@adea-ai/plugins 1.0.0

package/dist/schema.js

@@ -0,0 +1,267 @@
+import { z } from 'zod';
+export const DIGEST_RE = /^sha256:[a-f0-9]{64}$/;
+export const SHA_RE = /^[a-f0-9]{40}$/;
+export const DigestSchema = z.string().regex(DIGEST_RE);
+export const ShaSchema = z.string().regex(SHA_RE);
+export const TimestampSchema = z.string().datetime({ offset: true });
+export const MarketplaceDialectSchema = z.enum(['openai', 'cursor', 'claude']);
+export const TrustClassificationSchema = z.enum(['official']);
+export const SyncStatusSchema = z.enum(['synchronized', 'unchanged', 'failed']);
+export const CapabilityTypeSchema = z.enum([
+    'skill',
+    'mcp-server',
+    'connector',
+    'command',
+    'agent',
+    'hook',
+    'rule',
+    'browser',
+    'scheduled-task',
+    'ui-component',
+    'executable',
+    'unknown',
+]);
+export const HarnessSchema = z.enum([
+    'codex',
+    'claude-code',
+    'cursor',
+    'pi',
+    'hermes',
+    'opencode',
+    'generic-skill-mcp',
+]);
+export const CompatibilityStatusSchema = z.enum([
+    'native',
+    'portable',
+    'requires-translation',
+    'partially-supported',
+    'unsupported',
+    'blocked-by-policy',
+    'unknown',
+]);
+const JsonValueSchema = z.lazy(() => z.union([
+    z.string(),
+    z.number().finite(),
+    z.boolean(),
+    z.null(),
+    z.array(JsonValueSchema),
+    z.record(z.string(), JsonValueSchema),
+]));
+export const JsonObjectSchema = z.record(z.string(), JsonValueSchema);
+export const CatalogSourceSchema = z
+    .object({
+    sourceId: z.string().regex(/^[a-z0-9][a-z0-9-]{1,63}$/),
+    displayName: z.string().min(1).max(160),
+    repositoryUrl: z.string().url(),
+    marketplaceDialect: MarketplaceDialectSchema,
+    manifestPath: z.string().min(1).max(512),
+    defaultBranch: z.string().regex(/^[A-Za-z0-9._/-]+$/),
+    resolvedCommitSha: ShaSchema,
+    retrievalTimestamp: TimestampSchema,
+    trustClassification: TrustClassificationSchema,
+    sourceManifestDigest: DigestSchema,
+    synchronizationStatus: SyncStatusSchema,
+})
+    .strict();
+export const CapabilitySchema = z
+    .object({
+    type: CapabilityTypeSchema,
+    name: z.string().min(1).max(200),
+    paths: z.array(z.string().min(1).max(512)).max(512),
+    metadata: JsonObjectSchema,
+    securityImpact: z.enum(['none', 'review', 'sensitive']),
+})
+    .strict();
+export const HarnessCompatibilitySchema = z
+    .object({
+    status: CompatibilityStatusSchema,
+    reasons: z.array(z.string().min(1).max(500)).max(64),
+    responsibleCapabilities: z.array(CapabilityTypeSchema).max(32),
+})
+    .strict();
+export const LicenseMetadataSchema = z
+    .object({
+    name: z.string().min(1).max(200),
+    spdxId: z.string().min(1).max(100).optional(),
+    url: z.string().url().optional(),
+    source: z.enum(['plugin-manifest', 'package-manifest', 'marketplace-entry', 'unknown']),
+})
+    .strict();
+export const SecurityClassificationSchema = z
+    .object({
+    level: z.enum(['low', 'review', 'sensitive']),
+    reasons: z.array(z.string().min(1).max(500)).max(64),
+    permissionSensitiveChanges: z.array(z.string().min(1).max(200)).max(64),
+    contentResolution: z.enum(['complete', 'metadata-only']),
+})
+    .strict();
+export const PluginProvenanceSchema = z
+    .object({
+    sourceId: z.string().min(1),
+    repositoryUrl: z.string().url(),
+    manifestPath: z.string().min(1),
+    pluginSubdirectory: z.string().min(1),
+    resolvedCommitSha: ShaSchema,
+    sourceManifestDigest: DigestSchema,
+    upstreamEntryDigest: DigestSchema,
+})
+    .strict();
+export const IconContentTypeSchema = z.enum([
+    'image/png',
+    'image/jpeg',
+    'image/gif',
+    'image/webp',
+    'image/svg+xml',
+    'image/x-icon',
+]);
+export const PluginReleaseSchema = z
+    .object({
+    releaseId: z.string().regex(/^release:[a-f0-9]{64}$/),
+    upstreamVersion: z.string().min(1).max(128).optional(),
+    resolvedRepositoryUrl: z.string().url(),
+    resolvedCommitSha: ShaSchema,
+    pluginSubdirectory: z.string().min(1).max(512),
+    canonicalContentDigest: DigestSchema,
+    manifestDigest: DigestSchema,
+    contentResolution: z.enum(['complete', 'metadata-only']),
+    releaseMetadata: JsonObjectSchema,
+    capabilities: z.array(CapabilitySchema).max(1024),
+    requiredConnectors: z.array(z.string().min(1).max(200)).max(128),
