@adea-ai/plugins 4.0.0 → 4.0.1

package/src/index.ts

@@ -1,11 +1,12 @@
 import { spawn } from 'node:child_process'
 import { createHash } from 'node:crypto'
 import { promises as fs } from 'node:fs'
-import { basename, dirname, join, relative, resolve } from 'node:path'
+import { basename, join, relative, resolve } from 'node:path'
 import { Readable } from 'node:stream'
 import { setTimeout as sleep } from 'node:timers/promises'
 import { createGunzip } from 'node:zlib'
 import { extract } from 'tar-stream'
+import { publishCatalog, type PublishOptions } from './catalog-store.js'
 import {
   CatalogSchema,
   type Catalog,
@@ -63,6 +64,15 @@ import { immutableAssetUrl } from './publication.js'
 import { sourceDigest as bytesDigest } from './source-digest.js'
 
 export { bytesDigest }
+export {
+  catalogFingerprint,
+  publishCatalog,
+  withCatalogRead,
+  writeFileAtomically,
+  type CatalogCoordinationOptions,
+  type PublicationStep,
+  type PublishOptions,
+} from './catalog-store.js'
 
 /**
  * Marks the catalog format this compiler emits.
@@ -338,20 +348,26 @@ export async function synchronize(input: SyncInput): Promise<SyncResult> {
     sourceId: config.sourceId,
     commitSha,
   }))
+  const resolvedLock = createSourcesLock(resolved)
   const unchanged =
     input.fromLock === undefined &&
     input.forceRebuild !== true &&
     input.existingLock !== undefined &&
     resolved.length === input.existingLock.sources.length &&
-    resolved.every((source) => {
+    resolvedLock.sources.every((source) => {
       const previous = input.existingLock?.sources.find(
-        (entry) => entry.sourceId === source.config.sourceId
+        (entry) => entry.sourceId === source.sourceId
       )
-      if (!previous) return false
+      if (!previous || sourceLockChanged(previous, source)) return false
+      if (!input.existingCatalog) return true
+      const priorCatalog = input.existingCatalog.sources.find(
+        (entry) => entry.sourceId === source.sourceId
+      )
+      const config = resolved.find((entry) => entry.config.sourceId === source.sourceId)!.config
       return (
-        previous.resolvedCommitSha === source.commitSha &&
-        previous.sourceManifestDigest === source.manifestDigest &&
-        digest(previous.pluginPins) === digest(source.pluginPins)
+        !!priorCatalog &&
+        priorCatalog.displayName === config.displayName &&
+        priorCatalog.trustClassification === config.trustClassification
       )
     })
   if (unchanged) {
@@ -391,7 +407,7 @@ export async function synchronize(input: SyncInput): Promise<SyncResult> {
     ...(input.transformRelease ? { transformRelease: input.transformRelease } : {}),
   })
   const catalog = buildResult.catalog
-  const lock = createSourcesLock(resolved)
+  const lock = resolvedLock
   const artifacts = createArtifacts(orderLeadingPlugins(catalog, input.leading), lock, {
     ...(input.leading ? { leading: input.leading } : {}),
     ...(input.topCount !== undefined ? { topCount: input.topCount } : {}),
@@ -982,10 +998,7 @@ async function resolvePluginSource(
     pin?.resolvedCommitSha ??
     spec.sha ??
     (resolveExternalRefs
-      ? await resolveGitRef(
-          spec.repositoryUrl,
-          spec.ref?.startsWith('refs/') ? spec.ref : `refs/heads/${spec.ref ?? 'main'}`
-        )
+      ? await resolveGitRef(spec.repositoryUrl, externalGitRef(spec.ref))
       : source.commitSha)
   return {
     repositoryUrl: canonicalUrl,
@@ -1241,6 +1254,18 @@ function findLicense(
   }
 }
 
