@adea-ai/plugins 1.0.0

package/dist/display-name.js

@@ -0,0 +1,160 @@
+/**
+ * Display-name normalization for catalog plugins.
+ *
+ * Marketplace manifests are inconsistent: a vendor names a plugin `Gmail`, the
+ * next one names it `zapier`, and a curated source names it
+ * `aws-agents-for-devsecops`. The UI renders those strings verbatim, so one
+ * list reads `Zapier` and the next reads `zapier` beside it. This turns a
+ * slug-shaped name into the title-cased form a person would write, in the
+ * catalog, so every consumer shows the same thing without its own guesswork.
+ *
+ * Two rules keep it from "correcting" names that are already right:
+ *
+ * - a token that carries any uppercase is left exactly as it is, which
+ *   preserves vendor casing (`Gmail`, `iMessage`, `eToro`, `PDF Viewer`) and
+ *   makes the function idempotent;
+ * - a token with a published non-title-case form comes from `BRAND_TOKENS`
+ *   instead of the general rule, because title-casing `npm` → `Npm` or
+ *   `github` → `Github` is exactly the inconsistency this exists to remove.
+ */
+const BRAND_TOKENS = {
+    '42crunch': '42Crunch',
+    adlc: 'ADLC',
+    ai: 'AI',
+    bigquery: 'BigQuery',
+    brightdata: 'Bright Data',
+    amd: 'AMD',
+    alloydb: 'AlloyDB',
+    api: 'API',
+    apis: 'APIs',
+    aws: 'AWS',
+    cds: 'CDS',
+    ckeditor: 'CKEditor',
+    clickhouse: 'ClickHouse',
+    cli: 'CLI',
+    coderabbit: 'CodeRabbit',
+    crowdsec: 'CrowdSec',
+    crm: 'CRM',
+    crowdstrike: 'CrowdStrike',
+    css: 'CSS',
+    dak: 'DAK',
+    dominodatalab: 'Domino Data Lab',
+    datadog: 'Datadog',
+    fullstory: 'FullStory',
+    gitkraken: 'GitKraken',
+    devops: 'DevOps',
+    devsecops: 'DevSecOps',
+    gcp: 'GCP',
+    github: 'GitHub',
+    gitlab: 'GitLab',
+    graphql: 'GraphQL',
+    html: 'HTML',
+    huggingface: 'Hugging Face',
+    ibm: 'IBM',
+    idmp: 'IDMP',
+    imessage: 'iMessage',
+    ios: 'iOS',
+    javascript: 'JavaScript',
+    json: 'JSON',
+    k8s: 'Kubernetes',
+    langchain: 'LangChain',
+    llm: 'LLM',
+    llms: 'LLMs',
+    logrocket: 'LogRocket',
+    lsp: 'LSP',
+    lseg: 'LSEG',
+    macos: 'macOS',
+    md: 'MD',
+    mcp: 'MCP',
+    mongodb: 'MongoDB',
+    oracledb: 'Oracle Database',
+    pagerduty: 'PagerDuty',
+    planetscale: 'PlanetScale',
+    posthog: 'PostHog',
+    mysql: 'MySQL',
+    ngs: 'NGS',
+    nosql: 'NoSQL',
+    nvidia: 'NVIDIA',
+    ocr: 'OCR',
+    openai: 'OpenAI',
+    paypal: 'PayPal',
+    pdf: 'PDF',
+    postgres: 'Postgres',
+    postgresql: 'PostgreSQL',
+    pytorch: 'PyTorch',
+    sap: 'SAP',
+    sdk: 'SDK',
+    seo: 'SEO',
+    servicenow: 'ServiceNow',
+    sql: 'SQL',
+    sre: 'SRE',
+    tensorflow: 'TensorFlow',
+    terraform: 'Terraform',
+    twg: 'TWG',
+    typescript: 'TypeScript',
+    ui: 'UI',
+    ui5: 'UI5',
+    ux: 'UX',
+    whatsapp: 'WhatsApp',
+    wordpress: 'WordPress',
+    youtube: 'YouTube',
+};
+/** Articles, conjunctions and prepositions stay lowercase inside a name. */
+const SMALL_WORDS = new Set([
+    'a',
+    'an',
+    'and',
+    'as',
+    'at',
+    'by',
+    'for',
+    'from',
+    'in',
+    'of',
+    'on',
+    'or',
+    'the',
+    'to',
+    'with',
+]);
+/**
+ * Names whose slug form hides a domain or an initialism, which the token rules
+ * below cannot recover: `monday-com` is `monday.com`, not `Monday Com`.
+ */
+const FULL_NAMES = {
+    'bigdata-com': 'BigData.com',
+    'incident-io': 'Incident.io',
+    'monday-com': 'Monday.com',
+    vpai: 'VPAI',
+};
+/**
+ * Title-cases a slug-shaped name and leaves a properly cased one alone.
