@adea-ai/plugins 4.0.1 → 4.0.6

package/src/snapshots.ts

@@ -0,0 +1,287 @@
+import { promises as fs } from 'node:fs'
+import { join, relative, resolve } from 'node:path'
+import { Readable } from 'node:stream'
+import { createGunzip } from 'node:zlib'
+import { extract } from 'tar-stream'
+import type { CatalogPolicy } from './policy.js'
+import { PluginSafetyError } from './plugin-skips.js'
+import { canonicalRepositoryUrl, safeRelativePath, type SourceConfig } from './sources.js'
+import { fetchUpstream, GITHUB_REPOSITORY_HOSTS, upstreamRequestHeaders } from './upstream.js'
+
+export interface Snapshot {
+  readonly files: ReadonlyMap<string, Uint8Array>
+  readonly symlinks: readonly string[]
+}
+
+export interface SnapshotLoader {
+  load(repositoryUrl: string, commitSha: string, pluginSubdirectory: string): Promise<Snapshot>
+}
+
+/**
+ * Ceiling on bytes read out of one repository archive.
+ *
+ * The per-plugin policy still bounds what any single plugin may contain; this
+ * only stops a decompression bomb from exhausting the build host, and it is
+ * enforced while the stream is read rather than after it is buffered.
+ */
+const MAX_ARCHIVE_BYTES = 512 * 1024 * 1024
+
+function concatChunks(chunks: readonly Uint8Array[], length: number): Uint8Array {
+  const out = new Uint8Array(length)
+  let offset = 0
+  for (const chunk of chunks) {
+    out.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return out
+}
+
+/**
+ * Read one GitHub repository tarball into path -> bytes.
+ *
+ * GitHub wraps every entry in a single top-level `<repo>-<sha>/` directory,
+ * which is stripped so the keys match the tree API's repository-relative
+ * paths. Only regular files are taken: directories, symlinks, hardlinks and
+ * the `pax_global_header` record are skipped, so a link can never be
+ * materialized as content. Every remaining path goes through
+ * `safeRelativePath`, so an archive that tries to escape the repository is
+ * rejected rather than partially trusted. This is a whole-repository archive
+ * shared across plugins, so an oversized unrelated file is drained and
+ * counted against the archive budget but not retained. The selected plugin's
+ * files are checked against the tree before the archive is fetched and again
+ * when its snapshot is validated.
+ */
+export async function readArchiveFiles(
+  archive: Uint8Array,
+  policy: CatalogPolicy
+): Promise<Map<string, Uint8Array>> {
+  const files = new Map<string, Uint8Array>()
+  let totalBytes = 0
+  const parser = extract()
+  const gunzip = createGunzip()
+  const settled = new Promise<void>((resolveDone, rejectDone) => {
+    const fail = (error: unknown): void => {
+      gunzip.destroy()
+      parser.destroy()
+      rejectDone(error)
+    }
+    parser.on('entry', (header, stream, next) => {
+      const skip = (): void => {
+        stream.on('end', next)
+        stream.resume()
+      }
+      if (header.type !== 'file') return skip()
+      const segments = header.name.split('/')
+      if (segments.length < 2) return skip()
+      let path: string
+      try {
+        path = safeRelativePath(segments.slice(1).join('/'), 'TREE_PATH_INVALID')
+      } catch (error) {
+        return fail(error)
+      }
+      const chunks: Uint8Array[] = []
+      let length = 0
+      stream.on('data', (chunk: unknown) => {
+        const bytes = chunk as Uint8Array
+        length += bytes.byteLength
+        if (totalBytes + length > MAX_ARCHIVE_BYTES) {
+          fail(new Error('PLUGIN_SIZE_POLICY: archive'))
+          return
+        }
+        if (length <= policy.maxFileBytes) chunks.push(bytes)
+        else chunks.length = 0
+      })
+      stream.on('error', fail)