+    requiredCredentials: z.array(z.string().min(1).max(200)).max(128),
+    permissionSensitiveChanges: z.array(z.string().min(1).max(200)).max(128),
+    fileIndex: z.array(z.string().min(1).max(512)).max(4096),
+    publicationTimestamp: TimestampSchema,
+    /**
+     * Brand mark resolved at compile time. `content` comes from the release's
+     * own files; `favicon` comes from the product's declared homepage, for
+     * products that ship no mark of their own.
+     */
+    icon: z
+        .discriminatedUnion('kind', [
+        z
+            .object({
+            kind: z.literal('content'),
+            path: z.string().min(1).max(512),
+            contentType: IconContentTypeSchema,
+            digest: DigestSchema,
+            bytes: z.number().int().positive().max(1048576),
+        })
+            .strict(),
+        z
+            .object({
+            kind: z.literal('favicon'),
+            url: z.string().url().max(1024),
+            homepage: z.string().url().max(1024),
+            contentType: IconContentTypeSchema,
+            digest: DigestSchema,
+            bytes: z.number().int().positive().max(1048576),
+        })
+            .strict(),
+    ])
+        .optional(),
+})
+    .strict();
+export const PluginSchema = z
+    .object({
+    pluginId: z.string().regex(/^plugin:[a-z0-9-]+:[a-z0-9][a-z0-9-]{1,127}$/),
+    displayName: z.string().min(1).max(200),
+    description: z.string().max(4096),
+    productGroupingKey: z.string().regex(/^[a-z0-9][a-z0-9-]{1,127}$/),
+    categories: z.array(z.string().regex(/^[a-z0-9][a-z0-9-]{1,63}$/)).max(32),
+    keywords: z.array(z.string().min(1).max(100)).max(128),
+    authors: z.array(z.string().min(1).max(200)).max(32),
+    homepage: z.string().url().optional(),
+    icons: z.array(z.string().min(1).max(1024)).max(16),
+    sourceId: z.string().min(1),
+    upstreamPluginName: z.string().min(1).max(200),
+    currentReleaseId: z.string().regex(/^release:[a-f0-9]{64}$/),
+    availableReleases: z.array(PluginReleaseSchema).min(1).max(128),
+    capabilitySummary: z.partialRecord(CapabilityTypeSchema, z.number().int().nonnegative()),
+    harnessCompatibility: z.record(HarnessSchema, HarnessCompatibilitySchema),
+    license: LicenseMetadataSchema,
+    provenance: PluginProvenanceSchema,
+    securityClassification: SecurityClassificationSchema,
+})
+    .strict();
+export const CatalogSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    catalogId: z.string().regex(/^catalog:[a-f0-9]{64}$/),
+    generatedAt: TimestampSchema,
+    sources: z.array(CatalogSourceSchema).min(1).max(64),
+    plugins: z.array(PluginSchema).max(4096),
+})
+    .strict();
+export const SourceLockEntrySchema = z
+    .object({
+    sourceId: z.string().min(1),
+    repositoryUrl: z.string().url(),
+    defaultBranch: z.string().min(1),
+    resolvedCommitSha: ShaSchema,
+    manifestPath: z.string().min(1),
+    marketplaceDialect: MarketplaceDialectSchema,
+    sourceManifestDigest: DigestSchema,
+    retrievedAt: TimestampSchema,
+    synchronizationStatus: SyncStatusSchema,
+    pluginPins: z
+        .array(z
+        .object({
+        pluginName: z.string().min(1).max(200),
+        repositoryUrl: z.string().url(),
+        pluginSubdirectory: z.string().max(512),
+        resolvedCommitSha: ShaSchema,
+    })
+        .strict())
+        .max(4096),
+})
+    .strict();
+export const SourcesLockSchema = z
+    .object({
+    schemaVersion: z.literal(1),
+    lockId: z.string().regex(/^lock:[a-f0-9]{64}$/),
+    sources: z.array(SourceLockEntrySchema).min(1).max(64),
+})
+    .strict();
+export const MaterializationPlanSchema = z
+    .object({
+    planVersion: z.literal(1),
+    pluginId: PluginSchema.shape.pluginId,
+    releaseId: PluginReleaseSchema.shape.releaseId,
+    harness: HarnessSchema,
+    source: z
+        .object({
+        repositoryUrl: z.string().url(),
+        commitSha: ShaSchema,
+        pluginSubdirectory: z.string().min(1),
+        contentDigest: DigestSchema,
+    })
+        .strict(),
+    targetLayout: z
+        .object({
+        root: z.string().min(1),
+        notes: z.array(z.string().min(1)).max(32),
+    })
+        .strict(),
+    files: z
+        .array(z
+        .object({
+        sourcePath: z.string().min(1),
+        targetPath: z.string().min(1),
