@boostkit-dsh/market 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,9 @@
+# Changelog
+
+## 0.1.0 - 2026-09-22
+
+- 从 `@lujinxing/market-ui` 迁入本项目，切换为 `@boostkit-dsh/*` 命名和 catalog v3。
+- 市场目录识别 scope 原生短包名；鉴权引导使用 `@boostkit-dsh/auth-management`。
+- 机器目录包缩短为 `@boostkit-dsh/market-catalog`，避免重复 scope 中的 `dsh`。
+- 基于 DSH `0.1.7-alpha.1` 官方 Plugin Manager 服务完成安装、更新、修复和卸载。
+- 未鉴权时只展示鉴权插件的最小引导入口，登录后展示完整本项目 catalog。

package/README.md

@@ -0,0 +1,21 @@
+# @boostkit-dsh/market
+
+鲲鹏 DSH Demo 专用计算插件市场。源码由旧 `@lujinxing/market-ui` 的交互与分发经验迁入，但当前包由本仓库独立维护，只读取 `@boostkit-dsh/market-catalog`，不依赖旧市场源码或 npm 包。
+
+市场作为预安装引导插件，不对鉴权管理建立硬依赖。未检测到有效 GitCode ActorRef 时，只返回并展示 `@boostkit-dsh/auth-management`；鉴权完成后才展示完整目录。除首次安装鉴权插件外，市场变更通过鉴权服务记录最小化审计事件。
+
+Host 直接使用 DSH `0.1.7-alpha.1` 的 `ctx.pluginManager`，由 DSH 负责 profile 文件锁、pnpm 执行、失败恢复和热加载结果。市场自身不能从自己的页面卸载。
+
+正式安装：
+
+```bash
+dsh plugin --profile web add --save-exact @boostkit-dsh/market@0.1.0
+```
+
+在 npm 包发布前，可用绝对本地路径开发安装：
+
+```bash
+dsh plugin --profile web add file:/absolute/path/to/kunpeng-dsh-demo/plugins/market
+```
+
+目录包和插件包必须先按版本发布到 npm；市场不会把 GitCode raw、本地仓库目录或相对路径作为正式安装源。

package/client.js

@@ -0,0 +1,167 @@
+// Generated from src/client.ts by scripts/build-clients.mjs. Do not edit.
+window.__ModuleLoader__.load({ id: "@boostkit-dsh/market", factory: (require2) => {
+  const module = { exports: {} };
+  const exports = module.exports;
+  const { createElement: h, useCallback, useEffect, useMemo, useState } = require2("react");
+  const NS = "boostkit-market";
+  const PANEL_ID = "boostkit-market";
+  const AUTH_PACKAGE = "@boostkit-dsh/auth-management";
+  const AUTH_REQUIRED_EVENT = "kunpeng-auth-required";
+  const dictionaries = {
+    zh: {
+      nav: "\u9CB2\u9E4F\u63D2\u4EF6\u5E02\u573A",
+      title: "\u9CB2\u9E4F\u8BA1\u7B97\u63D2\u4EF6\u5E02\u573A",
+      subtitle: "\u53EA\u5C55\u793A\u5E76\u7BA1\u7406 kunpeng-dsh-demo catalog \u4E2D\u7684\u63D2\u4EF6\u3002",
+      bootstrap: "\u5C1A\u672A\u5B8C\u6210 GitCode \u9274\u6743\u3002\u4E3A\u907F\u514D\u533F\u540D\u6D4F\u89C8\uFF0C\u76EE\u524D\u53EA\u663E\u793A\u9274\u6743\u63D2\u4EF6\u3002",
+      login: "\u524D\u5F80 GitCode \u9274\u6743",
+      offline: "npm \u76EE\u5F55\u6682\u4E0D\u53EF\u7528",
+      offlineHelp: "\u4ECD\u53EF\u67E5\u770B\u5DF2\u5B89\u88C5\u7684\u53EF\u89C1\u63D2\u4EF6\uFF1B\u5B89\u88C5\u548C\u66F4\u65B0\u6682\u4E0D\u53EF\u7528\u3002",
+      search: "\u641C\u7D22\u63D2\u4EF6\u540D\u79F0\u3001\u5305\u540D\u6216\u8BF4\u660E\u2026",
+      installed: "\u5DF2\u5B89\u88C5",
+      enabled: "\u5DF2\u542F\u7528",
+      update: "\u53EF\u66F4\u65B0",
+      deprecated: "\u5DF2\u5F03\u7528",
+      install: "\u5B89\u88C5",
+      upgrade: "\u66F4\u65B0",
+      repair: "\u4FEE\u590D",
+      remove: "\u5378\u8F7D",
+      working: "\u5904\u7406\u4E2D\u2026",
+      refresh: "\u5237\u65B0",
+      empty: "\u6CA1\u6709\u7B26\u5408\u6761\u4EF6\u7684\u63D2\u4EF6",
+      failed: "\u64CD\u4F5C\u5931\u8D25",
+      done: "\u64CD\u4F5C\u5DF2\u63D0\u4EA4",
+      restart: "\u9700\u8981\u91CD\u542F DSH \u540E\u751F\u6548",
+      confirm: "\u786E\u8BA4\u5BF9\u63D2\u4EF6\u6267\u884C\u6B64\u64CD\u4F5C\u5417\uFF1F"
+    },
+    en: {
+      nav: "Kunpeng Market",
+      title: "Kunpeng Plugin Market",
+      subtitle: "Only plugins from the kunpeng-dsh-demo catalog are shown and managed.",
+      bootstrap: "GitCode authentication is not complete. Only the authentication plugin is visible.",
+      login: "Open GitCode authentication",
+      offline: "The npm catalog is unavailable",
+      offlineHelp: "Visible installed plugins remain readable; installs and updates are disabled.",
+      search: "Search plugin name, package, or description\u2026",
+      installed: "Installed",