+ *
+ * Separators become spaces (`adobe-for-creativity` → `Adobe for Creativity`),
+ * but a dot does not, so domain-style names keep their shape
+ * (`monday.com` → `Monday.com`).
+ */
+export function normalizeDisplayName(value) {
+    const trimmed = value.trim();
+    const known = FULL_NAMES[trimmed.toLowerCase()];
+    if (known !== undefined)
+        return known;
+    const tokens = trimmed.split(/[-_\s]+/u).filter(Boolean);
+    if (tokens.length === 0)
+        return value;
+    return tokens
+        .map((token, index) => {
+        const key = token.toLowerCase();
+        const brand = BRAND_TOKENS[key];
+        if (brand !== undefined)
+            return brand;
+        // Any uppercase means the vendor already chose a casing.
+        if (/\p{Lu}/u.test(token))
+            return token;
+        if (index > 0 && SMALL_WORDS.has(key))
+            return key;
+        return `${token.slice(0, 1).toUpperCase()}${token.slice(1)}`;
+    })
+        .join(' ');
+}
+//# sourceMappingURL=display-name.js.map

package/dist/display-name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"display-name.js","sourceRoot":"","sources":["../src/display-name.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,YAAY,GAAqC;IACrD,UAAU,EAAE,UAAU;IACtB,IAAI,EAAE,MAAM;IACZ,EAAE,EAAE,IAAI;IACR,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,aAAa;IACzB,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,YAAY;IACxB,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;IACxB,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;IACV,WAAW,EAAE,aAAa;IAC1B,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,aAAa,EAAE,iBAAiB;IAChC,OAAO,EAAE,SAAS;IAClB,SAAS,EAAE,WAAW;IACtB,SAAS,EAAE,WAAW;IACtB,MAAM,EAAE,QAAQ;IAChB,SAAS,EAAE,WAAW;IACtB,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,OAAO,EAAE,SAAS;IAClB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,cAAc;IAC3B,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,UAAU;IACpB,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;IACxB,IAAI,EAAE,MAAM;IACZ,GAAG,EAAE,YAAY;IACjB,SAAS,EAAE,WAAW;IACtB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,WAAW;IACtB,GAAG,EAAE,KAAK;IACV,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;IACd,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,OAAO,EAAE,SAAS;IAClB,QAAQ,EAAE,iBAAiB;IAC3B,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,aAAa;IAC1B,OAAO,EAAE,SAAS;IAClB,KAAK,EAAE,OAAO;IACd,GAAG,EAAE,KAAK;IACV,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;IACV,QAAQ,EAAE,UAAU;IACpB,UAAU,EAAE,YAAY;IACxB,OAAO,EAAE,SAAS;IAClB,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;IACxB,GAAG,EAAE,KAAK;IACV,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;IACxB,SAAS,EAAE,WAAW;IACtB,GAAG,EAAE,KAAK;IACV,UAAU,EAAE,YAAY;IACxB,EAAE,EAAE,IAAI;IACR,GAAG,EAAE,KAAK;IACV,EAAE,EAAE,IAAI;IACR,QAAQ,EAAE,UAAU;IACpB,SAAS,EAAE,WAAW;IACtB,OAAO,EAAE,SAAS;CACnB,CAAA;AAED,4EAA4E;AAC5E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC;IAC1B,GAAG;IACH,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,MAAM;IACN,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,MAAM;CACP,CAAC,CAAA;AAEF;;;GAGG;AACH,MAAM,UAAU,GAAqC;IACnD,aAAa,EAAE,aAAa;IAC5B,aAAa,EAAE,aAAa;IAC5B,YAAY,EAAE,YAAY;IAC1B,IAAI,EAAE,MAAM;CACb,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACrC,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACxD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IACrC,OAAO,MAAM;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QACpB,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,EAAE,CAAA;QAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;QAC/B,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACrC,yDAAyD;QACzD,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;QACvC,IAAI,KAAK,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAA;QACjD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9D,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC"}

package/dist/harness.d.ts

@@ -0,0 +1,13 @@
+import { type Catalog, type Harness, type MaterializationPlan } from './schema.js';
+export declare class MaterializationError extends Error {
+    readonly code: string;
+    readonly details: readonly string[];
+    constructor(code: string, details?: readonly string[]);
+}
+export declare function createMaterializationPlan(input: {
+    readonly catalog: Catalog;
+    readonly pluginId: string;
+    readonly harness: Harness;
+    readonly releaseId?: string;