+      stream.on('end', () => {
+        try {
+          totalBytes += length
+          if (length <= policy.maxFileBytes) files.set(path, concatChunks(chunks, length))
+          next()
+        } catch (error) {
+          fail(error)
+        }
+      })
+      stream.resume()
+    })
+    parser.on('error', fail)
+    gunzip.on('error', fail)
+    parser.on('finish', () => resolveDone())
+  })
+  Readable.from([archive]).pipe(gunzip).pipe(parser)
+  await settled
+  return files
+}
+
+export class NetworkSnapshotLoader implements SnapshotLoader {
+  readonly #policy: CatalogPolicy
+  readonly #trees = new Map<string, Promise<readonly TreeEntry[]>>()
+  readonly #archives = new Map<string, Promise<ReadonlyMap<string, Uint8Array>>>()
+
+  constructor(policy: CatalogPolicy) {
+    this.#policy = policy
+  }
+
+  async load(
+    repositoryUrl: string,
+    commitSha: string,
+    pluginSubdirectory: string
+  ): Promise<Snapshot> {
+    const parsed = new URL(canonicalRepositoryUrl(repositoryUrl))
+    if (!GITHUB_REPOSITORY_HOSTS.includes(parsed.hostname))
+      throw new Error(`GIT_HOST_UNSUPPORTED: ${parsed.hostname}`)
+    const [owner, repo] = parsed.pathname.split('/').filter(Boolean)
+    if (!owner || !repo) throw new Error('GIT_REPOSITORY_INVALID')
+    const key = `${owner}/${repo}@${commitSha}`
+    let pendingTree = this.#trees.get(key)
+    if (!pendingTree) {
+      pendingTree = (async () => {
+        const treeUrl = `https://api.github.com/repos/${owner}/${repo}/git/trees/${commitSha}?recursive=1`
+        const response = await fetchUpstream(treeUrl, {
+          headers: upstreamRequestHeaders(treeUrl),
+        })
+        if (!response.ok)
+          throw new PluginSafetyError('PLUGIN_SOURCE_UNAVAILABLE', [`${owner}/${repo}`])
+        const payload = (await response.json()) as { truncated?: boolean; tree?: TreeEntry[] }
+        if (payload.truncated) throw new Error(`GIT_TREE_TRUNCATED: ${owner}/${repo}@${commitSha}`)
+        return (payload.tree ?? []).map((entry) => ({
+          ...entry,
+          path: safeRelativePath(entry.path, 'TREE_PATH_INVALID'),
+        }))
+      })().catch((error: unknown) => {
+        this.#trees.delete(key)
+        throw error
+      })
+      this.#trees.set(key, pendingTree)
+    }
+    const tree = await pendingTree
+    const prefix = pluginSubdirectory ? `${safeRelativePath(pluginSubdirectory)}/` : ''
+    const submodules = tree.filter(
+      (entry) =>
+        entry.path.startsWith(prefix) && (entry.type === 'commit' || entry.mode === '160000')
+    )
+    if (submodules.length > 0)
+      throw new Error(`GIT_SUBMODULE_UNSUPPORTED: ${repositoryUrl}:${pluginSubdirectory}`)
+    const selected = tree.filter((entry) => entry.type === 'blob' && entry.path.startsWith(prefix))
+    if (selected.length === 0)
+      throw new Error(`PLUGIN_PATH_NOT_FOUND: ${repositoryUrl}:${pluginSubdirectory}`)
+    const files = new Map<string, Uint8Array>()
+    const symlinks = tree
+      .filter((entry) => entry.mode === '120000' && entry.path.startsWith(prefix))
+      .map((entry) => entry.path)
+    if (selected.length > this.#policy.maxFilesPerPlugin) throw new Error('PLUGIN_TOO_MANY_FILES')
+    let totalSize = 0
+    for (const entry of selected) {
+      const size = entry.size ?? 0
+      if (size > this.#policy.maxFileBytes || totalSize + size > this.#policy.maxBytesPerPlugin)
+        throw new Error(`PLUGIN_SIZE_POLICY: ${entry.path}`)
+      totalSize += size
+    }
+    // The tree above already bounded this plugin before a byte was pulled, so
+    // the archive is the only unbounded read left and it is capped while it