+      enabled: "Enabled",
+      update: "Update",
+      deprecated: "Deprecated",
+      install: "Install",
+      upgrade: "Update",
+      repair: "Repair",
+      remove: "Remove",
+      working: "Working\u2026",
+      refresh: "Refresh",
+      empty: "No matching plugins",
+      failed: "Operation failed",
+      done: "Operation submitted",
+      restart: "Restart DSH to apply this change",
+      confirm: "Continue with this plugin operation?"
+    }
+  };
+  const styles = {
+    page: { flex: 1, minHeight: 0, overflow: "auto", boxSizing: "border-box", padding: "24px clamp(18px,4vw,48px)", background: "var(--dsw-alias-bg-base)" },
+    content: { width: "100%", maxWidth: 1180, margin: "0 auto", display: "flex", flexDirection: "column", gap: 14 },
+    row: { display: "flex", alignItems: "center", gap: 9, flexWrap: "wrap" },
+    grow: { flex: 1 },
+    title: { margin: 0, fontSize: 20, color: "var(--dsw-alias-label-primary)" },
+    muted: { color: "var(--dsw-alias-label-tertiary)", fontSize: 12, lineHeight: 1.6 },
+    search: { minWidth: 280, flex: 1, padding: "8px 10px", borderRadius: 7, border: "1px solid var(--dsw-alias-border-l2)", background: "var(--dsw-alias-bg-layer-1)", color: "var(--dsw-alias-label-primary)" },
+    grid: { display: "grid", gridTemplateColumns: "repeat(auto-fill,minmax(300px,1fr))", gap: 12 },
+    card: { padding: 14, borderRadius: 10, border: "1px solid var(--dsw-alias-border-l1)", background: "var(--dsw-alias-bg-layer-1)", display: "flex", flexDirection: "column", gap: 9 },
+    badge: { padding: "1px 7px", borderRadius: 999, border: "1px solid var(--dsw-alias-border-l2)", color: "var(--dsw-alias-label-secondary)", fontSize: 11 },
+    button: { padding: "6px 12px", borderRadius: 7, border: "1px solid var(--dsw-alias-border-l2)", background: "var(--dsw-alias-bg-layer-2)", color: "var(--dsw-alias-label-primary)", cursor: "pointer" },
+    primary: { padding: "6px 12px", borderRadius: 7, border: "1px solid var(--dsw-alias-state-business-primary)", background: "var(--dsw-alias-state-business-primary)", color: "#fff", cursor: "pointer" },
+    notice: { padding: 12, borderRadius: 9, border: "1px solid var(--dsw-alias-state-business-primary)", color: "var(--dsw-alias-label-primary)" },
+    error: { padding: 12, borderRadius: 9, border: "1px solid var(--dsw-alias-state-error-primary)", color: "var(--dsw-alias-state-error-primary)" },
+    link: { color: "var(--dsw-alias-state-business-primary)", textDecoration: "none" }
+  };
+  async function responseJson(response) {
+    const value = await response.json().catch(() => ({}));
+    if (!response.ok || value?.ok === false) throw Object.assign(new Error(value?.error?.message ?? `HTTP ${response.status}`), { code: value?.error?.code });
+    return value;
+  }
+  function MarketIcon({ size = 16, active = false }) {
+    const color = active ? "var(--dsw-alias-state-business-primary)" : "currentColor";
+    return h(
+      "svg",
+      { width: size, height: size, viewBox: "0 0 24 24", fill: "none", "aria-hidden": true },
+      h("path", { d: "M4 9h16l-1-5H5L4 9Zm1 2v9h14v-9M9 20v-5h6v5M7 9v2m5-2v2m5-2v2", stroke: color, strokeWidth: 1.6, strokeLinecap: "round", strokeLinejoin: "round" })
+    );
+  }
+  function MarketPage({ t }) {
+    const [state, setState] = useState(null);
+    const [query, setQuery] = useState("");
+    const [busy, setBusy] = useState(null);
+    const [error, setError] = useState(null);
+    const [notice, setNotice] = useState(null);
+    const load = useCallback(async () => {
+      setError(null);
+      try {
+        setState(await fetch("/boostkit-market/catalog", { cache: "no-store" }).then(responseJson));
+      } catch (value) {