+function sourceLockChanged(previous: SourceLockEntry, current: SourceLockEntry): boolean {
+  return (
+    previous.repositoryUrl !== current.repositoryUrl ||
+    previous.defaultBranch !== current.defaultBranch ||
+    previous.manifestPath !== current.manifestPath ||
+    previous.marketplaceDialect !== current.marketplaceDialect ||
+    previous.resolvedCommitSha !== current.resolvedCommitSha ||
+    previous.sourceManifestDigest !== current.sourceManifestDigest ||
+    digest(previous.pluginPins) !== digest(current.pluginPins)
+  )
+}
+
 function createSourcesLock(sources: readonly ResolvedSource[]): SourcesLock {
   const entries: SourceLockEntry[] = sources
     .map((source) => ({
@@ -1479,35 +1504,16 @@ export function iconAssets(index: ConsumerIndex): readonly PublishedAsset[] {
   return [...assets.values()].toSorted((left, right) => left.name.localeCompare(right.name))
 }
 
+/**
+ * Publishes a verified artifact set to `generatedDirectory` under the output's
+ * coordination lock. See `catalog-store.ts` for the publication contract.
+ */
 export async function writeArtifacts(
   generatedDirectory: string,
-  artifacts: GeneratedArtifacts
+  artifacts: GeneratedArtifacts,
+  options: PublishOptions = {}
 ): Promise<void> {
-  const parent = dirname(generatedDirectory)
-  await fs.mkdir(parent, { recursive: true })
-  const temporary = await fs.mkdtemp(join(parent, '.catalog-'))
-  try {
-    for (const [name, content] of Object.entries(artifacts))
-      await fs.writeFile(join(temporary, name), content, 'utf8')
-    const backup = `${generatedDirectory}.previous`
-    await fs.rm(backup, { recursive: true, force: true })
-    let movedExisting = false
-    try {
-      await fs.rename(generatedDirectory, backup)
-      movedExisting = true
-    } catch (error) {
-      if ((error as NodeJS.ErrnoException).code !== 'ENOENT') throw error
-    }
-    try {
-      await fs.rename(temporary, generatedDirectory)
-    } catch (error) {
-      if (movedExisting) await fs.rename(backup, generatedDirectory)
-      throw error
-    }
-    if (movedExisting) await fs.rm(backup, { recursive: true, force: true })
-  } finally {
-    await fs.rm(temporary, { recursive: true, force: true })
-  }
+  await publishCatalog(generatedDirectory, artifacts as Record<string, string>, options)
 }
 
 export function verifyArtifacts(artifacts: GeneratedArtifacts): void {
@@ -1872,11 +1878,20 @@ function createChangeReport(
             const previous = existingLock.sources.find(
               (candidate) => candidate.sourceId === source.sourceId
             )
+            const priorCatalog = existingCatalog?.sources.find(
+              (entry) => entry.sourceId === source.sourceId
+            )
+            const currentCatalog = catalog.sources.find(
+              (entry) => entry.sourceId === source.sourceId
+            )
             return (
               !previous ||
-              previous?.resolvedCommitSha !== source.resolvedCommitSha ||
-              previous.sourceManifestDigest !== source.sourceManifestDigest ||
-              digest(previous.pluginPins) !== digest(source.pluginPins)
+              sourceLockChanged(previous, source) ||
+              (existingCatalog !== undefined &&
+                (!priorCatalog ||
+                  !currentCatalog ||
+                  priorCatalog.displayName !== currentCatalog.displayName ||
+                  priorCatalog.trustClassification !== currentCatalog.trustClassification))
             )
           })()
         )
@@ -2015,17 +2030,19 @@ async function resolvePluginPins(input: {
       const resolvedCommitSha =
         entry.source.sha ??
         (input.resolveExternalRefs
-          ? await resolveGitRef(
-              repositoryUrl,
-              entry.source.ref?.startsWith('refs/')
-                ? entry.source.ref
-                : `refs/heads/${entry.source.ref ?? 'main'}`
-            )
+          ? await resolveGitRef(repositoryUrl, externalGitRef(entry.source.ref))
           : input.sourceCommitSha)
       return { pluginName: entry.name, repositoryUrl, pluginSubdirectory, resolvedCommitSha }
     }
   )
-  return pins.toSorted((left, right) => left.pluginName.localeCompare(right.pluginName))
+  return pins.toSorted((left, right) =>
+    left.pluginName < right.pluginName ? -1 : left.pluginName > right.pluginName ? 1 : 0
+  )
+}
+
+function externalGitRef(ref: string | undefined): string {
+  if (ref === undefined) return 'HEAD'
+  return ref.startsWith('refs/') ? ref : `refs/heads/${ref}`
 }
 