+        action: z.enum(['copy', 'translate', 'ignore', 'unsupported']),
+        reason: z.string().min(1).max(500),
+    })
+        .strict())
+        .max(4096),
+    configuration: JsonObjectSchema,
+    requiredConnectors: z.array(z.string().min(1)).max(128),
+    requiredCredentials: z.array(z.string().min(1)).max(128),
+    policyConstraints: z.array(z.string().min(1)).max(128),
+})
+    .strict();
+export function parseCatalog(input) {
+    return CatalogSchema.parse(input);
+}
+export function parseSourcesLock(input) {
+    return SourcesLockSchema.parse(input);
+}
+//# sourceMappingURL=schema.js.map

package/dist/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../src/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,MAAM,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAA;AAChD,MAAM,CAAC,MAAM,MAAM,GAAG,gBAAgB,CAAA;AAEtC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;AACvD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;AACjD,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAA;AAEpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAA;AAC9E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAA;AAC7D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAA;AAE/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC;IACzC,OAAO;IACP,YAAY;IACZ,WAAW;IACX,SAAS;IACT,OAAO;IACP,MAAM;IACN,MAAM;IACN,SAAS;IACT,gBAAgB;IAChB,cAAc;IACd,YAAY;IACZ,SAAS;CACV,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC;IAClC,OAAO;IACP,aAAa;IACb,QAAQ;IACR,IAAI;IACJ,QAAQ;IACR,UAAU;IACV,mBAAmB;CACpB,CAAC,CAAA;AAGF,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC9C,QAAQ;IACR,UAAU;IACV,sBAAsB;IACtB,qBAAqB;IACrB,aAAa;IACb,mBAAmB;IACnB,SAAS;CACV,CAAC,CAAA;AAEF,MAAM,eAAe,GAAuB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CACtD,CAAC,CAAC,KAAK,CAAC;IACN,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE;IACnB,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,IAAI,EAAE;IACR,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC;IACxB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC;CACtC,CAAC,CACH,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAA;AAErE,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC;IACvD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,kBAAkB,EAAE,wBAAwB;IAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC;IACrD,iBAAiB,EAAE,SAAS;IAC5B,kBAAkB,EAAE,eAAe;IACnC,mBAAmB,EAAE,yBAAyB;IAC9C,oBAAoB,EAAE,YAAY;IAClC,qBAAqB,EAAE,gBAAgB;CACxC,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,oBAAoB;IAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnD,QAAQ,EAAE,gBAAgB;IAC1B,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;CACxD,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC;KACxC,MAAM,CAAC;IACN,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,uBAAuB,EAAE,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAC/D,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC7C,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,iBAAiB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,SAAS,CAAC,CAAC;CACxF,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACvE,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;CACzD,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACpC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrC,iBAAiB,EAAE,SAAS;IAC5B,oBAAoB,EAAE,YAAY;IAClC,mBAAmB,EAAE,YAAY;CAClC,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC1C,WAAW;IACX,YAAY;IACZ,WAAW;IACX,YAAY;IACZ,eAAe;IACf,cAAc;CACf,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACrD,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACtD,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACvC,iBAAiB,EAAE,SAAS;IAC5B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,sBAAsB,EAAE,YAAY;IACpC,cAAc,EAAE,YAAY;IAC5B,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,eAAe,CAAC,CAAC;IACxD,eAAe,EAAE,gBAAgB;IACjC,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACjD,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAChE,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACjE,0BAA0B,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxE,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;IACxD,oBAAoB,EAAE,eAAe;IACrC;;;;OAIG;IACH,IAAI,EAAE,CAAC;SACJ,kBAAkB,CAAC,MAAM,EAAE;QAC1B,CAAC;aACE,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;YAChC,WAAW,EAAE,qBAAqB;YAClC,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;SAChD,CAAC;aACD,MAAM,EAAE;QACX,CAAC;aACE,MAAM,CAAC;YACN,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YAC1B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;YAC/B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;YACpC,WAAW,EAAE,qBAAqB;YAClC,MAAM,EAAE,YAAY;YACpB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;SAChD,CAAC;aACD,MAAM,EAAE;KACZ,CAAC;SACD,QAAQ,EAAE;CACd,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,8CAA8C,CAAC;IAC1E,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC;IACjC,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,CAAC;IAClE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC1E,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACtD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACrC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC9C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IAC5D,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC/D,iBAAiB,EAAE,CAAC,CAAC,aAAa,CAAC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IACxF,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,0BAA0B,CAAC;IACzE,OAAO,EAAE,qBAAqB;IAC9B,UAAU,EAAE,sBAAsB;IAClC,sBAAsB,EAAE,4BAA4B;CACrD,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,wBAAwB,CAAC;IACrD,WAAW,EAAE,eAAe;IAC5B,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACpD,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IAC/B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAChC,iBAAiB,EAAE,SAAS;IAC5B,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,kBAAkB,EAAE,wBAAwB;IAC5C,oBAAoB,EAAE,YAAY;IAClC,WAAW,EAAE,eAAe;IAC5B,qBAAqB,EAAE,gBAAgB;IACvC,UAAU,EAAE,CAAC;SACV,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACtC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QAC/B,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC;QACvC,iBAAiB,EAAE,SAAS;KAC7B,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,IAAI,CAAC;CACb,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,MAAM,CAAC;IACN,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC/C,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACvD,CAAC;KACD,MAAM,EAAE,CAAA;AAEX,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC;KACvC,MAAM,CAAC;IACN,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzB,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ;IACrC,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC,SAAS;IAC9C,OAAO,EAAE,aAAa;IACtB,MAAM,EAAE,CAAC;SACN,MAAM,CAAC;QACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;QAC/B,SAAS,EAAE,SAAS;QACpB,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,aAAa,EAAE,YAAY;KAC5B,CAAC;SACD,MAAM,EAAE;IACX,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;KAC1C,CAAC;SACD,MAAM,EAAE;IACX,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;QAC9D,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;KACnC,CAAC;SACD,MAAM,EAAE,CACZ;SACA,GAAG,CAAC,IAAI,CAAC;IACZ,aAAa,EAAE,gBAAgB;IAC/B,kBAAkB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACvD,mBAAmB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACxD,iBAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACvD,CAAC;KACD,MAAM,EAAE,CAAA;AAeX,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,OAAO,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACnC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;AACvC,CAAC"}

package/dist/site-icons.d.ts

@@ -0,0 +1,55 @@
+import { type IconContentType } from './icons.js';
+/**
+ * Site icon discovery, for products that ship no brand mark of their own.
+ *
+ * Many plugins are a thin wrapper over a vendor's API: the content carries no
+ * logo, and the declared homepage is the only pointer to the vendor. Fetching
+ * that site's icon once at publish time, verifying it and mirroring it as a
+ * release asset replaces a per-render favicon lookup in the client.
+ */
+export declare const SITE_ICON_MAX_HTML_BYTES: number;
+/**
+ * Only the document head is parsed. Icon links are declared there, and vendor
+ * landing pages are frequently several megabytes of markup and script.
+ */
+export declare const SITE_ICON_HEAD_BYTES: number;
+export interface SiteIcon {
+    readonly url: string;
+    /** The product homepage the icon was discovered from. */
+    readonly homepage: string;
+    readonly bytes: Uint8Array;
+    readonly contentType: IconContentType;
+    readonly digest: string;
+}
+/**
+ * Whether a homepage can stand in for a product brand.