+        setError(value?.message ?? String(value));
+      }
+    }, []);
+    useEffect(() => {
+      void load();
+    }, [load]);
+    const entries = useMemo(() => (state?.plugins ?? []).filter((entry) => {
+      const needle = query.trim().toLowerCase();
+      if (!needle) return true;
+      return [entry.pkg, entry.dir, entry.description, entry.displayName?.zh, entry.displayName?.en].some((value) => String(value ?? "").toLowerCase().includes(needle));
+    }), [query, state]);
+    const act = useCallback(async (kind, entry) => {
+      if (!globalThis.confirm(`${t("confirm")}
+${entry.pkg}
+${kind}`)) return;
+      setBusy(entry.pkg);
+      setError(null);
+      setNotice(null);
+      try {
+        const value = await fetch(`/boostkit-market/${kind}`, { method: "POST", headers: { "content-type": "application/json" }, body: JSON.stringify({ pkg: entry.pkg }) }).then(responseJson);
+        setNotice(value.result?.application === "restart-required" ? t("restart") : t("done"));
+        await load();
+      } catch (value) {
+        setError(value?.message ?? String(value));
+      } finally {
+        setBusy(null);
+      }
+    }, [load, t]);
+    const openLogin = () => window.dispatchEvent(new CustomEvent(AUTH_REQUIRED_EVENT));
+    return h("main", { style: styles.page }, h(
+      "div",
+      { style: styles.content },
+      h("div", { style: styles.row }, h("div", null, h("h2", { style: styles.title }, t("title")), h("div", { style: styles.muted }, t("subtitle"))), h("span", { style: styles.grow }), state ? h("span", { style: styles.badge }, `v${state.marketVersion}`) : null),
+      state && !state.authenticated ? h("section", { style: styles.notice }, h("div", { style: styles.row }, h("strong", null, t("bootstrap")), h("span", { style: styles.grow }), state.plugins?.some((entry) => entry.pkg === AUTH_PACKAGE && entry.installed) ? h("button", { type: "button", style: styles.primary, onClick: openLogin }, t("login")) : null)) : null,
+      state && !state.connected ? h("section", { style: styles.error }, h("strong", null, t("offline")), h("div", { style: styles.muted }, t("offlineHelp")), h("div", { style: styles.muted }, state.error)) : null,
+      error ? h("section", { style: styles.error }, `${t("failed")}\uFF1A${error}`) : null,
+      notice ? h("section", { style: styles.notice }, notice) : null,
+      h("div", { style: styles.row }, h("input", { style: styles.search, value: query, placeholder: t("search"), onChange: (event) => setQuery(event.target.value) }), h("button", { type: "button", style: styles.button, disabled: busy !== null, onClick: () => void load() }, t("refresh"))),
+      h("div", { style: styles.grid }, entries.length ? entries.map((entry) => {
+        const working = busy === entry.pkg;
+        const action = !entry.installed ? "install" : entry.updateAvailable ? "update" : entry.error ? "repair" : null;
+        const disabled = busy !== null || (action === "install" || action === "update" || action === "repair") && state?.connected !== true;
+        return h(
+          "article",
+          { key: entry.pkg, style: styles.card },
+          h("div", { style: styles.row }, h("strong", null, entry.displayName?.zh ?? entry.dir), h("span", { style: styles.grow }), action ? h("button", { type: "button", style: styles.primary, disabled, onClick: () => void act(action, entry) }, working ? t("working") : t(action === "update" ? "upgrade" : action)) : null, entry.installed && entry.canRemove && state?.authenticated === true ? h("button", { type: "button", style: styles.button, disabled: busy !== null, onClick: () => void act("remove", entry) }, t("remove")) : null),
+          h("div", { style: styles.muted }, `${entry.pkg} \xB7 ${entry.version || entry.currentVersion || "?"}`),