+}): MaterializationPlan;
+export declare function supportedHarnesses(): readonly Harness[];

package/dist/harness.js

@@ -0,0 +1,169 @@
+import { HarnessSchema, MaterializationPlanSchema, } from './schema.js';
+export class MaterializationError extends Error {
+    code;
+    details;
+    constructor(code, details = []) {
+        super(`${code}${details.length ? `: ${details.join(', ')}` : ''}`);
+        this.code = code;
+        this.details = details;
+        this.name = 'MaterializationError';
+    }
+}
+export function createMaterializationPlan(input) {
+    const plugin = input.catalog.plugins.find((candidate) => candidate.pluginId === input.pluginId);
+    if (!plugin)
+        throw new MaterializationError('PLUGIN_NOT_FOUND', [input.pluginId]);
+    const release = plugin.availableReleases.find((candidate) => candidate.releaseId === (input.releaseId ?? plugin.currentReleaseId));
+    if (!release)
+        throw new MaterializationError('RELEASE_NOT_FOUND', [
+            input.releaseId ?? plugin.currentReleaseId,
+        ]);
+    const compatibility = plugin.harnessCompatibility[input.harness];
+    if (!compatibility)
+        throw new MaterializationError('HARNESS_UNSUPPORTED', [input.harness]);
+    return MaterializationPlanSchema.parse({
+        planVersion: 1,
+        pluginId: plugin.pluginId,
+        releaseId: release.releaseId,
+        harness: input.harness,
+        source: {
+            repositoryUrl: release.resolvedRepositoryUrl,
+            commitSha: release.resolvedCommitSha,
+            pluginSubdirectory: release.pluginSubdirectory,
+            contentDigest: release.canonicalContentDigest,
+        },
+        targetLayout: targetLayout(input.harness),
+        files: release.fileIndex
+            .map((sourcePath) => filePlan(release, sourcePath, input.harness, compatibility.status))
+            .toSorted((left, right) => left.targetPath.localeCompare(right.targetPath) ||
+            left.sourcePath.localeCompare(right.sourcePath)),
+        configuration: {
+            compatibilityStatus: compatibility.status,
+            sourceDialect: release.releaseMetadata.sourceDialect ?? 'unknown',
+            executeInstallation: false,
+        },
+        requiredConnectors: release.requiredConnectors,
+        requiredCredentials: release.requiredCredentials,
+        policyConstraints: [
+            'This plan describes files and translation only; it does not install or execute upstream code.',
+            ...release.permissionSensitiveChanges.map((type) => `Control Plane must authorize ${type} capability explicitly.`),
+        ],
+    });
+}
+function targetLayout(harness) {
+    switch (harness) {
+        case 'codex':
+            return {
+                root: '.agents',
+                notes: [
+                    'Skills and instructions map to the Codex .agents layout.',
+                    'MCP and executable capabilities require Control Plane policy.',
+                ],
+            };
+        case 'claude-code':
+            return {
+                root: '.claude',
+                notes: [
+                    'Claude Code-native files can be copied when the source dialect is Claude.',
+                    'Hooks and MCP configuration still require explicit runtime authorization.',
+                ],
+            };
+        case 'cursor':
+            return {
+                root: '.cursor',
+                notes: [
+                    'Cursor rules and skills map to the .cursor layout.',
+                    'MCP configuration is declarative and is not executed by this plan.',
+                ],
+            };
+        case 'pi':
+            return {
+                root: '.pi',
+                notes: [
+                    'Pi receives portable SKILL.md and MCP metadata only.',
+                    'No Pi process or package lifecycle is invoked.',
+                ],
+            };
+        case 'hermes':
+            return {
+                root: '.hermes',
+                notes: [
+                    'Hermes receives portable skill and MCP metadata only.',
+                    'Harness-specific translation remains explicit in each file action.',
+                ],
+            };
+        case 'opencode':
+            return {
+                root: '.opencode',
+                notes: [
+                    'OpenCode receives portable instruction and MCP metadata only.',
