@adea-ai/plugins 4.0.0 → 4.0.6

package/dist/synchronize.d.ts

@@ -0,0 +1,44 @@
+import { type ConsumerIndexOptions, type GeneratedArtifacts } from './artifacts.js';
+import { type BuildCatalogInput } from './build.js';
+import type { SkippedPlugin } from './plugin-skips.js';
+import type { CatalogPolicy } from './policy.js';
+import type { Catalog, SourcesLock } from './schema.js';
+import { type SnapshotLoader } from './snapshots.js';
+import type { SourceConfig } from './sources.js';
+export interface SyncInput extends ConsumerIndexOptions, Omit<BuildCatalogInput, 'resolvedSources' | 'snapshotLoader' | 'resolveExternalRefs'> {
+    readonly sources: readonly SourceConfig[];
+    readonly policy: CatalogPolicy;
+    readonly mode?: 'live' | 'offline';
+    readonly fixtureRoot?: string;
+    readonly sourceId?: string;
+    readonly dryRun?: boolean;
+    readonly existingLock?: SourcesLock;
+    readonly existingCatalog?: Catalog;
+    readonly fromLock?: SourcesLock;
+    readonly snapshotLoader?: SnapshotLoader;
+    /** Rebuild even when source pins are unchanged (used for explicit format migrations). */
+    readonly forceRebuild?: boolean;
+}
+export interface SyncResult {
+    readonly changed: boolean;
+    readonly dryRun: boolean;
+    readonly sourceHeads: readonly {
+        sourceId: string;
+        commitSha: string;
+    }[];
+    readonly catalog?: Catalog;
+    readonly lock?: SourcesLock;
+    readonly artifacts?: GeneratedArtifacts;
+    readonly changeReport: ChangeReport;
+}
+export interface ChangeReport {
+    readonly schemaVersion: 1;
+    readonly changedSources: readonly string[];
+    readonly addedPlugins: readonly string[];
+    readonly removedPlugins: readonly string[];
+    readonly changedPlugins: readonly string[];
+    readonly permissionSensitiveChanges: readonly string[];
+    readonly skippedPlugins: readonly SkippedPlugin[];
+    readonly contentResolution: 'complete' | 'complete-with-skips' | 'metadata-only';
+}
+export declare function synchronize(input: SyncInput): Promise<SyncResult>;