+    // streams. One archive per repository replaces one request per file.
+    const archive = await this.#archiveFiles(key, owner, repo, commitSha)
+    for (const entry of selected) {
+      const bytes = archive.get(entry.path)
+      if (!bytes) throw new PluginSafetyError('PLUGIN_FILE_UNAVAILABLE', [entry.path])
+      if (bytes.byteLength > this.#policy.maxFileBytes)
+        throw new Error(`PLUGIN_FILE_TOO_LARGE: ${entry.path}`)
+      files.set(
+        prefix ? relative(prefix.slice(0, -1), entry.path).replaceAll('\\', '/') : entry.path,
+        bytes
+      )
+    }
+    return { files, symlinks }
+  }
+
+  async #archiveFiles(
+    key: string,
+    owner: string,
+    repo: string,
+    commitSha: string
+  ): Promise<ReadonlyMap<string, Uint8Array>> {
+    const cached = this.#archives.get(key)
+    if (cached) return cached
+    const pending = (async () => {
+      const url = `https://api.github.com/repos/${owner}/${repo}/tarball/${commitSha}`
+      const response = await fetchUpstream(url, { headers: upstreamRequestHeaders(url) })
+      if (!response.ok)
+        throw new PluginSafetyError('PLUGIN_SOURCE_UNAVAILABLE', [`${owner}/${repo}`])
+      return readArchiveFiles(new Uint8Array(await response.arrayBuffer()), this.#policy)
+    })().catch((error: unknown) => {
+      this.#archives.delete(key)
+      throw error
+    })
+    this.#archives.set(key, pending)
+    return pending
+  }
+}
+
+interface TreeEntry {
+  readonly path: string
+  readonly mode?: string
+  readonly type?: string
+  readonly size?: number
+}
+
+export class FixtureSnapshotLoader implements SnapshotLoader {
+  readonly #root: string
+  readonly #sources: ReadonlyMap<string, SourceConfig>
+
+  constructor(root: string, sources: readonly SourceConfig[]) {
+    this.#root = resolve(root)
+    this.#sources = new Map(
+      sources.map((source) => [canonicalRepositoryUrl(source.repositoryUrl), source])
+    )
+  }
+
+  async load(
+    repositoryUrl: string,
+    _commitSha: string,
+    pluginSubdirectory: string
+  ): Promise<Snapshot> {
+    const source = this.#sources.get(canonicalRepositoryUrl(repositoryUrl))
+    if (!source?.fixturePath) throw new Error(`FIXTURE_REPOSITORY_NOT_FOUND: ${repositoryUrl}`)
+    return snapshotFromDirectory(join(this.#root, source.fixturePath), pluginSubdirectory)
+  }
+}
+
+export class DirectorySnapshotLoader implements SnapshotLoader {
+  async load(
+    _repositoryUrl: string,
+    _commitSha: string,
+    pluginSubdirectory: string
+  ): Promise<Snapshot> {
+    throw new Error(`DIRECTORY_LOADER_REQUIRES_ROOT: ${pluginSubdirectory}`)
+  }
+}
+
+export async function snapshotFromDirectory(
+  root: string,
+  pluginSubdirectory: string
+): Promise<Snapshot> {
+  const directory = resolve(root, pluginSubdirectory)
+  const files = new Map<string, Uint8Array>()
+  const symlinks: string[] = []
+  const rootStat = await fs.lstat(directory)
+  if (rootStat.isSymbolicLink()) return { files, symlinks: [pluginSubdirectory || '.'] }
+  await walk(directory, directory, files, symlinks)
+  return { files, symlinks }
+}
+
+async function walk(
+  root: string,
+  current: string,
+  files: Map<string, Uint8Array>,
+  symlinks: string[]
+): Promise<void> {
+  for (const entry of await fs.readdir(current, { withFileTypes: true })) {
+    const absolute = join(current, entry.name)
+    const relativePath = safeRelativePath(relative(root, absolute), 'DIRECTORY_PATH_INVALID')
+    if (entry.isSymbolicLink()) {
+      symlinks.push(relativePath)
+      continue
+    }
+    if (entry.isDirectory()) await walk(root, absolute, files, symlinks)
+    else if (entry.isFile()) files.set(relativePath, await fs.readFile(absolute))
+  }
+}

package/src/source-digest.test.ts

@@ -11,20 +11,17 @@ test('source digests agree across consumer locales and equivalent Unicode path o
   try {
     const entry = join(directory, 'entry.ts')
     const output = join(directory, 'consumer.mjs')
-    await writeFile(
-      entry,
-      `export { bytesDigest } from '../index.ts'\nexport { sourceDigest } from '../agent-plugins-catalog.ts'\n`
-    )
+    await writeFile(entry, `export { sourceDigest } from '../digest.ts'\n`)
     const build = await Bun.build({ entrypoints: [entry], target: 'node', packages: 'external' })
     expect(build.success).toBe(true)
     await Bun.write(output, build.outputs[0]!)
     const script = `
-      import { bytesDigest, sourceDigest } from ${JSON.stringify(pathToFileURL(output).href)};
+      import { sourceDigest } from ${JSON.stringify(pathToFileURL(output).href)};
       const paths = ['z.txt', 'ä.txt', 'é.txt', 'e\\u0301.txt'];
       const entries = paths.map((path) => [path, new TextEncoder().encode(path)]);
       const forward = new Map(entries), reverse = new Map([...entries].reverse());
       console.log(JSON.stringify([
-        bytesDigest(forward), bytesDigest(reverse), sourceDigest(forward), sourceDigest(reverse)
+        sourceDigest(forward), sourceDigest(reverse)
       ]));
     `
     const results = ['en_US.UTF-8', 'sv_SE.UTF-8'].map((locale) => {
@@ -34,7 +31,6 @@ test('source digests agree across consumer locales and equivalent Unicode path o
       })
       if (result.error) throw result.error
       if (result.status !== 0) throw new Error(result.stderr)
-      expect(result.status).toBe(0)
       return JSON.parse(result.stdout) as string[]
     })
     expect(new Set(results.flat()).size).toBe(1)