+ *
+ * Only HTTPS sites qualify: a repository URL would yield the forge's own logo,
+ * and a non-routable host is a request forgery risk rather than a vendor site.
+ */
+export declare function isVendorHomepage(homepage: string | undefined): boolean;
+/** Rejects loopback, link-local, private and internal hostnames. */
+export declare function isPublicHostname(hostname: string): boolean;
+/**
+ * Extracts icon URLs from a document head, best candidate first.
+ *
+ * `apple-touch-icon` is preferred because it is a square PNG sized for a home
+ * screen; declared `icon` links follow in declared order; `/favicon.ico` is the
+ * conventional last resort when nothing is declared.
+ */
+export declare function discoverSiteIcons(html: string, baseUrl: string): readonly string[];
+export interface SiteIconFetcher {
+    readonly fetchText: (url: string) => Promise<string>;
+    readonly fetchBytes: (url: string) => Promise<Uint8Array>;
+    readonly digest: (bytes: Uint8Array) => string;
+}
+/**
+ * Resolves the best usable icon for a vendor homepage.
+ *
+ * Every candidate is inspected with the same gate as an in-content mark, so a
+ * site that serves an oversized, unsupported or scripted image yields no icon
+ * rather than a mirrored liability.
+ */
+export declare function resolveSiteIcon(homepage: string, fetcher: SiteIconFetcher): Promise<SiteIcon | {
+    readonly failed: string;
+}>;

package/dist/site-icons.js

@@ -0,0 +1,155 @@
+import { inspectIconBytes, MAX_ICON_BYTES } from './icons.js';
+/**
+ * Site icon discovery, for products that ship no brand mark of their own.
+ *
+ * Many plugins are a thin wrapper over a vendor's API: the content carries no
+ * logo, and the declared homepage is the only pointer to the vendor. Fetching
+ * that site's icon once at publish time, verifying it and mirroring it as a
+ * release asset replaces a per-render favicon lookup in the client.
+ */
+export const SITE_ICON_MAX_HTML_BYTES = 4 * 1024 * 1024;
+/**
+ * Only the document head is parsed. Icon links are declared there, and vendor
+ * landing pages are frequently several megabytes of markup and script.
+ */
+export const SITE_ICON_HEAD_BYTES = 256 * 1024;
+/** Hosts that serve repository chrome rather than a product brand. */
+const REPOSITORY_HOSTS = /(^|\.)(github\.com|githubusercontent\.com|gitlab\.com|bitbucket\.org|codeberg\.org|sourceforge\.net|gitee\.com)$/;
+/**
+ * Whether a homepage can stand in for a product brand.
+ *
+ * Only HTTPS sites qualify: a repository URL would yield the forge's own logo,
+ * and a non-routable host is a request forgery risk rather than a vendor site.
+ */
+export function isVendorHomepage(homepage) {
+    if (!homepage)
+        return false;
+    let parsed;
+    try {
+        parsed = new URL(homepage);
+    }
+    catch {
+        return false;
+    }
+    if (parsed.protocol !== 'https:')
+        return false;
+    return isPublicHostname(parsed.hostname) && !REPOSITORY_HOSTS.test(parsed.hostname);
+}
+/** Rejects loopback, link-local, private and internal hostnames. */
+export function isPublicHostname(hostname) {
+    const host = hostname.toLowerCase().replace(/^\[|\]$/g, '');
+    if (host === 'localhost' || host.endsWith('.localhost') || host.endsWith('.local'))
+        return false;
+    if (host.endsWith('.internal') || host.endsWith('.home.arpa'))
+        return false;
+    if (host === '::1' || host.startsWith('fe80:') || host.startsWith('fc') || host.startsWith('fd'))
+        return false;
+    const ipv4 = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/.exec(host);
+    if (ipv4) {
+        const [a, b] = ipv4.slice(1).map(Number);
+        if (a === 0 || a === 10 || a === 127 || a >= 224)
+            return false;
+        if (a === 169 && b === 254)
+            return false;
+        if (a === 172 && b >= 16 && b <= 31)
+            return false;
+        if (a === 192 && b === 168)
+            return false;
+        return true;
+    }
+    // A bare hostname label has no public site behind it.