package/dist/synchronize.js

@@ -0,0 +1,118 @@
+import { createArtifacts } from './artifacts.js';
+import { buildCatalogInternal } from './build.js';
+import { mapWithConcurrency } from './concurrency.js';
+import { digest } from './digest.js';
+import { FixtureSnapshotLoader, NetworkSnapshotLoader } from './snapshots.js';
+import { createSourcesLock, resolveSource, sourceLockChanged } from './source-resolution.js';
+import { verifyArtifacts } from './verify-artifacts.js';
+export async function synchronize(input) {
+    const mode = input.mode ?? 'live';
+    const configs = input.sources.filter((source) => !input.sourceId || source.sourceId === input.sourceId);
+    if (configs.length === 0)
+        throw new Error(`SOURCE_NOT_FOUND: ${input.sourceId ?? 'none'}`);
+    const lockToUse = input.fromLock ?? input.existingLock;
+    const resolved = await mapWithConcurrency(configs, 4, (config) => resolveSource(config, mode, input.fixtureRoot, lockToUse, input.fromLock !== undefined));
+    const sourceHeads = resolved.map(({ config, commitSha }) => ({
+        sourceId: config.sourceId,
+        commitSha,
+    }));
+    const lock = createSourcesLock(resolved);
+    const unchanged = input.fromLock === undefined &&
+        input.forceRebuild !== true &&
+        input.existingLock !== undefined &&
+        resolved.length === input.existingLock.sources.length &&
+        lock.sources.every((source) => !sourceChanged(source, resolved.find((entry) => entry.config.sourceId === source.sourceId)?.config, input.existingLock, input.existingCatalog));
+    if (unchanged) {
+        return {
+            changed: false,
+            dryRun: input.dryRun ?? false,
+            sourceHeads,
+            changeReport: {
+                schemaVersion: 1,
+                changedSources: [],
+                addedPlugins: [],
+                removedPlugins: [],
+                changedPlugins: [],
+                permissionSensitiveChanges: [],
+                skippedPlugins: [],
+                contentResolution: input.metadataOnly ? 'metadata-only' : 'complete',
+            },
+        };
+    }
+    const { catalog, skippedPlugins } = await buildCatalogInternal({
+        ...input,
+        resolvedSources: resolved,
+        snapshotLoader: input.snapshotLoader ??
+            (mode === 'offline'
+                ? new FixtureSnapshotLoader(input.fixtureRoot ?? 'fixtures', configs)
+                : new NetworkSnapshotLoader(input.policy)),
+        resolveExternalRefs: mode === 'live',
+    });
+    // An offline build replays fixtures, so its curation findings are noise.
+    const artifacts = createArtifacts(catalog, lock, {
+        ...input,
+        curationDiagnostics: mode !== 'offline',
+    });
+    verifyArtifacts(artifacts);
+    const report = createChangeReport(catalog, lock, input.existingLock, input.existingCatalog, skippedPlugins);
+    if (input.policy.publishRequiresCompleteContent && input.metadataOnly) {
+        throw new Error('CATALOG_CONTENT_INCOMPLETE: publication requires complete content');
+    }
+    return {
+        changed: true,
+        dryRun: input.dryRun ?? false,
+        sourceHeads,
+        catalog,
+        lock,
+        artifacts,
+        changeReport: report,
+    };
+}
+/** Whether a source differs from the last published lock and catalog. */
+function sourceChanged(source, current, existingLock, existingCatalog) {
+    const previous = existingLock?.sources.find((entry) => entry.sourceId === source.sourceId);
+    if (!previous || sourceLockChanged(previous, source))
+        return true;
+    if (!existingCatalog)
+        return false;
+    const prior = existingCatalog.sources.find((entry) => entry.sourceId === source.sourceId);
+    return (!prior ||
+        !current ||
+        prior.displayName !== current.displayName ||
+        prior.trustClassification !== current.trustClassification);
+}
+function createChangeReport(catalog, lock, existingLock, existingCatalog, skippedPlugins = []) {
+    const changedSources = lock.sources
+        .filter((source) => existingLock === undefined ||
+        sourceChanged(source, catalog.sources.find((entry) => entry.sourceId === source.sourceId), existingLock, existingCatalog))
+        .map((source) => source.sourceId);
+    const previousPlugins = new Map(existingCatalog?.plugins.map((plugin) => [plugin.pluginId, plugin]) ?? []);
+    const currentPlugins = new Map(catalog.plugins.map((plugin) => [plugin.pluginId, plugin]));
+    const addedPlugins = catalog.plugins
+        .filter((plugin) => !previousPlugins.has(plugin.pluginId))
+        .map((plugin) => plugin.pluginId);
+    const removedPlugins = [...previousPlugins.keys()].filter((pluginId) => !currentPlugins.has(pluginId));
+    const changedPlugins = catalog.plugins
+        .filter((plugin) => {
+        const previous = previousPlugins.get(plugin.pluginId);
+        return previous !== undefined && digest(previous) !== digest(plugin);
+    })
+        .map((plugin) => plugin.pluginId);
+    return {
+        schemaVersion: 1,
+        changedSources: changedSources.toSorted(),
+        addedPlugins: addedPlugins.toSorted(),
+        removedPlugins: removedPlugins.toSorted(),
+        changedPlugins: changedPlugins.toSorted(),
+        skippedPlugins,
+        permissionSensitiveChanges: catalog.plugins
+            .flatMap((plugin) => plugin.securityClassification.permissionSensitiveChanges.map((type) => `${plugin.pluginId}:${type}`))
+            .toSorted(),
+        contentResolution: skippedPlugins.length > 0
+            ? 'complete-with-skips'
+            : catalog.plugins.some((plugin) => plugin.securityClassification.contentResolution === 'metadata-only')
+                ? 'metadata-only'
+                : 'complete',
+    };
+}
+//# sourceMappingURL=synchronize.js.map