package/src/source-resolution.ts

@@ -0,0 +1,233 @@
+import { promises as fs } from 'node:fs'
+import { join, resolve } from 'node:path'
+import { mapWithConcurrency } from './concurrency.js'
+import { contentId, digest, ordinalCompare } from './digest.js'
+import { SourcesLockSchema, type SourceLockEntry, type SourcesLock } from './schema.js'
+import {
+  canonicalRepositoryUrl,
+  parseJsonDocument,
+  parseMarketplaceManifest,
+  safeRelativePath,
+  type ParsedMarketplace,
+  type PluginSourceSpec,
+  type SourceConfig,
+} from './sources.js'
+import { externalGitRef, fetchText, rawContentUrl, resolveGitRef } from './upstream.js'
+
+export interface ResolvedSource {
+  readonly config: SourceConfig
+  readonly commitSha: string
+  readonly manifestText: string
+  readonly parsed: ParsedMarketplace
+  readonly pluginPins: readonly PluginSourcePin[]
+  readonly retrievedAt: string
+  readonly manifestDigest: string
+}
+
+export interface PluginSourcePin {
+  readonly pluginName: string
+  readonly repositoryUrl: string
+  readonly pluginSubdirectory: string
+  readonly resolvedCommitSha: string
+}
+
+export async function resolvePluginSource(
+  pluginName: string,
+  spec: PluginSourceSpec,
+  source: ResolvedSource,
+  resolveExternalRefs: boolean
+): Promise<ResolvedPluginSource> {
+  if (spec.kind === 'local')
+    return {
+      repositoryUrl: canonicalRepositoryUrl(source.config.repositoryUrl),
+      subdirectory: spec.path,
+      commitSha: source.commitSha,
+    }
+  const canonicalUrl = canonicalRepositoryUrl(spec.repositoryUrl)
+  const pin = source.pluginPins.find(
+    (candidate) =>
+      candidate.pluginName === pluginName &&
+      candidate.repositoryUrl === canonicalUrl &&
+      candidate.pluginSubdirectory === spec.subdirectory
+  )
+  const commitSha =
+    pin?.resolvedCommitSha ??
+    spec.sha ??
+    (resolveExternalRefs
+      ? await resolveGitRef(spec.repositoryUrl, externalGitRef(spec.ref))
+      : source.commitSha)
+  return {
+    repositoryUrl: canonicalUrl,
+    subdirectory: pin?.pluginSubdirectory ?? spec.subdirectory,
+    commitSha,
+  }
+}
+
+export interface ResolvedPluginSource {
+  readonly repositoryUrl: string
+  readonly subdirectory: string
+  readonly commitSha: string
+}
+
+/** The fields that differ between two lock entries for the same source. */
+export function lockChangedFields(previous: SourceLockEntry, current: SourceLockEntry): string[] {
+  const fields = [
+    'repositoryUrl',
+    'defaultBranch',
+    'manifestPath',
+    'marketplaceDialect',
+    'resolvedCommitSha',
+    'sourceManifestDigest',
+    'synchronizationStatus',
+  ] as const
+  const changed: string[] = fields.filter((field) => previous[field] !== current[field])
+  if (digest(sortedPins(previous)) !== digest(sortedPins(current))) changed.push('pluginPins')
+  return changed
+}
+
+export function sourceLockChanged(previous: SourceLockEntry, current: SourceLockEntry): boolean {
+  return lockChangedFields(previous, current).length > 0
+}
+
+function sortedPins(source: SourceLockEntry): string[] {
+  return source.pluginPins
+    .map((pin) =>
+      JSON.stringify([
+        pin.pluginName,
+        pin.repositoryUrl,
+        pin.pluginSubdirectory,
+        pin.resolvedCommitSha,
+      ])
+    )
+    .toSorted()
+}
+
+export function createSourcesLock(sources: readonly ResolvedSource[]): SourcesLock {
+  const entries: SourceLockEntry[] = sources
+    .map((source) => ({
+      sourceId: source.config.sourceId,
+      repositoryUrl: canonicalRepositoryUrl(source.config.repositoryUrl),
+      defaultBranch: source.config.defaultBranch,
+      resolvedCommitSha: source.commitSha,
+      manifestPath: source.config.manifestPath,
+      marketplaceDialect: source.config.marketplaceDialect,
+      sourceManifestDigest: source.manifestDigest,
+      retrievedAt: source.retrievedAt,
+      synchronizationStatus: 'synchronized' as const,
+      pluginPins: source.pluginPins.map((pin) => ({ ...pin })),
+    }))
+    .toSorted((left, right) => left.sourceId.localeCompare(right.sourceId))
+  const body = { schemaVersion: 1 as const, sources: entries }
+  return SourcesLockSchema.parse({
+    ...body,