 async function mapWithConcurrency<T, U>(
@@ -2058,9 +2075,14 @@ async function readFixtureManifest(
 }
 
 async function resolveGitRef(repositoryUrl: string, ref: string): Promise<string> {
-  const result = spawn('git', ['ls-remote', canonicalRepositoryUrl(repositoryUrl), ref], {
-    stdio: ['ignore', 'pipe', 'pipe'],
-  })
+  const peeled = ref.startsWith('refs/tags/') && !ref.endsWith('^{}') ? `${ref}^{}` : undefined
+  const result = spawn(
+    'git',
+    ['ls-remote', canonicalRepositoryUrl(repositoryUrl), ref, ...(peeled ? [peeled] : [])],
+    {
+      stdio: ['ignore', 'pipe', 'pipe'],
+    }
+  )
   const [stdout, stderr, exitCode] = await Promise.all([
     new Promise<string>((resolveOutput, reject) => {
       const chunks: Buffer[] = []
@@ -2081,7 +2103,13 @@ async function resolveGitRef(repositoryUrl: string, ref: string): Promise<string
   ])
   if (exitCode !== 0)
     throw new Error(`GIT_REF_LOOKUP_FAILED: ${repositoryUrl}:${ref}:${stderr.trim()}`)
-  const sha = stdout.trim().split(/\s+/)[0]
+  const rows = stdout
+    .trim()
+    .split('\n')
+    .map((line) => line.split(/\s+/))
+  const sha =
+    (peeled && rows.find((row) => row[1] === peeled)?.[0]) ??
+    rows.find((row) => row[1] === ref)?.[0]
   if (!sha || !/^[a-f0-9]{40}$/.test(sha))
     throw new Error(`GIT_REF_NOT_FOUND: ${repositoryUrl}:${ref}`)
   return sha
@@ -2108,7 +2136,8 @@ function rawUrl(repositoryUrl: string, commitSha: string, path: string): string
 }
 
 async function fetchText(url: string): Promise<string> {
-  const response = await fetch(url, { headers: upstreamRequestHeaders(url) })
+  // Manifest requests use the same bounded retry policy as the tree and archive.
+  const response = await fetchUpstream(url, { headers: upstreamRequestHeaders(url) })
   if (!response.ok) throw new Error(`HTTP_FETCH_FAILED: ${response.status}:${url}`)
   return response.text()
 }