package/dist/synchronize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"synchronize.js","sourceRoot":"","sources":["../src/synchronize.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAsD,MAAM,gBAAgB,CAAA;AACpG,OAAO,EAAE,oBAAoB,EAA0B,MAAM,YAAY,CAAA;AACzE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACrD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAIpC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAuB,MAAM,gBAAgB,CAAA;AAClG,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAA;AAE5F,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAyCvD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAgB;IAChD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,MAAM,CAAA;IACjC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAClC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,CAClE,CAAA;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,CAAC,QAAQ,IAAI,MAAM,EAAE,CAAC,CAAA;IAC1F,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,YAAY,CAAA;IACtD,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAC/D,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CACxF,CAAA;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3D,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS;KACV,CAAC,CAAC,CAAA;IACH,MAAM,IAAI,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAA;IACxC,MAAM,SAAS,GACb,KAAK,CAAC,QAAQ,KAAK,SAAS;QAC5B,KAAK,CAAC,YAAY,KAAK,IAAI;QAC3B,KAAK,CAAC,YAAY,KAAK,SAAS;QAChC,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM;QACrD,IAAI,CAAC,OAAO,CAAC,KAAK,CAChB,CAAC,MAAM,EAAE,EAAE,CACT,CAAC,aAAa,CACZ,MAAM,EACN,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EAAE,MAAM,EAC3E,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,eAAe,CACtB,CACJ,CAAA;IACH,IAAI,SAAS,EAAE,CAAC;QACd,OAAO;YACL,OAAO,EAAE,KAAK;YACd,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK;YAC7B,WAAW;YACX,YAAY,EAAE;gBACZ,aAAa,EAAE,CAAC;gBAChB,cAAc,EAAE,EAAE;gBAClB,YAAY,EAAE,EAAE;gBAChB,cAAc,EAAE,EAAE;gBAClB,cAAc,EAAE,EAAE;gBAClB,0BAA0B,EAAE,EAAE;gBAC9B,cAAc,EAAE,EAAE;gBAClB,iBAAiB,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,UAAU;aACrE;SACF,CAAA;IACH,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,oBAAoB,CAAC;QAC7D,GAAG,KAAK;QACR,eAAe,EAAE,QAAQ;QACzB,cAAc,EACZ,KAAK,CAAC,cAAc;YACpB,CAAC,IAAI,KAAK,SAAS;gBACjB,CAAC,CAAC,IAAI,qBAAqB,CAAC,KAAK,CAAC,WAAW,IAAI,UAAU,EAAE,OAAO,CAAC;gBACrE,CAAC,CAAC,IAAI,qBAAqB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC9C,mBAAmB,EAAE,IAAI,KAAK,MAAM;KACrC,CAAC,CAAA;IACF,yEAAyE;IACzE,MAAM,SAAS,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,EAAE;QAC/C,GAAG,KAAK;QACR,mBAAmB,EAAE,IAAI,KAAK,SAAS;KACxC,CAAC,CAAA;IACF,eAAe,CAAC,SAAS,CAAC,CAAA;IAC1B,MAAM,MAAM,GAAG,kBAAkB,CAC/B,OAAO,EACP,IAAI,EACJ,KAAK,CAAC,YAAY,EAClB,KAAK,CAAC,eAAe,EACrB,cAAc,CACf,CAAA;IACD,IAAI,KAAK,CAAC,MAAM,CAAC,8BAA8B,IAAI,KAAK,CAAC,YAAY,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAA;IACtF,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,KAAK;QAC7B,WAAW;QACX,OAAO;QACP,IAAI;QACJ,SAAS;QACT,YAAY,EAAE,MAAM;KACrB,CAAA;AACH,CAAC;AAED,yEAAyE;AACzE,SAAS,aAAa,CACpB,MAAuB,EACvB,OAA+E,EAC/E,YAAqC,EACrC,eAAoC;IAEpC,MAAM,QAAQ,GAAG,YAAY,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAA;IAC1F,IAAI,CAAC,QAAQ,IAAI,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IACjE,IAAI,CAAC,eAAe;QAAE,OAAO,KAAK,CAAA;IAClC,MAAM,KAAK,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAA;IACzF,OAAO,CACL,CAAC,KAAK;QACN,CAAC,OAAO;QACR,KAAK,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW;QACzC,KAAK,CAAC,mBAAmB,KAAK,OAAO,CAAC,mBAAmB,CAC1D,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,OAAgB,EAChB,IAAiB,EACjB,YAA0B,EAC1B,eAAyB,EACzB,cAAc,GAA6B,EAAE;IAE7C,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO;SAChC,MAAM,CACL,CAAC,MAAM,EAAE,EAAE,CACT,YAAY,KAAK,SAAS;QAC1B,aAAa,CACX,MAAM,EACN,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,EACnE,YAAY,EACZ,eAAe,CAChB,CACJ;SACA,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,eAAe,GAAG,IAAI,GAAG,CAC7B,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAC1E,CAAA;IACD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAA;IAC1F,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO;SACjC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;SACzD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACnC,MAAM,cAAc,GAAG,CAAC,GAAG,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CACvD,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,QAAQ,CAAC,CAC5C,CAAA;IACD,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO;SACnC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;QACjB,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;QACrD,OAAO,QAAQ,KAAK,SAAS,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAA;IACtE,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;IACnC,OAAO;QACL,aAAa,EAAE,CAAC;QAChB,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;QACzC,YAAY,EAAE,YAAY,CAAC,QAAQ,EAAE;QACrC,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;QACzC,cAAc,EAAE,cAAc,CAAC,QAAQ,EAAE;QACzC,cAAc;QACd,0BAA0B,EAAE,OAAO,CAAC,OAAO;aACxC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAClB,MAAM,CAAC,sBAAsB,CAAC,0BAA0B,CAAC,GAAG,CAC1D,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,EAAE,CACvC,CACF;aACA,QAAQ,EAAE;QACb,iBAAiB,EACf,cAAc,CAAC,MAAM,GAAG,CAAC;YACvB,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAChB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,iBAAiB,KAAK,eAAe,CAChF;gBACH,CAAC,CAAC,eAAe;gBACjB,CAAC,CAAC,UAAU;KACnB,CAAA;AACH,CAAC"}