+                    'Executable capabilities are excluded.',
+                ],
+            };
+        case 'generic-skill-mcp':
+            return {
+                root: '.agent',
+                notes: ['Generic SKILL.md and MCP-compatible files are copied when recognized.'],
+            };
+    }
+}
+function filePlan(release, sourcePath, harness, status) {
+    const type = capabilityTypeForPath(release, sourcePath);
+    const directory = sourcePath.includes('/') ? sourcePath.slice(0, sourcePath.lastIndexOf('/')) : '';
+    if (status === 'unsupported' || type === 'executable' || type === 'unknown') {
+        return {
+            sourcePath,
+            targetPath: sourcePath,
+            action: 'unsupported',
+            reason: `${type} capability is not executable through a materialization plan.`,
+        };
+    }
+    if (type === 'hook' ||
+        type === 'browser' ||
+        type === 'scheduled-task' ||
+        type === 'ui-component') {
+        return {
+            sourcePath,
+            targetPath: sourcePath,
+            action: 'ignore',
+            reason: `${type} is cataloged but has no portable target layout for ${harness}.`,
+        };
+    }
+    const targetPath = targetForType(type, sourcePath, directory, harness);
+    const action = type === 'skill' || type === 'rule' || (type === 'mcp-server' && status === 'native')
+        ? 'copy'
+        : 'translate';
+    return {
+        sourcePath,
+        targetPath,
+        action: action,
+        reason: action === 'copy'
+            ? `Copy recognized ${type} content.`
+            : `Translate ${type} metadata into the ${harness} layout.`,
+    };
+}
+function capabilityTypeForPath(release, path) {
+    const match = release.capabilities.find((capability) => capability.paths.includes(path));
+    return match?.type ?? 'unknown';
+}
+function targetForType(type, path, directory, harness) {
+    if (type === 'skill')
+        return `${targetLayout(harness).root}/skills/${directory || basenameWithoutExtension(path)}/${path.endsWith('SKILL.md') ? 'SKILL.md' : basenameWithoutExtension(path)}`;
+    if (type === 'rule')
+        return `${targetLayout(harness).root}/rules/${basenameWithoutExtension(path)}.md`;
+    if (type === 'command')
+        return `${targetLayout(harness).root}/commands/${basenameWithoutExtension(path)}.md`;
+    if (type === 'agent')
+        return `${targetLayout(harness).root}/agents/${basenameWithoutExtension(path)}.md`;
+    if (type === 'mcp-server')
+        return `${targetLayout(harness).root}/mcp/${basenameWithoutExtension(path)}.json`;
+    return `${targetLayout(harness).root}/${path}`;
+}
+function basenameWithoutExtension(path) {
+    const basename = path.split('/').at(-1) ?? path;
+    return basename.replace(/\.[^.]+$/, '');
+}
+export function supportedHarnesses() {
+    return HarnessSchema.options;
+}
+//# sourceMappingURL=harness.js.map

package/dist/harness.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness.js","sourceRoot":"","sources":["../src/harness.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,yBAAyB,GAM1B,MAAM,aAAa,CAAA;AAEpB,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAElC;IACA;IAFX,YACW,IAAY,EACZ,UAA6B,EAAE;QAExC,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;QAHzD,SAAI,GAAJ,IAAI,CAAQ;QACZ,YAAO,GAAP,OAAO,CAAwB;QAGxC,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAA;IACpC,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CAAC,KAKzC;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAAC,CAAA;IAC/F,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,oBAAoB,CAAC,kBAAkB,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAA;IACjF,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,IAAI,CAC3C,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,SAAS,KAAK,CAAC,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB,CAAC,CACpF,CAAA;IACD,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,oBAAoB,CAAC,mBAAmB,EAAE;YAClD,KAAK,CAAC,SAAS,IAAI,MAAM,CAAC,gBAAgB;SAC3C,CAAC,CAAA;IACJ,MAAM,aAAa,GAAG,MAAM,CAAC,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAChE,IAAI,CAAC,aAAa;QAAE,MAAM,IAAI,oBAAoB,CAAC,qBAAqB,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAA;IAC1F,OAAO,yBAAyB,CAAC,KAAK,CAAC;QACrC,WAAW,EAAE,CAAC;QACd,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,MAAM,EAAE;YACN,aAAa,EAAE,OAAO,CAAC,qBAAqB;YAC5C,SAAS,EAAE,OAAO,CAAC,iBAAiB;YACpC,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