package/src/manifest-retry.test.ts

@@ -0,0 +1,49 @@
+import { readFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { expect, test } from 'bun:test'
+import { FixtureSnapshotLoader, synchronize } from './index.js'
+import { withPortableFixture } from '../test-support/portable-fixture.js'
+
+test('retries transient marketplace manifest responses while preserving permanent failures', () =>
+  withPortableFixture(async (input, root) => {
+    const initial = await synchronize(input)
+    const manifest = await readFile(join(root, 'fixtures/source/marketplace.json'), 'utf8')
+    const realFetch = globalThis.fetch
+    let calls = 0
+    try {
+      globalThis.fetch = (async () => {
+        calls++
+        if (calls < 3)
+          return new Response('temporarily unavailable', {
+            status: 503,
+            headers: { 'retry-after': '0' },
+          })
+        return new Response(manifest, { status: 200 })
+      }) as unknown as typeof fetch
+      const options = {
+        ...input,
+        mode: 'live' as const,
+        fromLock: initial.lock!,
+        snapshotLoader: new FixtureSnapshotLoader(input.fixtureRoot!, input.sources),
+      }
+      const recovered = await synchronize(options)
+      expect(recovered.catalog?.catalogId).toBe(initial.catalog?.catalogId)
+      expect(calls).toBe(3)
+      calls = 0
+      globalThis.fetch = (async () => {
+        calls++
+        return new Response('not found', { status: 404 })
+      }) as unknown as typeof fetch
+      await expect(synchronize(options)).rejects.toThrow('HTTP_FETCH_FAILED: 404')
+      expect(calls).toBe(1)
+      calls = 0
+      globalThis.fetch = (async () => {
+        calls++
+        return new Response('busy', { status: 429, headers: { 'retry-after': '0' } })
+      }) as unknown as typeof fetch
+      await expect(synchronize(options)).rejects.toThrow('HTTP_FETCH_FAILED: 429')
+      expect(calls).toBe(3)
+    } finally {
+      globalThis.fetch = realFetch
+    }
+  }))

package/src/publication.ts

@@ -9,9 +9,9 @@
  * that slot, so no version is ever the one a visitor sees first.
  *
  * The branch gives each catalog an immutable path — `catalogs/<catalogId>/…`,
- * where `catalogId` is the canonical digest of the catalog itself — so a
- * pinned URL is immutable by construction, exactly as a content-addressed
- * release tag was, and `raw.githubusercontent.com` serves it with permissive
+ * where `catalogId` is the canonical digest of the catalog itself. The
+ * publisher must reject replacement of existing snapshot bytes, and
+ * `raw.githubusercontent.com` serves the branch with permissive
  * CORS so a browser can fetch it directly.
  */
 
@@ -63,11 +63,9 @@ export interface StagedAssetAudit {
 /**
  * Audits the bytes this build staged against what it declared.
  *
- * A content-addressed path removes the comparison the release audit used to
- * perform: a snapshot published at `catalogs/<catalogId>/` can only hold this
- * catalog's bytes, because any different build has a different `catalogId` and
- * therefore a different path. What survives is the check that cannot be
- * delegated to the path — that the bytes exist here at all.
+ * This checks that the declared bytes exist here at all. Publication must
+ * separately compare the complete staged snapshot with any existing snapshot:
+ * companion artifacts can differ without changing the catalog identity.
  */
 export function auditStagedAssets(input: {
   readonly declared: readonly DeclaredAsset[]
@@ -95,9 +93,8 @@ export interface PublicationPlan {
 /**
  * The 64-hex digest a `catalog:<hex>` identity is addressed by.
  *
- * A catalog identity names its own bytes, so this is also what makes the
- * snapshot path immutable: any build that produced different content has a
- * different identity and cannot write over this one.
+ * A catalog identity names the catalog content. The publisher must also guard
+ * the snapshot path against changes to companion artifacts under the same ID.
  */
 export function catalogIdSuffix(catalogId: string): string {
   const match = /^catalog:([a-f0-9]{64})$/.exec(catalogId)

package/src/site-icons.test.ts

@@ -96,6 +96,68 @@ describe('site icon discovery', () => {
     ])
   })
 