package/dist/taxonomy.d.ts

@@ -0,0 +1,23 @@
+export interface CategoryMap {
+    readonly aliases: Readonly<Record<string, string>>;
+    readonly fallback: string;
+}
+export interface ProductAliases {
+    readonly aliases: Readonly<Record<string, string>>;
+}
+export declare function stablePluginId(sourceId: string, upstreamName: string): string;
+export declare function stableReleaseId(repositoryUrl: string, subdirectory: string, commitSha: string, contentDigest: string): string;
+export declare function normalizeCategory(value: string, map: CategoryMap): string;
+export declare function productGroupingKey(name: string, aliases: ProductAliases): string;
+/**
+ * Orders plugins so each category's curated leading products come first, in
+ * the configured order. Consumers preview the head of each category, so this
+ * ordering decides what users see before expanding.
+ */
+export declare function orderLeadingPlugins<T extends {
+    readonly plugins: readonly {
+        categories: readonly string[];
+        upstreamPluginName: string;
+    }[];
+}>(catalog: T, leading?: Record<string, readonly string[]>): T;
+export declare function slug(value: string): string;

package/dist/taxonomy.js

@@ -0,0 +1,62 @@
+import { contentId } from './digest.js';
+export function stablePluginId(sourceId, upstreamName) {
+    return `plugin:${slug(sourceId)}:${slug(upstreamName)}`;
+}
+export function stableReleaseId(repositoryUrl, subdirectory, commitSha, contentDigest) {
+    return contentId('release', { repositoryUrl, subdirectory, commitSha, contentDigest });
+}
+export function normalizeCategory(value, map) {
+    const key = value.trim().toLocaleLowerCase();
+    return map.aliases[key] ?? (slug(key) || map.fallback);
+}
+export function productGroupingKey(name, aliases) {
+    const key = name.trim().toLocaleLowerCase();
+    return aliases.aliases[key] ?? slug(key);
+}
+/**
+ * Orders plugins so each category's curated leading products come first, in
+ * the configured order. Consumers preview the head of each category, so this
+ * ordering decides what users see before expanding.
+ */
+export function orderLeadingPlugins(catalog, leading) {
+    if (!leading)
+        return catalog;
+    const leadRank = new Map();
+    for (const [category, names] of Object.entries(leading)) {
+        names.forEach((name, index) => {
+            const key = `${category}::${name}`;
+            if (!leadRank.has(key))
+                leadRank.set(key, index);
+        });
+    }
+    const rank = (plugin) => {
+        let best = Number.POSITIVE_INFINITY;
+        for (const category of plugin.categories) {
+            const value = leadRank.get(`${category}::${plugin.upstreamPluginName}`);
+            if (value !== undefined && value < best)
+                best = value;
+        }
+        return best;
+    };
+    return {
+        ...catalog,
+        plugins: catalog.plugins.toSorted((left, right) => rank(left) - rank(right)),
+    };
+}
+function trimSlugEdges(value) {
+    let start = 0;
+    let end = value.length;
+    while (start < end && value[start] === '-')
+        start += 1;
+    while (end > start && value[end - 1] === '-')
+        end -= 1;
+    return value.slice(start, end);
+}
+export function slug(value) {
+    const result = trimSlugEdges(value
+        .trim()
+        .toLocaleLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')).slice(0, 128) || 'unknown';
+    return result.length < 2 ? `${result}-plugin` : result;
+}
+//# sourceMappingURL=taxonomy.js.map

package/dist/taxonomy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"taxonomy.js","sourceRoot":"","sources":["../src/taxonomy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAWvC,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,YAAoB;IACnE,OAAO,UAAU,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,EAAE,CAAA;AACzD,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,aAAqB,EACrB,YAAoB,EACpB,SAAiB,EACjB,aAAqB;IAErB,OAAO,SAAS,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAA;AACxF,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,GAAgB;IAC/D,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,iBAAiB,EAAE,CAAA;IAC5C,OAAO,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;AACxD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,OAAuB;IACtE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,iBAAiB,EAAE,CAAA;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAA;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAOjC,OAAU,EAAE,OAA2C;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAA;IAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAA;IAC1C,KAAK,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,GAAG,QAAQ,KAAK,IAAI,EAAE,CAAA;YAClC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAClD,CAAC,CAAC,CAAA;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAA4B,EAAU,EAAE;QACpD,IAAI,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAA;QACnC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,QAAQ,KAAK,MAAM,CAAC,kBAAkB,EAAE,CAAC,CAAA;YACvE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,GAAG,IAAI;gBAAE,IAAI,GAAG,KAAK,CAAA;QACvD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC,CAAA;IACD,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;KAC7E,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,GAAG,GAAG,KAAK,CAAC,MAAM,CAAA;IACtB,OAAO,KAAK,GAAG,GAAG,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG;QAAE,KAAK,IAAI,CAAC,CAAA;IACtD,OAAO,GAAG,GAAG,KAAK,IAAI,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG;QAAE,GAAG,IAAI,CAAC,CAAA;IACtD,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;AAChC,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,MAAM,MAAM,GACV,aAAa,CACX,KAAK;SACF,IAAI,EAAE;SACN,iBAAiB,EAAE;SACnB,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAC/B,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,SAAS,CAAA;IAC9B,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,MAAM,CAAA;AACxD,CAAC"}