+    return host.includes('.');
+}
+/**
+ * Extracts icon URLs from a document head, best candidate first.
+ *
+ * `apple-touch-icon` is preferred because it is a square PNG sized for a home
+ * screen; declared `icon` links follow in declared order; `/favicon.ico` is the
+ * conventional last resort when nothing is declared.
+ */
+export function discoverSiteIcons(html, baseUrl) {
+    const candidates = [];
+    const linkTags = html.match(/<link\b[^>]*>/gi) ?? [];
+    for (const tag of linkTags) {
+        const rel = /\brel\s*=\s*["']?([^"'>]+)/i.exec(tag)?.[1]?.toLowerCase() ?? '';
+        if (!/\b(apple-touch-icon|icon|shortcut|mask-icon)\b/.test(rel))
+            continue;
+        const href = /\bhref\s*=\s*["']([^"']+)["']/i.exec(tag)?.[1];
+        if (!href)
+            continue;
+        const sizes = /\bsizes\s*=\s*["']?([0-9]+x[0-9]+)/i.exec(tag)?.[1];
+        const edge = sizes ? Number.parseInt(sizes, 10) : 180;
+        // Apple touch icons lead; larger declared sizes lead within a group.
+        const rank = rel.includes('apple-touch-icon') ? 0 : rel.includes('mask-icon') ? 2 : 1;
+        candidates.push({ href, rank: rank * 1000 + Math.max(0, 512 - (edge || 180)) });
+    }
+    const resolved = [];
+    for (const candidate of candidates.toSorted((left, right) => left.rank - right.rank)) {
+        try {
+            const url = new URL(candidate.href, baseUrl);
+            if (url.protocol !== 'https:' || !isPublicHostname(url.hostname))
+                continue;
+            resolved.push({ url: url.toString(), rank: candidate.rank });
+        }
+        catch {
+            continue;
+        }
+    }
+    // The conventional location is always the last candidate: a site whose
+    // declared icon turns out to be unusable can still resolve through it.
+    try {
+        const fallback = new URL('/favicon.ico', baseUrl);
+        if (fallback.protocol === 'https:' && isPublicHostname(fallback.hostname))
+            resolved.push({ url: fallback.toString(), rank: 5000 });
+    }
+    catch {
+        // An unparseable base leaves the declared candidates only.
+    }
+    return [...new Set(resolved.toSorted((l, r) => l.rank - r.rank).map((item) => item.url))];
+}
+/**
+ * Resolves the best usable icon for a vendor homepage.
+ *
+ * Every candidate is inspected with the same gate as an in-content mark, so a
+ * site that serves an oversized, unsupported or scripted image yields no icon
+ * rather than a mirrored liability.
+ */
+export async function resolveSiteIcon(homepage, fetcher) {
+    if (!isVendorHomepage(homepage))
+        return { failed: 'NOT_VENDOR_HOMEPAGE' };
+    let html;
+    try {
+        html = await fetcher.fetchText(homepage);
+    }
+    catch (error) {
+        return { failed: `HOMEPAGE_FETCH_FAILED: ${message(error)}` };
+    }
+    if (html.length > SITE_ICON_MAX_HTML_BYTES)
+        return { failed: 'HOMEPAGE_TOO_LARGE' };
+    for (const url of discoverSiteIcons(html.slice(0, SITE_ICON_HEAD_BYTES), homepage)) {
+        let bytes;
+        try {
+            bytes = await fetcher.fetchBytes(url);
+        }
+        catch {
+            continue;
+        }
+        if (bytes.byteLength > MAX_ICON_BYTES)
+            continue;
+        const inspected = inspectIconBytes(bytes);
+        if (!('contentType' in inspected))
+            continue;
+        return {
+            url,
+            homepage,
+            bytes,
+            contentType: inspected.contentType,
+            digest: fetcher.digest(bytes),
+        };
+    }
+    return { failed: 'NO_USABLE_ICON' };
+}
+function message(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+//# sourceMappingURL=site-icons.js.map

package/dist/site-icons.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"site-icons.js","sourceRoot":"","sources":["../src/site-icons.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAwB,MAAM,YAAY,CAAA;AAEnF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAA;AAEvD;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,GAAG,IAAI,CAAA;AAE9C,sEAAsE;AACtE,MAAM,gBAAgB,GACpB,kHAAkH,CAAA;AAWpH;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,QAA4B;IAC3D,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC3B,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAC9C,OAAO,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;AACrF,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC3D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAA;IAChG,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAA;IAC3E,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAC9F,OAAO,KAAK,CAAA;IACd,MAAM,IAAI,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACtE,IAAI,IAAI,EAAE,CAAC;QACT,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAqB,CAAA;QAC5D,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,KAAK,CAAA;QAC9D