+  test('resolves relative icon links against the first document base URL', () => {
+    const baseHtml = `<!-- <base href="https://ignored.example/"> <script> -->
+      <script>const sample = '<!-- <base href="https://script.example/">'</script>
+      <meta content="<base href='https://attribute.example/'>">
+      <base target="_blank"><base href="/assets/icons/">
+      <base href="https://later.example/">
+      <link rel="icon" href="mark.png">`
+    expect(discoverSiteIcons(baseHtml, 'https://vendor.example/docs/page')).toEqual([
+      'https://vendor.example/assets/icons/mark.png',
+      'https://vendor.example/favicon.ico',
+    ])
+  })
+
+  test('ignores bases and links inside text and template content', () => {
+    for (const inert of [
+      '<title><base href="https://title.example/"></title>',
+      '<textarea><base href="https://textarea.example/"></textarea>',
+      `<template><template><base href="https://nested.example/"></template>
+        <link rel="icon" href="https://template.example/icon.png"></template>`,
+    ]) {
+      expect(
+        discoverSiteIcons(
+          `${inert}<base href="/real/"><link rel="icon" href="mark.png">`,
+          'https://vendor.example/'
+        )
+      ).toEqual(['https://vendor.example/real/mark.png', 'https://vendor.example/favicon.ico'])
+    }
+  })
+
+  test('decodes HTML character references in URLs', () => {
+    expect(
+      discoverSiteIcons(
+        '<base href="/icons/?a=1&amp;b=2"><link rel="icon" href="mark.png?x=1&amp;y=2">',
+        'https://vendor.example/'
+      )
+    ).toEqual([
+      'https://vendor.example/icons/mark.png?x=1&y=2',
+      'https://vendor.example/favicon.ico',
+    ])
+  })
+
+  test('retains the homepage fallback and URL policy with a document base', () => {
+    expect(
+      discoverSiteIcons(
+        '<base href="https://cdn.example/icons/"><link rel="icon" href="mark.png">',
+        'https://vendor.example/docs/page'
+      )
+    ).toEqual(['https://cdn.example/icons/mark.png', 'https://vendor.example/favicon.ico'])
+    expect(
+      discoverSiteIcons(
+        '<base href="http://vendor.example/assets/"><link rel="icon" href="mark.png">',
+        'https://vendor.example/docs/page'
+      )
+    ).toEqual(['https://vendor.example/favicon.ico'])
+    expect(
+      discoverSiteIcons(
+        '<base href="http://["><base href="/later/"><link rel="icon" href="mark.png">',
+        'https://vendor.example/docs/page'
+      )
+    ).toEqual(['https://vendor.example/docs/mark.png', 'https://vendor.example/favicon.ico'])
+  })
+
   test('prefers the larger declared size within a group', () => {
     const sizes = `<link rel="icon" sizes="32x32" href="/small.png">
       <link rel="icon" sizes="512x512" href="/large.png">`
@@ -163,6 +225,17 @@ describe('site icon resolution', () => {
     expect(io.byteCalls).toEqual(['https://vendor.example/apple-icon.png'])
   })
 
+  test('fetches a relative icon from the document base', async () => {
+    const page = 'https://vendor.example/docs/page'
+    const baseHtml = '<head><base href="/assets/"><link rel="icon" href="mark.png"></head>'
+    const io = fetcher({ [page]: baseHtml, 'https://vendor.example/assets/mark.png': PNG })
+    expect(await resolveSiteIcon(page, io)).toMatchObject({
+      url: 'https://vendor.example/assets/mark.png',
+      homepage: page,
+    })
+    expect(io.byteCalls).toEqual(['https://vendor.example/assets/mark.png'])
+  })
+
   test('accepts an icon container and skips a candidate that fails inspection', async () => {
     const ico = fetcher({ [homepage]: html, 'https://vendor.example/apple-icon.png': ICO })
     expect(await resolveSiteIcon(homepage, ico)).toMatchObject({ contentType: 'image/x-icon' })

package/src/site-icons.ts

@@ -1,3 +1,4 @@
+import { parseFragment, type DefaultTreeAdapterTypes } from 'parse5'
 import { inspectIconBytes, MAX_ICON_BYTES, type IconContentType } from './icons.js'
 