package/dist/upstream.d.ts

@@ -0,0 +1,42 @@
+import type { SiteIconFetcher } from './site-icons.js';
+export declare function externalGitRef(ref: string | undefined): string;
+export declare function resolveGitRef(repositoryUrl: string, ref: string): Promise<string>;
+export declare function fetchUpstreamBytes(url: string, signal?: AbortSignal): Promise<Uint8Array>;
+export declare function rawContentUrl(repositoryUrl: string, commitSha: string, path: string): string;
+export declare function fetchText(url: string): Promise<string>;
+/**
+ * Hosts that may receive the repository credential.
+ *
+ * Everything else is fetched anonymously. The token this build runs with
+ * authorises repository writes for the duration of the job, so a vendor
+ * homepage, its icon CDN or any other third party must never be handed it.
+ */
+/** The hosts the network snapshot loader reads repositories from. */
+export declare const GITHUB_REPOSITORY_HOSTS: readonly string[];
+/**
+ * Request headers for one upstream URL.
+ *
+ * The credential and GitHub's media type are attached only for GitHub hosts.
+ * Sending them elsewhere is not merely a needless disclosure: `appwrite.io`
+ * answers a page carrying an `Authorization` header with HTTP 500, and a CDN
+ * asked for an image with `accept: application/vnd.github+json` can answer with
+ * bytes that are not the mark. A build that did this dropped marks it had
+ * already curated, and the curation verifier — which used its own anonymous
+ * headers — could not see it.
+ */
+export declare function upstreamRequestHeaders(url: string): Record<string, string>;
+/**
+ * Fetches vendor-site documents exactly as a live build does.
+ *
+ * Shared with the curation verifier so both ask a vendor the same question: a
+ * verifier with its own headers reports sites healthy that the build then fails
+ * to resolve.
+ *
+ * `deadline` optionally bounds one product's whole resolution. The per-request
+ * ceiling is always created fresh inside each fetch, so a caller that passes a
+ * deadline — or shares one — can never hand later requests an already-expired
+ * signal.
+ */
+export declare function createSiteIconFetcher(deadline?: AbortSignal): SiteIconFetcher;
+export declare const SITE_FETCH_TIMEOUT_MS = 15000;
+export declare function fetchUpstream(url: string, init: RequestInit): Promise<Response>;