+          h("div", null, entry.description),
+          h("div", { style: styles.row }, entry.installed ? h("span", { style: styles.badge }, t("installed")) : null, entry.enabled ? h("span", { style: styles.badge }, t("enabled")) : null, entry.updateAvailable ? h("span", { style: styles.badge }, t("update")) : null, entry.deprecated ? h("span", { style: styles.badge }, t("deprecated")) : null),
+          h("div", { style: styles.row }, h("a", { style: styles.link, href: entry.readmeUrl, target: "_blank", rel: "noreferrer" }, "README"), h("a", { style: styles.link, href: entry.changelogUrl, target: "_blank", rel: "noreferrer" }, "CHANGELOG"))
+        );
+      }) : h("div", { style: styles.muted }, state ? t("empty") : "\u2026"))
+    ));
+  }
+  function apply(ctx) {
+    ctx.effect(() => ctx.locale.register(NS, dictionaries), "boostkit-market.dictionaries");
+    const t = ctx.locale.bind(NS);
+    ctx.slots.inject("main", () => ctx.slots.register({ name: "main", key: PANEL_ID, locale: NS, inject: () => ({ t }) }, MarketPage));
+    ctx.slots.inject("sidebar.panellist", () => ctx.slots.register({ name: "sidebar.panellist", id: PANEL_ID, order: 5, label: () => t("nav"), locale: NS }, MarketIcon));
+  }
+  exports.name = "boostkit-market-client";
+  exports.inject = ["slots", "locale", "layout"];
+  exports.apply = apply;
+  return module.exports;
+} });

package/cordis.patch.yml

@@ -0,0 +1,4 @@
+# 本项目专用计算插件市场；作为安装鉴权插件的预置引导入口。
+- insert:
+    - id: boostkit-market
+      name: '@boostkit-dsh/market'

package/index.js

@@ -0,0 +1,340 @@
+/** Project-owned plugin market backed by DSH 0.1.7's Plugin Manager service. */
+import { createHash } from 'node:crypto'
+import { readFileSync } from 'node:fs'
+import { gunzipSync } from 'node:zlib'
+
+export const name = 'boostkit-market'
+export const inject = ['pluginManager']
+
+const API_PREFIX = '/boostkit-market'
+const REPO_BASE = 'https://gitcode.com/lujinxing/kunpeng-dsh-demo'
+const CATALOG_PACKAGE = '@boostkit-dsh/market-catalog'
+const DSH_VERSION = '0.1.7-alpha.1'
+const SELF_PACKAGE = '@boostkit-dsh/market'
+const AUTH_PACKAGE = '@boostkit-dsh/auth-management'
+const FALLBACK_DISPLAY_NAMES = {
+  [AUTH_PACKAGE]: { zh: '鉴权与审计管理', en: 'Authentication & Audit' },
+  [SELF_PACKAGE]: { zh: '鲲鹏插件市场', en: 'Kunpeng Plugin Market' },
+  '@boostkit-dsh/hello': { zh: 'Hello 示例插件', en: 'Hello Example Plugin' },
+}
+const REGISTRIES = ['https://registry.npmjs.org', 'https://registry.npmmirror.com']
+const PACKAGE_RE = /^@boostkit-dsh\/[a-z0-9][a-z0-9.-]*$/
+const NAME_RE = /^[a-z0-9][a-z0-9.-]*$/
+const SEMVER_RE = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/
+const REQUEST_TIMEOUT_MS = 15_000
+const BOOT_ID = `${process.pid}-${Date.now()}`
+let cachedCatalog = null
+let activeOperation = null
+
+function readJson(file) {
+  try { return JSON.parse(readFileSync(file, 'utf8')) } catch { return null }
+}
+const MARKET_VERSION = readJson(new URL('./package.json', import.meta.url))?.version ?? ''
+
+function sendJson(response, status, value) {
+  if (response.destroyed || response.writableEnded) return
+  response.writeHead(status, { 'cache-control': 'no-store', 'content-type': 'application/json; charset=utf-8' })
+  response.end(JSON.stringify(value))
+}
+
+function sameOrigin(request) {
+  const origin = request.headers.origin
+  const host = request.headers.host
+  if (typeof origin !== 'string' || typeof host !== 'string') return false
+  try { return new URL(origin).host === host } catch { return false }
+}
+
+async function readBody(request, maxBytes = 4096) {
+  const chunks = []
+  let size = 0
+  for await (const chunk of request) {
+    const value = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)