 /**
@@ -76,19 +77,35 @@ export function isPublicHostname(hostname: string): boolean {
  * `apple-touch-icon` is preferred because it is a square PNG sized for a home
  * screen; declared `icon` links follow in declared order; `/favicon.ico` is the
  * conventional last resort when nothing is declared.
+ * Relative links use the document's first base href when present; the fallback
+ * stays on the homepage origin.
  */
 export function discoverSiteIcons(html: string, baseUrl: string): readonly string[] {
   const candidates: { href: string; rank: number }[] = []
-  const linkTags = html.match(/<link(?=[ \t\r\n\f/>])(?:"[^"]*"|'[^']*'|[^'">])*>/gi) ?? []
-  for (const tag of linkTags) {
-    const attributes = new Map<string, string>()
-    for (const attribute of tag.matchAll(
-      /\s+([^\s"'<>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'=<>`]+)))?/g
-    )) {
-      const name = attribute[1]!.toLowerCase()
-      if (!attributes.has(name))
-        attributes.set(name, attribute[2] ?? attribute[3] ?? attribute[4] ?? '')
+  const elements: DefaultTreeAdapterTypes.Element[] = []
+  const nodes: DefaultTreeAdapterTypes.ChildNode[] = parseFragment(html).childNodes.toReversed()
+  while (nodes.length > 0) {
+    const node = nodes.pop()!
+    if (!('tagName' in node)) continue
+    if (node.namespaceURI === 'http://www.w3.org/1999/xhtml') elements.push(node)
+    // Template contents are a separate, inert document fragment.
+    if (node.tagName !== 'template') nodes.push(...node.childNodes.toReversed())
+  }
+  let resolutionBase = baseUrl
+  for (const element of elements) {
+    if (element.tagName !== 'base') continue
+    const attributes = new Map(element.attrs.map(({ name, value }) => [name, value]))
+    if (!attributes.has('href')) continue
+    try {
+      resolutionBase = new URL(attributes.get('href')!, baseUrl).toString()
+    } catch {
+      // An invalid first base falls back to the document URL.
     }
+    break
+  }
+  for (const element of elements) {
+    if (element.tagName !== 'link') continue
+    const attributes = new Map(element.attrs.map(({ name, value }) => [name, value]))
     const rel = new Set((attributes.get('rel') ?? '').toLowerCase().split(/\s+/))
     if (
       !['apple-touch-icon', 'apple-touch-icon-precomposed', 'icon', 'mask-icon'].some((name) =>
@@ -112,7 +129,7 @@ export function discoverSiteIcons(html: string, baseUrl: string): readonly strin
   const resolved: { url: string; rank: number }[] = []
   for (const candidate of candidates.toSorted((left, right) => left.rank - right.rank)) {
     try {
-      const url = new URL(candidate.href, baseUrl)
+      const url = new URL(candidate.href, resolutionBase)
       if (url.protocol !== 'https:' || !isPublicHostname(url.hostname)) continue
       resolved.push({ url: url.toString(), rank: candidate.rank })
     } catch {