package/dist/upstream.js

@@ -0,0 +1,179 @@
+import { spawn } from 'node:child_process';
+import { setTimeout as sleep } from 'node:timers/promises';
+import { canonicalRepositoryUrl } from './sources.js';
+export function externalGitRef(ref) {
+    if (ref === undefined)
+        return 'HEAD';
+    return ref.startsWith('refs/') ? ref : `refs/heads/${ref}`;
+}
+export async function resolveGitRef(repositoryUrl, ref) {
+    const peeled = ref.startsWith('refs/tags/') && !ref.endsWith('^{}') ? `${ref}^{}` : undefined;
+    const result = spawn('git', ['ls-remote', canonicalRepositoryUrl(repositoryUrl), ref, ...(peeled ? [peeled] : [])], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const [stdout, stderr, exitCode] = await Promise.all([
+        new Promise((resolveOutput, reject) => {
+            const chunks = [];
+            result.stdout?.on('data', (chunk) => chunks.push(chunk));
+            result.stdout?.on('error', reject);
+            result.stdout?.on('end', () => resolveOutput(Buffer.concat(chunks).toString('utf8')));
+        }),
+        new Promise((resolveError) => {
+            const chunks = [];
+            result.stderr?.on('data', (chunk) => chunks.push(chunk));
+            result.stderr?.on('error', () => resolveError(''));
+            result.stderr?.on('end', () => resolveError(Buffer.concat(chunks).toString('utf8')));
+        }),
+        new Promise((resolveExit, reject) => {
+            result.on('error', reject);
+            result.on('close', (code) => resolveExit(code ?? 1));
+        }),
+    ]);
+    if (exitCode !== 0)
+        throw new Error(`GIT_REF_LOOKUP_FAILED: ${repositoryUrl}:${ref}:${stderr.trim()}`);
+    const rows = stdout
+        .trim()
+        .split('\n')
+        .map((line) => line.split(/\s+/));
+    const sha = (peeled && rows.find((row) => row[1] === peeled)?.[0]) ??
+        rows.find((row) => row[1] === ref)?.[0];
+    if (!sha || !/^[a-f0-9]{40}$/.test(sha))
+        throw new Error(`GIT_REF_NOT_FOUND: ${repositoryUrl}:${ref}`);
+    return sha;
+}
+export async function fetchUpstreamBytes(url, signal) {
+    const response = await fetchUpstream(url, {
+        headers: upstreamRequestHeaders(url),
+        ...(signal ? { signal } : {}),
+    });
+    if (!response.ok)
+        throw new Error(`HTTP_FETCH_FAILED: ${response.status}: ${url}`);
+    return new Uint8Array(await response.arrayBuffer());
+}
+export function rawContentUrl(repositoryUrl, commitSha, path) {
+    const parsed = new URL(canonicalRepositoryUrl(repositoryUrl));
+    return `https://raw.githubusercontent.com${parsed.pathname}/${commitSha}/${path.split('/').map(encodeURIComponent).join('/')}`;
+}
+export async function fetchText(url) {
+    const response = await fetchUpstream(url, { headers: upstreamRequestHeaders(url) });
+    if (!response.ok)
+        throw new Error(`HTTP_FETCH_FAILED: ${response.status}:${url}`);
+    return response.text();
+}
+const UPSTREAM_USER_AGENT = 'agent-hq-plugin-marketplace';
+/**
+ * Hosts that may receive the repository credential.
+ *
+ * Everything else is fetched anonymously. The token this build runs with
+ * authorises repository writes for the duration of the job, so a vendor
+ * homepage, its icon CDN or any other third party must never be handed it.
+ */
+/** The hosts the network snapshot loader reads repositories from. */
+export const GITHUB_REPOSITORY_HOSTS = ['github.com', 'www.github.com'];
+const GITHUB_CREDENTIAL_HOSTS = /(^|\.)(github\.com|githubusercontent\.com)$/;
+/**
+ * Request headers for one upstream URL.
+ *
+ * The credential and GitHub's media type are attached only for GitHub hosts.
+ * Sending them elsewhere is not merely a needless disclosure: `appwrite.io`
+ * answers a page carrying an `Authorization` header with HTTP 500, and a CDN
+ * asked for an image with `accept: application/vnd.github+json` can answer with
+ * bytes that are not the mark. A build that did this dropped marks it had
+ * already curated, and the curation verifier — which used its own anonymous
+ * headers — could not see it.
+ */
+export function upstreamRequestHeaders(url) {
+    const anonymous = { 'user-agent': UPSTREAM_USER_AGENT };
+    let host;
+    try {
+        host = new URL(url).hostname.toLowerCase();
+    }
+    catch {
+        return anonymous;
+    }
+    const token = process.env.GITHUB_TOKEN ?? process.env.GH_TOKEN;
+    if (!token || !GITHUB_CREDENTIAL_HOSTS.test(host))
+        return anonymous;
+    return {
+        accept: 'application/vnd.github+json',
+        authorization: `Bearer ${token}`,
+        'user-agent': UPSTREAM_USER_AGENT,
+    };
+}
+/**
+ * Fetches vendor-site documents exactly as a live build does.
+ *
+ * Shared with the curation verifier so both ask a vendor the same question: a
+ * verifier with its own headers reports sites healthy that the build then fails
+ * to resolve.
+ *
+ * `deadline` optionally bounds one product's whole resolution. The per-request
+ * ceiling is always created fresh inside each fetch, so a caller that passes a
+ * deadline — or shares one — can never hand later requests an already-expired
+ * signal.
+ */
+export function createSiteIconFetcher(deadline) {
+    const bounded = () => {
+        const ceiling = AbortSignal.timeout(SITE_FETCH_TIMEOUT_MS);
+        return deadline ? AbortSignal.any([deadline, ceiling]) : ceiling;
+    };
+    return {
+        fetchText: async (url) => new TextDecoder().decode(await fetchUpstreamBytes(url, bounded())),
+        fetchBytes: (url) => fetchUpstreamBytes(url, bounded()),
+    };
+}
+export const SITE_FETCH_TIMEOUT_MS = 15_000;
+const UPSTREAM_FETCH_MAX_ATTEMPTS = 3;
+const UPSTREAM_FETCH_BASE_DELAY_MS = 1000;
+const UPSTREAM_FETCH_MAX_DELAY_MS = 30000;
+function upstreamRetryDelayMs(attempt, response) {
+    const retryAfter = response?.headers.get('retry-after');
+    if (retryAfter !== null && retryAfter !== undefined) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds) && seconds >= 0)
+            return Math.min(seconds * 1000, UPSTREAM_FETCH_MAX_DELAY_MS);
+        const date = Date.parse(retryAfter);
+        if (!Number.isNaN(date))
+            return Math.min(Math.max(date - Date.now(), 0), UPSTREAM_FETCH_MAX_DELAY_MS);
+    }
+    return Math.min(UPSTREAM_FETCH_BASE_DELAY_MS * 2 ** attempt, UPSTREAM_FETCH_MAX_DELAY_MS);
+}
+function isRateLimitedUpstream(response) {
+    return (response.headers.get('x-ratelimit-remaining') === '0' ||
+        response.headers.get('retry-after') !== null);
+}
+function isRetryableUpstreamStatus(status, response) {
+    if (status === 429)
+        return true;
+    if (status >= 500)
+        return true;
+    if (status === 403 && response !== undefined && isRateLimitedUpstream(response))
+        return true;
+    return false;
+}
+export async function fetchUpstream(url, init) {
+    let attempt = 0;
+    for (;;) {
+        let response;
+        try {
+            response = await fetch(url, init);
+        }
+        catch (error) {
+            if (init.signal?.aborted || attempt >= UPSTREAM_FETCH_MAX_ATTEMPTS - 1)
+                throw error;
+            await sleep(upstreamRetryDelayMs(attempt), undefined, { signal: init.signal ?? undefined });
+            attempt += 1;
+            continue;
+        }
+        if (response.ok ||
+            !isRetryableUpstreamStatus(response.status, response) ||
+            attempt >= UPSTREAM_FETCH_MAX_ATTEMPTS - 1)
+            return response;
+        await response.body?.cancel().catch(() => { });
+        await sleep(upstreamRetryDelayMs(attempt, response), undefined, {
+            signal: init.signal ?? undefined,
+        });
+        attempt += 1;
+    }
+}
+//# sourceMappingURL=upstream.js.map

