @default 'src'
+     */
+    srcDir?: string;
+}
+export interface FrameworkDetectionResult {
+    framework: string | null;
+    version: string | null;
+    confidence: 'high' | 'medium' | 'low';
+    source: 'dependencies' | 'devDependencies' | 'peerDependencies' | 'manual';
+}
+/**
+ * Core preset implementation
+ */
+export declare class CorePreset {
+    private options;
+    private cwd;
+    constructor(cwd: string, options?: CorePresetOptions);
+    /**
+     * Apply core preset to build config
+     */
+    apply(config?: Partial<BuildConfig>): Partial<BuildConfig>;
+    /**
+     * Detect framework from package.json
+     */
+    private detectFramework;
+    /**
+     * Detect entry points from common locations
+     */
+    private detectEntryPoints;
+    /**
+     * Select port based on strategy
+     */
+    private selectPort;
+    /**
+     * Detect CSS framework from package.json
+     */
+    private detectCSSFramework;
+    /**
+     * Get preset info for diagnostics
+     */
+    getInfo(): {
+        framework: FrameworkDetectionResult;
+        entry: string[];
+        port: number;
+        css: BuildConfig['css'];
+    };
+}
+/**
+ * Factory function for easy usage
+ */
+export declare function corePreset(options?: CorePresetOptions): (cwd: string) => CorePreset;
+/**
+ * Default export
+ */
+export default corePreset;