+    size += value.length
+    if (size > maxBytes) throw new Error('request body too large')
+    chunks.push(value)
+  }
+  const text = Buffer.concat(chunks).toString('utf8').trim()
+  return text === '' ? {} : JSON.parse(text)
+}
+
+function tarFile(tarball, wanted) {
+  if (tarball.length > 1024 * 1024) throw new Error('npm 目录 tarball 超过 1 MiB')
+  const archive = gunzipSync(tarball, { maxOutputLength: 5 * 1024 * 1024 })
+  for (let offset = 0; offset + 512 <= archive.length;) {
+    const header = archive.subarray(offset, offset + 512)
+    if (header.every((byte) => byte === 0)) break
+    const field = (start, length) => header.subarray(start, start + length).toString('utf8').replace(/\0.*$/s, '')
+    const name = field(0, 100)
+    const prefix = field(345, 155)
+    const path = prefix ? `${prefix}/${name}` : name
+    const size = Number.parseInt(field(124, 12).trim() || '0', 8)
+    if (!Number.isSafeInteger(size) || size < 0) throw new Error('npm tarball 文件大小非法')
+    const start = offset + 512
+    if (start + size > archive.length) throw new Error('npm tarball 文件越界')
+    if (path === wanted) return archive.subarray(start, start + size).toString('utf8')
+    offset = start + Math.ceil(size / 512) * 512
+  }
+  throw new Error(`npm tarball 缺少 ${wanted}`)
+}
+
+function validateCatalog(value) {
+  if (value?.version !== 3 || !SEMVER_RE.test(String(value.release ?? '')) || value.dsh !== DSH_VERSION) throw new Error('catalog.json 协议或 DSH 版本不匹配')
+  if (!Array.isArray(value.plugins) || !Array.isArray(value.solutions)) throw new Error('catalog.json 缺少插件或解决方案列表')
+  const packages = new Map()
+  for (const entry of value.plugins) {
+    if (!NAME_RE.test(String(entry?.dir ?? '')) || !PACKAGE_RE.test(String(entry?.pkg ?? ''))) throw new Error(`catalog.json 包含非法插件：${String(entry?.pkg ?? entry?.dir)}`)
+    if (!SEMVER_RE.test(String(entry.version ?? '')) || entry?.distribution?.type !== 'npm' || entry.distribution.spec !== `${entry.pkg}@${entry.version}`) throw new Error(`${entry.pkg} 的 npm 分发信息非法`)
+    if (entry.compatibility?.dsh !== DSH_VERSION || !Array.isArray(entry.allowedBuilds)) throw new Error(`${entry.pkg} 的兼容或构建信息非法`)
+    if (packages.has(entry.pkg)) throw new Error(`catalog.json 包名重复：${entry.pkg}`)
+    packages.set(entry.pkg, entry)
+  }
+  for (const entry of value.plugins) {
+    for (const [dependency, version] of Object.entries(entry.dependencies ?? {})) {
+      if (packages.get(dependency)?.version !== version) throw new Error(`${entry.pkg} 的依赖 ${dependency}@${version} 不在目录中`)
+    }
+  }
+  if (!packages.has(AUTH_PACKAGE) || !packages.has(SELF_PACKAGE)) throw new Error('catalog.json 缺少市场或鉴权引导插件')
+  return value
+}
+
+function manifestRelease(manifest) {
+  if (!SEMVER_RE.test(String(manifest?.version ?? '')) || !/^[a-f0-9]{64}$/.test(String(manifest?.dshCatalogSha256 ?? ''))) throw new Error('目录包 manifest 非法')
+  const tarball = manifest?.dist?.tarball
+  const integrity = manifest?.dist?.integrity
+  if (typeof tarball !== 'string' || !tarball.startsWith('https://') || typeof integrity !== 'string' || !integrity.startsWith('sha512-')) throw new Error('目录包 tarball 信息非法')
+  return { version: manifest.version, sha256: manifest.dshCatalogSha256, tarball, integrity }
+}
+
+async function remoteCatalog(fetchImpl = fetch) {
+  const controller = new AbortController()
+  const timer = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS)
+  const failures = []
+  try {
+    for (const registry of REGISTRIES) {
+      try {
+        const manifestResponse = await fetchImpl(`${registry}/${encodeURIComponent(CATALOG_PACKAGE)}/latest`, { signal: controller.signal, cache: 'no-store' })
+        if (!manifestResponse.ok) throw new Error(`manifest HTTP ${manifestResponse.status}`)