package/dist/upstream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.js","sourceRoot":"","sources":["../src/upstream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAA;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAA;AAGrD,MAAM,UAAU,cAAc,CAAC,GAAuB;IACpD,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,MAAM,CAAA;IACpC,OAAO,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,cAAc,GAAG,EAAE,CAAA;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,aAAqB,EAAE,GAAW;IACpE,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;IAC7F,MAAM,MAAM,GAAG,KAAK,CAClB,KAAK,EACL,CAAC,WAAW,EAAE,sBAAsB,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EACtF;QACE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CACF,CAAA;IACD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACnD,IAAI,OAAO,CAAS,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE;YAC5C,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YAChE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAClC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACvF,CAAC,CAAC;QACF,IAAI,OAAO,CAAS,CAAC,YAAY,EAAE,EAAE;YACnC,MAAM,MAAM,GAAa,EAAE,CAAA;YAC3B,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;YAChE,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAA;YAClD,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACtF,CAAC,CAAC;QACF,IAAI,OAAO,CAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE;YACjD,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;YAC1B,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;QACtD,CAAC,CAAC;KACH,CAAC,CAAA;IACF,IAAI,QAAQ,KAAK,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,0BAA0B,aAAa,IAAI,GAAG,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;IACpF,MAAM,IAAI,GAAG,MAAM;SAChB,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAA;IACnC,MAAM,GAAG,GACP,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IACzC,IAAI,CAAC,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,sBAAsB,aAAa,IAAI,GAAG,EAAE,CAAC,CAAA;IAC/D,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,GAAW,EAAE,MAAoB;IACxE,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE;QACxC,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC;QACpC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9B,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC,CAAA;IAClF,OAAO,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAA;AACrD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,aAAqB,EAAE,SAAiB,EAAE,IAAY;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAA;IAC7D,OAAO,oCAAoC,MAAM,CAAC,QAAQ,IAAI,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;AAChI,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAW;IACzC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sBAAsB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;IACnF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAA;IACjF,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAA;AACxB,CAAC;AAED,MAAM,mBAAmB,GAAG,6BAA6B,CAAA;AAEzD;;;;;;GAMG;AACH,qEAAqE;AACrE,MAAM,CAAC,MAAM,uBAAuB,GAAsB,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAA;AAE1F,MAAM,uBAAuB,GAAG,6CAA6C,CAAA;AAE7E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,MAAM,SAAS,GAAG,EAAE,YAAY,EAAE,mBAAmB,EAAE,CAAA;IACvD,IAAI,IAAY,CAAA;IAChB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAA;IAC9D,IAAI,CAAC,KAAK,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACnE,OAAO;QACL,MAAM,EAAE,6BAA6B;QACrC,aAAa,EAAE,UAAU,KAAK,EAAE;QAChC,YAAY,EAAE,mBAAmB;KAClC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAsB;IAC1D,MAAM,OAAO,GAAG,GAAgB,EAAE;QAChC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC,CAAA;QAC1D,OAAO,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAA;IAClE,CAAC,CAAA;IACD,OAAO;QACL,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5F,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC;KACxD,CAAA;AACH,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,MAAM,CAAA;AAE3C,MAAM,2BAA2B,GAAG,CAAC,CAAA;AACrC,MAAM,4BAA4B,GAAG,IAAI,CAAA;AACzC,MAAM,2BAA2B,GAAG,KAAK,CAAA;AAEzC,SAAS,oBAAoB,CAAC,OAAe,EAAE,QAAmB;IAChE,MAAM,UAAU,GAAG,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;IACvD,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,CAAA;QAClC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,IAAI,CAAC;YAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,GAAG,IAAI,EAAE,2BAA2B,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;QACnC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;YACrB,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,4BAA4B,GAAG,CAAC,IAAI,OAAO,EAAE,2BAA2B,CAAC,CAAA;AAC3F,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAkB;IAC/C,OAAO,CACL,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG;QACrD,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,KAAK,IAAI,CAC7C,CAAA;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAc,EAAE,QAAmB;IACpE,IAAI,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IAC/B,IAAI,MAAM,IAAI,GAAG;QAAE,OAAO,IAAI,CAAA;IAC9B,IAAI,MAAM,KAAK,GAAG,IAAI,QAAQ,KAAK,SAAS,IAAI,qBAAqB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5F,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,GAAW,EAAE,IAAiB;IAChE,IAAI,OAAO,GAAG,CAAC,CAAA;IACf,SAAS,CAAC;QACR,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAA;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,OAAO,IAAI,2BAA2B,GAAG,CAAC;gBAAE,MAAM,KAAK,CAAA;YACnF,MAAM,KAAK,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC,CAAA;YAC3F,OAAO,IAAI,CAAC,CAAA;YACZ,SAAQ;QACV,CAAC;QACD,IACE,QAAQ,CAAC,EAAE;YACX,CAAC,yBAAyB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;YACrD,OAAO,IAAI,2BAA2B,GAAG,CAAC;YAE1C,OAAO,QAAQ,CAAA;QACjB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC7C,MAAM,KAAK,CAAC,oBAAoB,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE;YAC9D,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,SAAS;SACjC,CAAC,CAAA;QACF,OAAO,IAAI,CAAC,CAAA;IACd,CAAC;AACH,CAAC"}