;YAC9C,aAAa,EAAE,OAAO,CAAC,sBAAsB;SAC9C;QACD,YAAY,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC;QACzC,KAAK,EAAE,OAAO,CAAC,SAAS;aACrB,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,OAAO,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;aACvF,QAAQ,CACP,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACd,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/C,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAClD;QACH,aAAa,EAAE;YACb,mBAAmB,EAAE,aAAa,CAAC,MAAM;YACzC,aAAa,EAAE,OAAO,CAAC,eAAe,CAAC,aAAa,IAAI,SAAS;YACjE,mBAAmB,EAAE,KAAK;SAC3B;QACD,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;QAChD,iBAAiB,EAAE;YACjB,+FAA+F;YAC/F,GAAG,OAAO,CAAC,0BAA0B,CAAC,GAAG,CACvC,CAAC,IAAI,EAAE,EAAE,CAAC,gCAAgC,IAAI,yBAAyB,CACxE;SACF;KACF,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,OAAgB;IACpC,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE;oBACL,0DAA0D;oBAC1D,+DAA+D;iBAChE;aACF,CAAA;QACH,KAAK,aAAa;YAChB,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE;oBACL,2EAA2E;oBAC3E,2EAA2E;iBAC5E;aACF,CAAA;QACH,KAAK,QAAQ;YACX,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE;oBACL,oDAAoD;oBACpD,oEAAoE;iBACrE;aACF,CAAA;QACH,KAAK,IAAI;YACP,OAAO;gBACL,IAAI,EAAE,KAAK;gBACX,KAAK,EAAE;oBACL,sDAAsD;oBACtD,gDAAgD;iBACjD;aACF,CAAA;QACH,KAAK,QAAQ;YACX,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,KAAK,EAAE;oBACL,uDAAuD;oBACvD,oEAAoE;iBACrE;aACF,CAAA;QACH,KAAK,UAAU;YACb,OAAO;gBACL,IAAI,EAAE,WAAW;gBACjB,KAAK,EAAE;oBACL,+DAA+D;oBAC/D,uCAAuC;iBACxC;aACF,CAAA;QACH,KAAK,mBAAmB;YACtB,OAAO;gBACL,IAAI,EAAE,QAAQ;gBACd,KAAK,EAAE,CAAC,uEAAuE,CAAC;aACjF,CAAA;IACL,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,OAAsB,EACtB,UAAkB,EAClB,OAAgB,EAChB,MAAyD;IAEzD,MAAM,IAAI,GAAG,qBAAqB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAClG,IAAI,MAAM,KAAK,aAAa,IAAI,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5E,OAAO;YACL,UAAU;YACV,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,aAAsB;YAC9B,MAAM,EAAE,GAAG,IAAI,+DAA+D;SAC/E,CAAA;IACH,CAAC;IACD,IACE,IAAI,KAAK,MAAM;QACf,IAAI,KAAK,SAAS;QAClB,IAAI,KAAK,gBAAgB;QACzB,IAAI,KAAK,cAAc,EACvB,CAAC;QACD,OAAO;YACL,UAAU;YACV,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,QAAiB;YACzB,MAAM,EAAE,GAAG,IAAI,uDAAuD,OAAO,GAAG;SACjF,CAAA;IACH,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IACtE,MAAM,MAAM,GACV,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,KAAK,QAAQ,CAAC;QACnF,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,WAAW,CAAA;IACjB,OAAO;QACL,UAAU;QACV,UAAU;QACV,MAAM,EAAE,MAA8B;QACtC,MAAM,EACJ,MAAM,KAAK,MAAM;YACf,CAAC,CAAC,mBAAmB,IAAI,WAAW;YACpC,CAAC,CAAC,aAAa,IAAI,sBAAsB,OAAO,UAAU;KAC/D,CAAA;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,OAAsB,EAAE,IAAY;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IACxF,OAAO,KAAK,EAAE,IAAI,IAAI,SAAS,CAAA;AACjC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,IAAY,EAAE,SAAiB,EAAE,OAAgB;IACpF,IAAI,IAAI,KAAK,OAAO;QAClB,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,WAAW,SAAS,IAAI,wBAAwB,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,wBAAwB,CAAC,IAAI,CAAC,EAAE,CAAA;IACzK,IAAI,IAAI,KAAK,MAAM;QACjB,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,UAAU,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAA;IACnF,IAAI,IAAI,KAAK,SAAS;QACpB,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,aAAa,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAA;IACtF,IAAI,IAAI,KAAK,OAAO;QAClB,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,WAAW,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAA;IACpF,IAAI,IAAI,KAAK,YAAY;QACvB,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,QAAQ,wBAAwB,CAAC,IAAI,CAAC,OAAO,CAAA;IACnF,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC,IAAI,IAAI,IAAI,EAAE,CAAA;AAChD,CAAC;AAED,SAAS,wBAAwB,CAAC,IAAY;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IAC/C,OAAO,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;AACzC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,aAAa,CAAC,OAAO,CAAA;AAC9B,CAAC"}

package/dist/icon-mirror.d.ts

@@ -0,0 +1,69 @@
+import type { Catalog } from './schema.js';
+import { type PublishedAsset } from './index.js';
+import { type IconContentType } from './icons.js';
+import type { ConsumerIndex } from './consumer-index.js';
+/**
+ * Where an icon's bytes come from, so a mirror needs no tree walk and no
+ * rediscovery: `content` refetches a file at the pinned commit, `favicon`
+ * refetches the site icon the catalog recorded.