+    lockId: contentId('lock', body),
+  })
+}
+
+export async function resolveSource(
+  config: SourceConfig,
+  mode: 'live' | 'offline',
+  fixtureRoot: string | undefined,
+  lock: SourcesLock | undefined,
+  fromLock: boolean
+): Promise<ResolvedSource> {
+  const manifestPath = safeRelativePath(config.manifestPath, 'SOURCE_MANIFEST_PATH_INVALID')
+  const locked = lock?.sources.find((entry) => entry.sourceId === config.sourceId)
+  if (fromLock && !locked) throw new Error(`SOURCE_LOCK_ENTRY_MISSING: ${config.sourceId}`)
+  const commitSha =
+    fromLock && locked
+      ? locked.resolvedCommitSha
+      : mode === 'offline'
+        ? (config.fixtureCommitSha ?? locked?.resolvedCommitSha)
+        : await resolveGitRef(config.repositoryUrl, `refs/heads/${config.defaultBranch}`)
+  if (!commitSha || !/^[a-f0-9]{40}$/.test(commitSha))
+    throw new Error(`SOURCE_COMMIT_UNRESOLVED: ${config.sourceId}`)
+  const manifestText =
+    mode === 'offline'
+      ? await readFixtureManifest({ ...config, manifestPath }, fixtureRoot)
+      : await fetchText(rawContentUrl(config.repositoryUrl, commitSha, manifestPath))
+  const parsed = parseMarketplaceManifest(parseJsonDocument(manifestText), config)
+  if (fromLock && locked && digest(manifestText) !== locked.sourceManifestDigest)
+    throw new Error(`SOURCE_LOCK_MANIFEST_MISMATCH: ${config.sourceId}`)
+  const pluginPins = await resolvePluginPins({
+    config,
+    parsed,
+    sourceCommitSha: commitSha,
+    lockedPins: locked?.pluginPins,
+    fromLock,
+    resolveExternalRefs: mode === 'live',
+  })
+  return {
+    config,
+    commitSha,
+    manifestText,
+    parsed,
+    pluginPins,
+    retrievedAt:
+      fromLock && locked
+        ? locked.retrievedAt
+        : mode === 'offline'
+          ? '2026-01-01T00:00:00.000Z'
+          : new Date().toISOString(),
+    manifestDigest: digest(manifestText),
+  }
+}
+
+async function resolvePluginPins(input: {
+  readonly config: SourceConfig
+  readonly parsed: ParsedMarketplace
+  readonly sourceCommitSha: string
+  readonly lockedPins: readonly PluginSourcePin[] | undefined
+  readonly fromLock: boolean
+  readonly resolveExternalRefs: boolean
+}): Promise<PluginSourcePin[]> {
+  const pins = await mapWithConcurrency(
+    input.parsed.entries,
+    8,
+    async (entry): Promise<PluginSourcePin> => {
+      if (entry.source.kind === 'local') {
+        return {
+          pluginName: entry.name,
+          repositoryUrl: canonicalRepositoryUrl(input.config.repositoryUrl),
+          pluginSubdirectory: entry.source.path,
+          resolvedCommitSha: input.sourceCommitSha,
+        }
+      }
+
+      const repositoryUrl = canonicalRepositoryUrl(entry.source.repositoryUrl)
+      const pluginSubdirectory = entry.source.subdirectory
+      // Existing locks describe the prior sync; only explicit replay freezes revisions.
+      const locked = input.fromLock
+        ? input.lockedPins?.find((pin) => pin.pluginName === entry.name)
+        : undefined
+      if (input.fromLock && !locked)
+        throw new Error(`SOURCE_LOCK_PLUGIN_PIN_MISSING: ${input.config.sourceId}:${entry.name}`)
+      if (locked) {
+        if (
+          locked.repositoryUrl !== repositoryUrl ||
+          locked.pluginSubdirectory !== pluginSubdirectory
+        ) {
+          throw new Error(`SOURCE_LOCK_PLUGIN_PIN_MISMATCH: ${input.config.sourceId}:${entry.name}`)
+        }
+        return locked
+      }
+
+      const resolvedCommitSha =
+        entry.source.sha ??
+        (input.resolveExternalRefs
+          ? await resolveGitRef(repositoryUrl, externalGitRef(entry.source.ref))
+          : input.sourceCommitSha)
+      return { pluginName: entry.name, repositoryUrl, pluginSubdirectory, resolvedCommitSha }
+    }
+  )
+  return pins.toSorted((left, right) => ordinalCompare(left.pluginName, right.pluginName))
+}
+
+async function readFixtureManifest(
+  config: SourceConfig,
+  fixtureRoot: string | undefined
+): Promise<string> {
+  if (!fixtureRoot || !config.fixturePath)
+    throw new Error(`FIXTURE_ROOT_REQUIRED: ${config.sourceId}`)
+  return fs.readFile(join(resolve(fixtureRoot), config.fixturePath, config.manifestPath), 'utf8')
+}