package/dist/verify-artifacts.d.ts

@@ -0,0 +1,36 @@
+import type { GeneratedArtifacts } from './artifacts.js';
+import { type ConsumerCategory, type ConsumerIndex, type ConsumerProduct, type LeadingDiagnostic } from './consumer-index.js';
+import { type CatalogPolicy } from './policy.js';
+import { type Catalog } from './schema.js';
+export interface ConsumerIndexVerification {
+    readonly hasConsumerIndex: boolean;
+    readonly diagnostics: readonly LeadingDiagnostic[];
+    readonly counts?: ConsumerIndex['counts'];
+    readonly topCount?: number;
+    readonly products?: Readonly<Record<string, ConsumerProduct>>;
+    readonly categories?: readonly ConsumerCategory[];
+    /** Shards the published integrity file set must carry for this index. */
+    readonly shards: readonly ShardArtifact[];
+}
+export interface ShardArtifact {
+    readonly name: string;
+    readonly kind: 'index' | 'shelf' | 'list';
+    readonly category?: string;
+}
+export declare function verifyArtifacts(artifacts: GeneratedArtifacts): void;
+/**
+ * Re-checks one consumer shard against the navigation index: a shelf carries
+ * exactly the curated products in order, and a category list carries exactly
+ * the category's products in order. The expected catalog ID must come from a
+ * separately verified catalog, not from the shard being checked.
+ */
+export declare function verifyShardArtifact(shard: ShardArtifact, content: string | undefined, verification: ConsumerIndexVerification, catalogId: string): void;
+/**
+ * Re-checks the published consumer index against the catalog it indexes. The
+ * index is what Adea renders directly, so a contradiction between the two
+ * artifacts must never reach a release. Snapshots published before the index
+ * existed carry membership only; those are still membership-checked and
+ * reported as `hasConsumerIndex: false`.
+ */
+export declare function verifyConsumerIndex(content: string, catalog: Pick<Catalog, 'plugins'>, indexContent?: string): ConsumerIndexVerification;
+export declare function verifyCatalogReferences(catalog: Catalog, policy?: CatalogPolicy): void;