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAA;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAA;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,KAAK,CAAA;QACxC,OAAO,IAAI,CAAA;IACb,CAAC;IACD,sDAAsD;IACtD,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;AAC3B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,OAAe;IAC7D,MAAM,UAAU,GAAqC,EAAE,CAAA;IACvD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,CAAA;IACpD,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,6BAA6B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAA;QAC7E,IAAI,CAAC,gDAAgD,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAQ;QACzE,MAAM,IAAI,GAAG,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAC5D,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,KAAK,GAAG,qCAAqC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAClE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAA;QACrD,qEAAqE;QACrE,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACrF,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;IACjF,CAAC;IACD,MAAM,QAAQ,GAAoC,EAAE,CAAA;IACpD,KAAK,MAAM,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YAC5C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,QAAQ,CAAC;gBAAE,SAAQ;YAC1E,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC,CAAA;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;IACH,CAAC;IACD,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,CAAA;QACjD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACvE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAA;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;AAC3F,CAAC;AAQD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,OAAwB;IAExB,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAA;IACzE,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAA;IAC1C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,0BAA0B,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,CAAA;IAC/D,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,wBAAwB;QAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAA;IACnF,KAAK,MAAM,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnF,IAAI,KAAiB,CAAA;QACrB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,SAAQ;QACV,CAAC;QACD,IAAI,KAAK,CAAC,UAAU,GAAG,cAAc;YAAE,SAAQ;QAC/C,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,CAAC,aAAa,IAAI,SAAS,CAAC;YAAE,SAAQ;QAC3C,OAAO;YACL,GAAG;YACH,QAAQ;YACR,KAAK;YACL,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9B,CAAA;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAA;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AAC/D,CAAC"}

package/dist/sources.d.ts

@@ -0,0 +1,54 @@
+export type MarketplaceDialect = 'openai' | 'cursor' | 'claude';
+export interface SourceConfig {
+    readonly sourceId: string;
+    readonly displayName: string;
+    readonly repositoryUrl: string;
+    readonly marketplaceDialect: MarketplaceDialect;
+    readonly manifestPath: string;
+    readonly defaultBranch: string;
+    readonly trustClassification: 'official';
+    readonly fixturePath?: string;
+    readonly fixtureCommitSha?: string;
+}
+export type PluginSourceSpec = {
+    readonly kind: 'local';
+    readonly path: string;
+} | {
+    readonly kind: 'git';
+    readonly repositoryUrl: string;
+    readonly subdirectory: string;
+    readonly ref?: string;
+    readonly sha?: string;
+};
+export interface MarketplacePluginEntry {
+    readonly name: string;
+    readonly displayName?: string | undefined;
+    readonly description: string;
+    readonly categories: readonly string[];
+    readonly keywords: readonly string[];
+    readonly authors: readonly string[];
+    readonly homepage?: string | undefined;
+    readonly icons: readonly string[];
+    readonly source: PluginSourceSpec;
+    readonly policy: Record<string, unknown>;
+    readonly raw: Record<string, unknown>;
+    readonly entryDigest: string;
+}
+export interface ParsedMarketplace {
+    readonly marketplaceName: string;
+    readonly marketplaceDescription: string;
+    readonly owner: readonly string[];
+    readonly entries: readonly MarketplacePluginEntry[];
+    readonly raw: Record<string, unknown>;
+}
+export declare class SourceAdapterError extends Error {
+    readonly code: string;
+    readonly details: readonly string[];
+    constructor(code: string, details?: readonly string[]);
+}
+export declare function parseMarketplaceManifest(input: unknown, source: SourceConfig): ParsedMarketplace;
+/** Parse JSON while rejecting duplicate object keys instead of accepting last-key-wins input. */
+export declare function parseJsonDocument(text: string): unknown;
+export declare function parseSourceSpec(value: unknown, source: SourceConfig, pluginName?: string): PluginSourceSpec;
+export declare function canonicalRepositoryUrl(input: string): string;
+export declare function safeRelativePath(input: string, code?: string): string;