+ */
+export type IconSource = {
+    readonly kind: 'content';
+    readonly asset: string;
+    readonly digest: string;
+    readonly bytes: number;
+    readonly contentType: IconContentType;
+    readonly repositoryUrl: string;
+    readonly commitSha: string;
+    readonly pluginSubdirectory: string;
+    /** Path relative to `pluginSubdirectory`, as recorded in the catalog. */
+    readonly path: string;
+    /** Path including the plugin subdirectory, for a raw content fetch. */
+    readonly sourcePath: string;
+} | {
+    readonly kind: 'favicon';
+    readonly asset: string;
+    readonly digest: string;
+    readonly bytes: number;
+    readonly contentType: IconContentType;
+    readonly url: string;
+    readonly homepage: string;
+};
+export interface IconMirrorResult {
+    /** Icons whose verified bytes are present in the assets directory. */
+    readonly staged: readonly PublishedAsset[];
+    /** Icons that could not be staged, with the reason, never silently dropped. */
+    readonly skipped: readonly {
+        readonly asset: string;
+        readonly reason: string;
+    }[];
+}
+/**
+ * Maps every mirrored icon back to the exact commit it was resolved from, by
+ * matching the digest the product advertises. Canonical variants are inspected
+ * first, mirroring the order product records were built in.
+ */
+export declare function resolveIconSources(catalog: Pick<Catalog, 'plugins'>, index: ConsumerIndex): readonly IconSource[];
+/**
+ * Writes mirrored icon bytes beside the published artifacts.
+ *
+ * Bytes are verified against the digest the catalog advertises before they are
+ * staged, so a mirror can never publish content that differs from what the
+ * index promised. Staging never overwrites a differing file: content-addressed
+ * names make an existing file either identical or a build error.
+ */
+export declare function stageIconAssets(input: {
+    readonly sources: readonly IconSource[];
+    readonly assetsDirectory: string;
+    /** Reads the icon bytes for a source; live fetches raw content, offline reads fixtures. */
+    readonly readBytes: (source: IconSource) => Promise<Uint8Array>;
+}): Promise<IconMirrorResult>;
+/**
+ * Writes one verified icon into the assets directory.
+ *
+ * The build already holds the exact bytes it recorded a digest for, so staging
+ * them here removes the re-fetch a later mirror would need. That matters for
+ * site icons: their URL is not content-addressed, so a vendor can change the
+ * file between resolution and publication.
+ */
+export declare function stageIconBytes(assetsDirectory: string, asset: string, bytes: Uint8Array): Promise<void>;

package/dist/icon-mirror.js

@@ -0,0 +1,147 @@
+import { promises as fs } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { byteDigest } from './index.js';
+import { iconAssetName, inspectIconBytes } from './icons.js';
+/**
+ * Maps every mirrored icon back to the exact commit it was resolved from, by
+ * matching the digest the product advertises. Canonical variants are inspected
+ * first, mirroring the order product records were built in.
+ */
+export function resolveIconSources(catalog, index) {
+    const byAsset = new Map();
+    for (const plugin of catalog.plugins) {
+        for (const release of plugin.availableReleases) {
+            const icon = release.icon;
+            if (!icon)
+                continue;
+            const asset = iconAssetName(icon.digest, icon.contentType);
+            if (byAsset.has(asset))
+                continue;
+            if (icon.kind === 'favicon') {
+                byAsset.set(asset, {
+                    kind: 'favicon',
+                    asset,
+                    digest: icon.digest,
+                    bytes: icon.bytes,
+                    contentType: icon.contentType,
+                    url: icon.url,
+                    homepage: icon.homepage,
+                });
+                continue;
+            }
+            const subdirectory = release.pluginSubdirectory && release.pluginSubdirectory !== '.'
+                ? release.pluginSubdirectory
+                : '';
+            byAsset.set(asset, {
+                kind: 'content',
+                asset,
+                digest: icon.digest,
+                bytes: icon.bytes,
+                contentType: icon.contentType,
+                repositoryUrl: release.resolvedRepositoryUrl,
+                commitSha: release.resolvedCommitSha,
+                pluginSubdirectory: subdirectory,
+                path: icon.path,
+                sourcePath: subdirectory ? `${subdirectory}/${icon.path}` : icon.path,
+            });
+        }
+    }
+    const sources = [];
+    for (const product of Object.values(index.products)) {
+        const icon = product.icon;
+        if (!icon)
+            continue;
+        const source = byAsset.get(icon.asset);
+        if (source)
+            sources.push(source);
+    }
+    return sources.toSorted((left, right) => left.asset.localeCompare(right.asset));
+}
+/**
+ * Writes mirrored icon bytes beside the published artifacts.
+ *
+ * Bytes are verified against the digest the catalog advertises before they are
+ * staged, so a mirror can never publish content that differs from what the
+ * index promised. Staging never overwrites a differing file: content-addressed
+ * names make an existing file either identical or a build error.