package/src/sources-json.test.ts

@@ -19,7 +19,6 @@ describe('JSON document whitespace', () => {
         `[1${space},2]`,
         `[1,${space}2]`,
       ]) {
-        expect(() => JSON.parse(text)).toThrow()
         expect(() => parseJsonDocument(text)).toThrow('JSON_MALFORMED')
       }
     }

package/src/sources.ts

@@ -1,6 +1,9 @@
-import { createHash } from 'node:crypto'
+import { digest, ordinalCompare } from './digest.js'
+import { isString, stringValue } from './json-values.js'
+import type { MarketplaceDialectSchema } from './schema.js'
+import type { z } from 'zod'
 
-export type MarketplaceDialect = 'openai' | 'cursor' | 'claude'
+export type MarketplaceDialect = z.output<typeof MarketplaceDialectSchema>
 
 export interface SourceConfig {
   readonly sourceId: string
@@ -44,6 +47,8 @@ export interface ParsedMarketplace {
   readonly marketplaceDescription: string
   readonly owner: readonly string[]
   readonly entries: readonly MarketplacePluginEntry[]
+  /** Entries left out because their source kind cannot be installed from a repository. */
+  readonly unsupportedEntries?: readonly string[]
   readonly raw: Record<string, unknown>
 }
 
@@ -62,7 +67,23 @@ export function parseMarketplaceManifest(input: unknown, source: SourceConfig):
   const plugins = root.plugins
   if (!Array.isArray(plugins)) throw new SourceAdapterError('MARKETPLACE_PLUGINS_REQUIRED')
 
-  const entries = plugins.map((value, index) => parsePluginEntry(value, source, index))
+  // Upstream marketplaces can list plugins that install some other way, such as by running a
+  // command. Those stay out of the catalog, and they must not stop the rest of it from building.
+  const entries: MarketplacePluginEntry[] = []
+  const unsupportedEntries: string[] = []
+  for (const [index, value] of plugins.entries()) {
+    try {
+      entries.push(parsePluginEntry(value, source, index))
+    } catch (error) {
+      if (!(error instanceof SourceAdapterError) || error.code !== 'PLUGIN_SOURCE_KIND_UNSUPPORTED')
+        throw error
+      unsupportedEntries.push(error.details.join(': '))
+    }
+  }
+  if (unsupportedEntries.length > 0)
+    console.error(
+      `${source.sourceId}: left out plugins with unsupported source kinds: ${unsupportedEntries.join(', ')}`
+    )
   const duplicateNames = new Set<string>()
   for (const entry of entries) {
     if (duplicateNames.has(entry.name))
@@ -72,8 +93,9 @@ export function parseMarketplaceManifest(input: unknown, source: SourceConfig):
   return {
     marketplaceName: stringValue(root.name) ?? source.displayName,
     marketplaceDescription: stringValue(root.description) ?? '',
-    owner: ownerNames(root.owner),
+    owner: authorNames(root.owner),
     entries,
+    ...(unsupportedEntries.length > 0 ? { unsupportedEntries } : {}),
     raw: root,
   }
 }
@@ -302,18 +324,8 @@ function requiredString(input: unknown, code: string, detail: string): string {
   return result
 }
 
-function stringValue(input: unknown): string | undefined {
-  return typeof input === 'string' && input.trim() ? input.trim() : undefined
-}
-
-function isString(input: unknown): input is string {
-  return typeof input === 'string' && input.trim().length > 0
-}
-
 function uniqueStrings(input: readonly string[]): string[] {
-  return [...new Set(input.map((value) => value.trim()).filter(Boolean))].toSorted((a, b) =>
-    a < b ? -1 : a > b ? 1 : 0
-  )
+  return [...new Set(input.map((value) => value.trim()).filter(Boolean))].toSorted(ordinalCompare)
 }
 
 function authorNames(input: unknown): string[] {
@@ -327,10 +339,6 @@ function authorNames(input: unknown): string[] {
   return []
 }
 
-function ownerNames(input: unknown): string[] {
-  return authorNames(input)
-}
-
 function safeOptionalUrl(input: unknown): string | undefined {
   if (!isString(input)) return undefined
   try {
@@ -344,17 +352,3 @@ function safeOptionalUrl(input: unknown): string | undefined {
 function looksLikeUrl(input: string): boolean {
   return /^https?:\/\//i.test(input)
 }
-
-function digest(value: unknown): string {
-  return `sha256:${createHash('sha256').update(canonicalJson(value)).digest('hex')}`
-}
-
-function canonicalJson(value: unknown): string {
-  if (value === null || typeof value !== 'object') return JSON.stringify(value)
-  if (Array.isArray(value)) return `[${value.map(canonicalJson).join(',')}]`
-  const object = value as Record<string, unknown>
-  return `{${Object.keys(object)
-    .toSorted()
-    .map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`)
-    .join(',')}}`
-}