+        const release = manifestRelease(await manifestResponse.json())
+        if (cachedCatalog?.version === release.version && cachedCatalog.sha256 === release.sha256) return cachedCatalog.value
+        const tarballResponse = await fetchImpl(release.tarball, { signal: controller.signal, cache: 'force-cache' })
+        if (!tarballResponse.ok) throw new Error(`tarball HTTP ${tarballResponse.status}`)
+        const tarball = Buffer.from(await tarballResponse.arrayBuffer())
+        const integrity = `sha512-${createHash('sha512').update(tarball).digest('base64')}`
+        if (integrity !== release.integrity) throw new Error('目录包 tarball integrity 校验失败')
+        const text = tarFile(tarball, 'package/catalog.json')
+        if (createHash('sha256').update(text).digest('hex') !== release.sha256) throw new Error('catalog SHA-256 校验失败')
+        const value = validateCatalog(JSON.parse(text))
+        if (value.release !== release.version) throw new Error('catalog release 与目录包版本不一致')
+        cachedCatalog = { version: release.version, sha256: release.sha256, value }
+        return value
+      } catch (error) {
+        failures.push(`${registry}: ${String(error?.message ?? error)}`)
+      }
+    }
+    throw new Error(failures.join('；') || 'npm 目录不可用')
+  } finally {
+    clearTimeout(timer)
+  }
+}
+
+function compareVersions(left, right) {
+  const parse = (value) => SEMVER_RE.exec(String(value ?? ''))?.slice(1).map(Number)
+  const a = parse(left)
+  const b = parse(right)
+  if (!a || !b) return 0
+  for (let index = 0; index < 3; index += 1) if (a[index] !== b[index]) return a[index] > b[index] ? 1 : -1
+  return 0
+}
+
+function entryLinks(entry) {
+  return {
+    sourceUrl: `${REPO_BASE}/tree/main/plugins/${entry.dir}`,
+    readmeUrl: `${REPO_BASE}/blob/main/${entry.readme ?? `plugins/${entry.dir}/README.md`}`,
+    changelogUrl: `${REPO_BASE}/blob/main/${entry.changelog ?? `plugins/${entry.dir}/CHANGELOG.md`}`,
+  }
+}
+
+function installedEntry(bundle) {
+  const packageName = bundle.name
+  const short = packageName.replace(/^@boostkit-dsh\//, '')
+  const fallbackName = FALLBACK_DISPLAY_NAMES[packageName] ?? { zh: short }
+  return {
+    dir: short,
+    pkg: packageName,
+    version: bundle.version ?? '',
+    currentVersion: bundle.version ?? '',
+    displayName: {
+      zh: bundle.meta?.displayName?.zh ?? fallbackName.zh,
+      en: bundle.meta?.displayName?.en ?? fallbackName.en,
+    },
+    description: bundle.description ?? '',
+    category: bundle.meta?.category ?? 'kunpeng-rd',
+    maintainers: [],
+    compatibility: { dsh: DSH_VERSION },
+    allowedBuilds: [],
+    dependencies: {},
+    deprecated: false,
+    listed: false,
+    installed: bundle.installed === true,
+    enabled: bundle.enabled === true,
+    canRemove: bundle.removable === true && packageName !== SELF_PACKAGE,
+    updateAvailable: false,
+    error: bundle.error,
+    ...entryLinks({ dir: short }),
+  }
+}
+
+function mergeCatalog(catalog, bundles) {
+  const installed = new Map(bundles.filter((bundle) => PACKAGE_RE.test(bundle.name)).map((bundle) => [bundle.name, installedEntry(bundle)]))
+  const entries = catalog.plugins.map((entry) => {
+    const current = installed.get(entry.pkg)
+    installed.delete(entry.pkg)
+    return {
+      ...entry,
+      ...entryLinks(entry),
+      listed: true,
+      installed: current?.installed === true,
+      enabled: current?.enabled === true,
+      currentVersion: current?.currentVersion ?? '',
+      canRemove: entry.pkg !== SELF_PACKAGE && current?.canRemove === true,
+      updateAvailable: current?.installed === true && compareVersions(entry.version, current.currentVersion) > 0,
+      error: current?.error,