+ */
+export async function stageIconAssets(input) {
+    const staged = [];
+    const skipped = [];
+    await fs.mkdir(input.assetsDirectory, { recursive: true });
+    for (const source of input.sources) {
+        const destination = join(input.assetsDirectory, source.asset);
+        const existing = await fs.readFile(destination).catch(() => undefined);
+        if (existing && byteDigest(existing) === source.digest) {
+            staged.push(publishedAssetOf(source));
+            continue;
+        }
+        if (existing) {
+            skipped.push({ asset: source.asset, reason: 'ASSET_CONFLICT' });
+            continue;
+        }
+        let bytes;
+        try {
+            bytes = await input.readBytes(source);
+        }
+        catch (error) {
+            skipped.push({
+                asset: source.asset,
+                reason: `FETCH_FAILED: ${error instanceof Error ? error.message : String(error)}`,
+            });
+            continue;
+        }
+        const inspected = inspectIconBytes(bytes);
+        if (!('contentType' in inspected)) {
+            skipped.push({ asset: source.asset, reason: inspected.rejected });
+            continue;
+        }
+        if (inspected.contentType !== source.contentType) {
+            skipped.push({ asset: source.asset, reason: 'CONTENT_TYPE_CHANGED' });
+            continue;
+        }
+        if (byteDigest(bytes) !== source.digest || bytes.byteLength !== source.bytes) {
+            skipped.push({ asset: source.asset, reason: 'DIGEST_MISMATCH' });
+            continue;
+        }
+        await fs.mkdir(dirname(destination), { recursive: true });
+        await fs.writeFile(destination, bytes);
+        staged.push(publishedAssetOf(source));
+    }
+    // Distinct assets: two products can share one mark, and the catalog declares
+    // each asset once.
+    return { staged: dedupeAssets(staged), skipped };
+}
+function dedupeAssets(assets) {
+    const unique = new Map();
+    for (const asset of assets)
+        unique.set(asset.name, asset);
+    return [...unique.values()];
+}
+function publishedAssetOf(source) {
+    return {
+        name: source.asset,
+        digest: source.digest,
+        bytes: source.bytes,
+        contentType: source.contentType,
+        kind: source.kind,
+        origin: source.kind === 'content' ? source.sourcePath : source.url,
+    };
+}
+/**
+ * Writes one verified icon into the assets directory.
+ *
+ * The build already holds the exact bytes it recorded a digest for, so staging
+ * them here removes the re-fetch a later mirror would need. That matters for
+ * site icons: their URL is not content-addressed, so a vendor can change the
+ * file between resolution and publication.
+ */
+export async function stageIconBytes(assetsDirectory, asset, bytes) {
+    const destination = join(assetsDirectory, asset);
+    const existing = await fs.readFile(destination).catch(() => undefined);
+    if (existing && byteDigest(existing) === byteDigest(bytes))
+        return;
+    await fs.mkdir(dirname(destination), { recursive: true });
+    await fs.writeFile(destination, bytes);
+}
+//# sourceMappingURL=icon-mirror.js.map

package/dist/icon-mirror.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"icon-mirror.js","sourceRoot":"","sources":["../src/icon-mirror.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAA;AACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEzC,OAAO,EAAE,UAAU,EAAuB,MAAM,YAAY,CAAA;AAC5D,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAwB,MAAM,YAAY,CAAA;AAwClF;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,OAAiC,EACjC,KAAoB;IAEpB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAsB,CAAA;IAC7C,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACrC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,iBAAiB,EAAE,CAAC;YAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;YACzB,IAAI,CAAC,IAAI;gBAAE,SAAQ;YACnB,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,WAAW,CAAC,CAAA;YAC1D,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC;gBAAE,SAAQ;YAChC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;oBACjB,IAAI,EAAE,SAAS;oBACf,KAAK;oBACL,MAAM,EAAE,IAAI,CAAC,MAAM;oBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,QAAQ,EAAE,IAAI,CAAC,QAAQ;iBACxB,CAAC,CAAA;gBACF,SAAQ;YACV,CAAC;YACD,MAAM,YAAY,GAChB,OAAO,CAAC,kBAAkB,IAAI,OAAO,CAAC,kBAAkB,KAAK,GAAG;gBAC9D,CAAC,CAAC,OAAO,CAAC,kBAAkB;gBAC5B,CAAC,CAAC,EAAE,CAAA;YACR,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE;gBACjB,IAAI,EAAE,SAAS;gBACf,KAAK;gBACL,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,OAAO,CAAC,qBAAqB;gBAC5C,SAAS,EAAE,OAAO,CAAC,iBAAiB;gBACpC,kBAAkB,EAAE,YAAY;gBAChC,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,YAAY,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;aACtE,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAiB,EAAE,CAAA;IAChC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;QACzB,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACtC,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAClC,CAAC;IACD,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;AACjF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAKrC;IACC,MAAM,MAAM,GAAqB,EAAE,CAAA;IACnC,MAAM,OAAO,GAAwC,EAAE,CAAA;IACvD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC1D,KAAK,MAAM,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAA;QAC7D,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACtE,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;YACvD,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAA;YACrC,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAA;YAC/D,SAAQ;QACV,CAAC;QACD,IAAI,KAAiB,CAAA;QACrB,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;QACvC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC;gBACX,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,MAAM,EAAE,iBAAiB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAClF,CAAC,CAAA;YACF,SAAQ;QACV,CAAC;QACD,MAAM,SAAS,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;QACzC,IAAI,CAAC,CAAC,aAAa,IAAI,SAAS,CAAC,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAA;YACjE,SAAQ;QACV,CAAC;QACD,IAAI,SAAS,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC,CAAA;YACrE,SAAQ;QACV,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;YAChE,SAAQ;QACV,CAAC;QACD,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;QACtC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAA;IACvC,CAAC;IACD,6EAA6E;IAC7E,mBAAmB;IACnB,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAA;AAClD,CAAC;AAED,SAAS,YAAY,CAAC,MAAiC;IACrD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA0B,CAAA;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;IACzD,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAA;AAC7B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,KAAK;QAClB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG;KACnE,CAAA;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,eAAuB,EACvB,KAAa,EACb,KAAiB;IAEjB,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAA;IAChD,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACtE,IAAI,QAAQ,IAAI,UAAU,CAAC,QAAQ,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC;QAAE,OAAM;IAClE,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACzD,MAAM,EAAE,CAAC,SAAS,CAAC,WAAW,EAAE,KAAK,CAAC,CAAA;AACxC,CAAC"}

package/dist/icons.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Compile-time icon resolution.
+ *
+ * Marketplaces do not declare an icon field, so a plugin's mark is a file in
+ * its own content (`assets/logo.svg`, `assets/icon-large.png`, ...). Resolving
+ * one at compile time removes a runtime guess from consumers, and mirroring the
+ * bytes at publish time removes the upstream fetch entirely.
+ */
+/** Why a candidate file was rejected as an icon. */
+export type IconRejection = 'CONTENT_TYPE_UNSUPPORTED' | 'EMPTY_FILE' | 'SIZE_LIMIT_EXCEEDED' | 'SVG_ACTIVE_CONTENT' | 'SVG_EXTERNAL_REFERENCE';
+/** Content types the catalog will publish as a brand mark. */
+export type IconContentType = 'image/png' | 'image/jpeg' | 'image/gif' | 'image/webp' | 'image/svg+xml' | 'image/x-icon';
+/** Icon file size ceiling; a brand mark is never a large asset. */
+export declare const MAX_ICON_BYTES: number;
+/**
+ * Chooses one icon file from a release's file index, deterministically.
+ *
+ * Preference: `assets/icon.svg` before `assets/icon.png` before `assets/logo.*`,
+ * an `icon`/`logo` stem before `avatar`/`mark`/`brand`, an `assets` directory
+ * before other asset directories, SVG before raster for the same stem, and a
+ * `-large` variant before `-small`. Anything that looks like documentation or a
+ * screenshot is never selected. Ties break on path so the result is stable.
+ */
+export declare function selectIconPath(fileIndex: readonly string[]): string | null;
+/** Sniffs a supported image type from magic bytes; SVG is detected as text. */
+export declare function sniffContentType(bytes: Uint8Array): IconContentType | null;
+/**
+ * Verifies icon bytes before they are published.
+ *
+ * SVG is text that a browser can execute when it is inlined, so active content
+ * and external references are rejected outright. Consumers must still render a
+ * mirrored SVG through an `<img>` element and never inline it into the DOM.
+ */
+export declare function inspectIconBytes(bytes: Uint8Array): {
+    contentType: IconContentType;
+} | {
+    rejected: IconRejection;
+};
+/**
+ * Content-addressed asset name. Release assets cannot contain `/`, so the
+ * digest prefix and extension form one flat name that any release can host.
+ */
+export declare function iconAssetName(digest: string, contentType: IconContentType): string;
+/**
+ * Curation override for a product's brand mark, keyed by product key.
+ *
+ * `null` publishes no mark; a path forces a file inside the plugin content; an
+ * `https://` value names the vendor site to take the mark from. The override
+ * exists because the selection rule is a heuristic over vendor filenames: many
+ * products ship no conventional mark and declare nothing but a repository, and
+ * a curator may know the real brand source.
+ */
+export interface ProductIconOverrides {
+    readonly schemaVersion: 1;
+    readonly overrides: Readonly<Record<string, string | null>>;
+}
+export declare function parseProductIconOverrides(input: unknown): ProductIconOverrides;
+/**
+ * Reads the override for a product: `forced` names a content path or `null` to
+ * publish no mark, and `site` names a vendor site to take the mark from.
+ */
+export declare function iconOverrideFor(overrides: ProductIconOverrides | undefined, productKey: string): {
+    readonly forced?: string | null;
+    readonly site?: string;
+} | undefined;