package/src/source-config-sync.test.ts

@@ -0,0 +1,84 @@
+import { copyFile } from 'node:fs/promises'
+import { join } from 'node:path'
+import { expect, test } from 'bun:test'
+import { synchronizePortable } from './portable-catalog.js'
+import { withPortableFixture } from '../test-support/portable-fixture.js'
+
+test('rebuilds and reports source metadata changes when source commits stay fixed', () =>
+  withPortableFixture(async (input, root) => {
+    const first = await synchronizePortable(input)
+    const old = input.sources[0]!
+    await copyFile(
+      join(root, 'fixtures/source/marketplace.json'),
+      join(root, 'fixtures/source/alternate.json')
+    )
+    const cases = [
+      { ...old, displayName: 'Renamed source' },
+      { ...old, defaultBranch: 'stable' },
+      { ...old, manifestPath: 'alternate.json' },
+      { ...old, marketplaceDialect: 'openai' as const },
+    ]
+    for (const source of cases) {
+      const result = await synchronizePortable({
+        ...input,
+        sources: [source],
+        existingLock: first.lock!,
+        existingCatalog: first.catalog!,
+      })
+      expect(result.changed).toBe(true)
+      expect(result.changeReport.changedSources).toContain(source.sourceId)
+      expect(result.catalog?.sources[0]?.displayName).toBe(source.displayName)
+      expect(result.lock?.sources[0]?.defaultBranch).toBe(source.defaultBranch)
+      expect(result.lock?.sources[0]?.manifestPath).toBe(source.manifestPath)
+      expect(result.lock?.sources[0]?.marketplaceDialect).toBe(source.marketplaceDialect)
+      const repeated = await synchronizePortable({
+        ...input,
+        sources: [source],
+        existingLock: result.lock!,
+        existingCatalog: result.catalog!,
+      })
+      expect(repeated.changed).toBe(false)
+    }
+    const equivalent = await synchronizePortable({
+      ...input,
+      sources: [{ ...old, repositoryUrl: `${old.repositoryUrl}.git` }],
+      existingLock: first.lock!,
+      existingCatalog: first.catalog!,
+    })
+    expect(equivalent.changed).toBe(false)
+  }))
+
+test('rebuilds if the marketplace repository changes while external plugin pins stay equal', () =>
+  withPortableFixture(async (input, root) => {
+    const { writeFile } = await import('node:fs/promises')
+    await writeFile(
+      join(root, 'fixtures/source/marketplace.json'),
+      JSON.stringify({
+        plugins: [
+          { name: 'remote', source: { source: 'git', url: 'https://github.com/example/external' } },
+        ],
+      })
+    )
+    const snapshotLoader = {
+      load: async () => ({
+        files: new Map([['plugin.json', new TextEncoder().encode('{"name":"Remote"}')]]),
+        symlinks: [],
+      }),
+    }
+    const options = { ...input, snapshotLoader }
+    const first = await synchronizePortable(options)
+    const source = {
+      ...input.sources[0]!,
+      repositoryUrl: 'https://github.com/example/moved-marketplace',
+    }
+    const result = await synchronizePortable({
+      ...options,
+      sources: [source],
+      existingLock: first.lock!,
+    })
+    expect(result.changed).toBe(true)
+    expect(result.lock?.sources[0]?.repositoryUrl).toBe(source.repositoryUrl)
+    expect(result.catalog?.sources[0]?.repositoryUrl).toBe(source.repositoryUrl)
+    expect(result.changeReport.changedSources).toEqual([source.sourceId])
+    expect(result.lock?.sources[0]?.pluginPins).toEqual(first.lock?.sources[0]?.pluginPins)
+  }))