+    }
+  })
+  entries.push(...installed.values())
+  return entries.sort((left, right) => left.dir.localeCompare(right.dir))
+}
+
+function authService(ctx) {
+  try { return ctx.get?.('authManagement') ?? ctx.authManagement ?? null } catch { return null }
+}
+
+async function accessState(ctx) {
+  const auth = authService(ctx)
+  if (auth === null || typeof auth.requireActor !== 'function') return { authenticated: false, auth: null }
+  try { return { authenticated: true, auth, actor: await auth.requireActor() } } catch (error) {
+    if (error?.code === 'AUTH_REQUIRED' || error?.code === 'AUTH_UNAVAILABLE') return { authenticated: false, auth, authError: error.code }
+    throw error
+  }
+}
+
+function bootstrapEntries(entries, authenticated) {
+  return authenticated
+    ? entries
+    : entries
+      .filter((entry) => entry.pkg === AUTH_PACKAGE)
+      .map((entry) => ({ ...entry, canRemove: false }))
+}
+
+async function marketState(ctx, catalogLoader = remoteCatalog) {
+  const access = await accessState(ctx)
+  const bundles = await ctx.pluginManager.listBundles()
+  try {
+    const catalog = await catalogLoader()
+    return {
+      ok: true,
+      connected: true,
+      authenticated: access.authenticated,
+      authError: access.authError,
+      source: `${REPO_BASE}/tree/main`,
+      marketVersion: MARKET_VERSION,
+      bootId: BOOT_ID,
+      plugins: bootstrapEntries(mergeCatalog(catalog, bundles), access.authenticated),
+    }
+  } catch (error) {
+    const installed = bundles.filter((bundle) => PACKAGE_RE.test(bundle.name)).map(installedEntry)
+    return {
+      ok: true,
+      connected: false,
+      authenticated: access.authenticated,
+      authError: access.authError,
+      error: `无法连接 npm 目录服务：${String(error?.message ?? error)}`,
+      source: `${REPO_BASE}/tree/main`,
+      marketVersion: MARKET_VERSION,
+      bootId: BOOT_ID,
+      plugins: bootstrapEntries(installed, access.authenticated),
+    }
+  }
+}
+
+function publicFailure(error) {
+  const code = typeof error?.code === 'string' ? error.code : 'MARKET_OPERATION_FAILED'
+  const message = code === 'AUTH_REQUIRED' ? '请先安装鉴权插件并完成 GitCode 登录。' : String(error?.message ?? error)
+  return { code, message }
+}
+
+async function mutate(ctx, kind, pkg, catalogLoader = remoteCatalog) {
+  if (!PACKAGE_RE.test(pkg)) return { status: 400, body: { ok: false, error: { code: 'INVALID_PACKAGE', message: '插件包名无效。' } } }
+  if (activeOperation !== null) return { status: 409, body: { ok: false, error: { code: 'MARKET_BUSY', message: `正在处理 ${activeOperation}` } } }
+  if (kind === 'remove' && pkg === SELF_PACKAGE) return { status: 400, body: { ok: false, error: { code: 'SELF_REMOVE_FORBIDDEN', message: '市场不能从自身页面卸载。' } } }
+
+  const access = await accessState(ctx)
+  const bootstrapAllowed = pkg === AUTH_PACKAGE && ['install', 'update', 'repair'].includes(kind)
+  if (!access.authenticated && !bootstrapAllowed) return { status: 401, body: { ok: false, error: { code: 'AUTH_REQUIRED', message: '请先安装鉴权插件并完成 GitCode 登录。' } } }
+
+  activeOperation = `${kind}:${pkg}`
+  try {
+    let entry = null
+    if (kind !== 'remove') {
+      const catalog = await catalogLoader()
+      entry = catalog.plugins.find((item) => item.pkg === pkg)
+      if (!entry) return { status: 404, body: { ok: false, error: { code: 'PLUGIN_NOT_LISTED', message: '目录中不存在该插件。' } } }
+      if (entry.deprecated && kind === 'install') return { status: 409, body: { ok: false, error: { code: 'PLUGIN_DEPRECATED', message: '该插件已弃用，禁止新安装。' } } }
+    }
+
+    const perform = () => kind === 'remove'
+      ? ctx.pluginManager.removeBundle(pkg)
+      : ctx.pluginManager.installBundle(entry.distribution.spec, { enabled: true })
+    const result = access.authenticated && access.auth?.executeAudited
+      ? await access.auth.executeAudited({ action: `market.${kind}`, target: { type: 'plugin', id: pkg, label: pkg } }, perform)
+      : await perform()
+    const ok = result?.error === undefined && result?.application !== 'failed' && result?.application !== 'cancelled'
+    return { status: ok ? 200 : 500, body: { ok, kind, pkg, result } }
+  } catch (error) {
+    const failure = publicFailure(error)
+    return { status: failure.code === 'AUTH_REQUIRED' ? 401 : 500, body: { ok: false, error: failure } }
+  } finally {
+    activeOperation = null
+  }
+}
+
+export function apply(ctx, config = {}) {
+  const catalogLoader = config.catalogLoader ?? remoteCatalog
+  ctx.inject(['webServer'], (host) => {
+    host.effect(() => {
+      const routes = [
+        {
+          kind: 'exact', path: `${API_PREFIX}/catalog`, handler: (request, response) => {
+            if (request.method !== 'GET') { response.writeHead(405, { allow: 'GET' }); response.end(); return }
+            void marketState(ctx, catalogLoader).then((value) => sendJson(response, 200, value)).catch((error) => sendJson(response, 500, { ok: false, error: publicFailure(error) }))
+          },
+        },
+        ...['install', 'update', 'repair', 'remove'].map((kind) => ({
+          kind: 'exact', path: `${API_PREFIX}/${kind}`, handler: (request, response) => {
+            if (request.method !== 'POST') { response.writeHead(405, { allow: 'POST' }); response.end(); return }
+            if (!sameOrigin(request)) { sendJson(response, 403, { ok: false, error: { code: 'ORIGIN_REQUIRED', message: '只允许 DSH 同源页面修改插件。' } }); return }
+            void readBody(request)
+              .then((body) => mutate(ctx, kind, body.pkg, catalogLoader))
+              .then((outcome) => sendJson(response, outcome.status, outcome.body))
+              .catch((error) => sendJson(response, 400, { ok: false, error: publicFailure(error) }))
+          },
+        })),
+      ]
+      const disposers = routes.map((route) => host.webServer.register(route))
+      return () => { for (const dispose of disposers) dispose() }
+    }, 'boostkit-market.http')
+  })
+}
+
+export const __testing = {
+  AUTH_PACKAGE,
+  SELF_PACKAGE,
+  accessState,
+  bootstrapEntries,
+  compareVersions,
+  mergeCatalog,
+  mutate,
+  remoteCatalog,
+  sameOrigin,
+  validateCatalog,
+}

package/package.json

@@ -0,0 +1,59 @@
+{
+  "name": "@boostkit-dsh/market",
+  "version": "0.1.0",
+  "type": "module",
+  "description": "本项目专用计算插件市场：浏览、安装、更新和卸载鲲鹏 DSH Demo 插件",
+  "main": "index.js",
+  "files": [
+    "CHANGELOG.md",
+    "README.md",
+    "client.js",
+    "cordis.patch.yml",
+    "index.js"
+  ],
+  "license": "UNLICENSED",
+  "repository": {
+    "type": "git",
+    "url": "git+https://gitcode.com/lujinxing/kunpeng-dsh-demo.git",
+    "directory": "plugins/market"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "exports": {
+    ".": "./index.js",
+    "./client": "./client.js",
+    "./package.json": "./package.json"
+  },
+  "scripts": {
+    "test": "node --test test/*.test.mjs"
+  },
+  "dsh": {
+    "bundle": {
+      "patch": "./cordis.patch.yml"
+    },
+    "client": {
+      "platform": "web",
+      "inject": [
+        "@deepseek-ai/dsh-client-locale",
+        "@deepseek-ai/dsh-client-ui-layout",
+        "@deepseek-ai/dsh-client-ui-sidebar"
+      ]
+    },
+    "market": {
+      "displayName": {
+        "zh": "鲲鹏计算插件市场",
+        "en": "Kunpeng Plugin Market"
+      },
+      "category": "kunpeng-rd",
+      "maintainers": [
+        "@lujinxing"
+      ],
+      "compatibility": {
+        "dsh": "0.1.7-alpha.1"
+      },
+      "allowedBuilds": []
+    }
+  }
+}