package/src/source-digest.test.ts

@@ -1,4 +1,4 @@
-import { mkdtemp, rm, writeFile } from 'node:fs/promises'
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
 import { spawnSync } from 'node:child_process'
 import { pathToFileURL } from 'node:url'
@@ -42,3 +42,60 @@ test('source digests agree across consumer locales and equivalent Unicode path o
     await rm(directory, { recursive: true, force: true })
   }
 })
+
+test('source lock identity is independent of the consumer locale', async () => {
+  const directory = await mkdtemp(join(import.meta.dirname, '.source-lock-'))
+  try {
+    const source = join(directory, 'fixture', 'source')
+    await mkdir(source, { recursive: true })
+    await writeFile(
+      join(source, 'marketplace.json'),
+      JSON.stringify({
+        plugins: [
+          { name: 'a-plugin', source: './a' },
+          { name: 'ä-plugin', source: './u' },
+          { name: 'z-plugin', source: './z' },
+        ],
+      })
+    )
+    const entry = join(directory, 'entry.ts')
+    const output = join(directory, 'consumer.mjs')
+    await writeFile(entry, "export { synchronize } from '../index.ts'\n")
+    const build = await Bun.build({ entrypoints: [entry], target: 'node', packages: 'external' })
+    expect(build.success).toBe(true)
+    await Bun.write(output, build.outputs[0]!)
+    const script = `
+      import { synchronize } from ${JSON.stringify(pathToFileURL(output).href)};
+      const result = await synchronize({
+        mode: 'offline', fixtureRoot: ${JSON.stringify(join(directory, 'fixture'))},
+        sources: [{sourceId:'test-source',displayName:'Test',marketplaceDialect:'claude',
+          repositoryUrl:'https://github.com/example/plugins',manifestPath:'marketplace.json',
+          defaultBranch:'main',trustClassification:'official',fixturePath:'source',
+          fixtureCommitSha:'a'.repeat(40)}],
+        categoryMap:{aliases:{},fallback:'other'},productAliases:{aliases:{}},
+        policy:{allowedRepositoryProtocols:['https:'],allowedRepositoryHosts:['github.com'],
+          maxFilesPerPlugin:100,maxBytesPerPlugin:100000,maxFileBytes:20000,
+          maxMarketplacePlugins:100,denyExecutableLifecycleScripts:true,
+          publishRequiresCompleteContent:false,sensitiveCapabilityTypes:[]},metadataOnly:true
+      });
+      console.log(JSON.stringify({lockId:result.lock.lockId,pins:result.lock.sources[0].pluginPins}));
+    `
+    const results = ['en_US.UTF-8', 'sv_SE.UTF-8'].map((locale) => {
+      const result = spawnSync('node', ['--input-type=module', '-e', script], {
+        encoding: 'utf8',
+        env: { ...process.env, LANG: locale, LC_ALL: locale },
+      })
+      if (result.error) throw result.error
+      if (result.status !== 0) throw new Error(result.stderr)
+      return JSON.parse(result.stdout) as { lockId: string; pins: { pluginName: string }[] }
+    })
+    expect(results[0]).toEqual(results[1])
+    expect(results[0]!.pins.map((pin) => pin.pluginName)).toEqual([
+      'a-plugin',
+      'z-plugin',
+      'ä-plugin',
+    ])
+  } finally {
+    await rm(directory, { recursive: true, force: true })
+  }
+})

package/src/sources-json.test.ts

@@ -1,5 +1,5 @@
 import { describe, expect, test } from 'bun:test'
-import { parseJsonDocument } from './sources.js'
+import { parseJsonDocument, parseMarketplaceManifest, type SourceConfig } from './sources.js'
 
 describe('JSON document whitespace', () => {
   test('accepts the four JSON whitespace characters around nested values', () => {
@@ -34,3 +34,20 @@ describe('JSON document whitespace', () => {
     expect(() => parseJsonDocument('{"name":1,"na\\u006de":2}')).toThrow('JSON_DUPLICATE_KEY')
   })
 })
+
+test('sorts marketplace metadata independently of the host locale', () => {
+  const source: SourceConfig = {
+    sourceId: 'test',
+    displayName: 'Test',
+    repositoryUrl: 'https://github.com/example/plugins',
+    marketplaceDialect: 'openai',
+    manifestPath: 'marketplace.json',
+    defaultBranch: 'main',
+    trustClassification: 'official',
+  }
+  const parsed = parseMarketplaceManifest(
+    { plugins: [{ name: 'test', source: './test', keywords: ['ä', 'z', 'a', 'ä'] }] },
+    source
+  )
+  expect(parsed.entries[0]?.keywords).toEqual(['a', 'z', 'ä'])
+})

package/src/sources.ts

@@ -312,7 +312,7 @@ function isString(input: unknown): input is string {
 
 function uniqueStrings(input: readonly string[]): string[] {
   return [...new Set(input.map((value) => value.trim()).filter(Boolean))].toSorted((a, b) =>
-    a.localeCompare(b)
+    a < b ? -1 : a > b ? 1 : 0
   )
 }