@chatcode/cco-market 1.45.1

package/lib/types/hot.d.ts

@@ -0,0 +1,221 @@
+/**
+ * Restart-free installs: mount a freshly installed plugin into the running
+ * composition through a market-owned Include subtree.
+ *
+ * Durable state stays with the profile's `dsh.profile.bundles` (reconciled by
+ * the dsh CLI at install time), so the next boot loads the plugin through the
+ * normal bundle layer. The subtree here exists only for the current process:
+ * its input files live under `<profile>/.dsh-market/` and are wiped on every
+ * boot, so a crash can never leave a file that collides with the bundle layer
+ * (inserting an id the bundle layer also inserts is a hard boot failure).
+ * `state.json` in the same directory is the market's own durable state
+ * (disable list + custom groups) and deliberately survives the wipe.
+ *
+ * The Include subclass suppresses `write()` — the loader otherwise persists
+ * tree changes back to the file it read (see dsh's agent-presets PresetTree
+ * for the in-tree precedent).
+ */
+import { type Channel } from './channels.ts';
+import { type Region } from './regions.ts';
+interface HotRow {
+    id: string;
+    name: string;
+}
+interface PluginHandle {
+    await(): Promise<unknown>;
+    dispose(): Promise<unknown> | void;
+}
+interface HotContext {
+    plugin(plugin: unknown, config: unknown): PluginHandle;
+    logger?: {
+        info?(message: string): void;
+        warn(message: string): void;
+    };
+}
+/**
+ * Insert rows of a plugin's bundle patch, or null when the patch contains
+ * anything beyond plain `id`/`name` insert rows (config blocks, disables,
+ * expressions) — those compositions fall back to restart activation.
+ */
+export declare function parseSimplePatch(patchText: string): HotRow[] | null;
+/**
+ * Wipe leftover hot-mount inputs; call once when the market host starts.
+ * `state.json` (disable choices + groups) deliberately survives.
+ */
+export declare function cleanHotDir(profileDir: string): void;
+/** Persisted market state: the generic disable list plus custom groups. */
+export interface MarketState {
+    /** Plugins the user switched off; replayed at every boot. */
+    disabled: Set<string>;
+    /** User-defined plugin groups: group name → member package names. */
+    groups: Record<string, string[]>;
+    /** Display order of group names; "ungrouped" is implicit and never listed. */
+    groupOrder: string[];
+    /**
+     * The user's own one-line note per installed plugin (#347).
+     *
+     * A catalog description answers "what is this", written by its author for
+     * strangers and often in a language the reader did not pick. It cannot
+     * answer "why did I install this" — which is the question someone with
+     * forty plugins is actually asking. So a note REPLACES the description on
+     * that row, and the original stays one click away.
+     *
+     * Local state like the disable list and the groups beside it: never sent
+     * anywhere, and carried by a backup because it is part of how this profile
+     * is set up.
+     *
+     * Optional on the way IN: several callers build a state object from the
+     * few fields they own and hand it to writeMarketState. Requiring this one
+     * would make every such call a silent way to erase every note — the exact
+     * shape of #339, where a partial snapshot dropped a field nobody was
+     * thinking about. Omitting it means "leave them alone" instead.
+     */
+    notes?: Record<string, string>;
+    /**
+     * The release channel the user PICKED, absent until they pick one.
+     *
+     * Absent is not the same as 'stable': with no choice on record the channel
+     * is derived from the running build, so installing a prerelease by hand
+     * puts you on the beta channel without a second step. Once chosen, the
+     * choice is the answer — including "stable" while a beta is running, which
+     * is how someone gets back off the channel.
+     */
+    channel?: Channel;
+    /**
+     * The download region in force, absent until something has decided one.
+     *
+     * Absent means "nobody has decided yet", which is what triggers the
+     * one-time network probe. Once a value is here — whether the probe wrote
+     * it or the user picked it — no further probing happens, so the market
+     * does not silently change routes between runs.
+     */
+    region?: Region;
+    /**
+     * Whether `region` was chosen by the probe rather than by the user.
+     *
+     * Only drives a one-time notice explaining why the market picked what it
+     * picked. A user who never learns a route was chosen for them has no way
+     * to know the setting exists, and no reason to look for it when something
+     * downloads oddly.
+     */
+    regionAuto?: boolean;
+    /**
+     * Catalog entry URLs the user bookmarked for later install (#414).
+     * Keys are registry `url` strings, not package names — favorites are a
+     * pre-install list, unlike groups/notes which target installed packages.
+     */
+    favorites?: string[];
+    /** User-supplied HTTPS prefix used when the built-in GitHub routes fail. */
+    githubProxy?: string;
+}
+/** Upper bound on bookmarked catalog URLs kept in state.json (#414). */
+export declare const MAX_FAVORITES = 500;
+/**
+ * Read the whole market state. Legacy `disabledSkins` (the pre-#60
+ * theme-only key) still loads; every new write uses the generic `disabled`
+ * key (#60).
+ */
+/** A note is a label, not a document: one line, bounded so state.json cannot
+ * grow without limit from a paste. */
+export declare const MAX_NOTE = 200;
+export declare function readMarketState(profileDir: string): MarketState;
+/**
+ * Persist the whole market state.
+ *
+ * Every field a caller does not carry forward is taken from disk rather than
+ * dropped. Several callers legitimately know about only one part of the
+ * state — `writeMarketState(dir, { disabled, groups, groupOrder })` appears
+ * at five call sites in routes.ts — and before #435 that shape silently
+ * erased whatever else the user had chosen:
+ *
+ * - `channel` and `region` had no fallback at all, so toggling any plugin
+ *   threw away the user's update channel and download region. Both are
+ *   deliberate choices made through the settings card, and neither has a
+ *   "clear it" path: once picked they only ever move to another value. So
+ *   an absent one always means "the caller has nothing to say", never
+ *   "the user unchose it".
+ * `notes` keeps its original rule — an explicit object wins, including an
+ * empty one, because deleting the last note has to be expressible. What made
+ * #435 lose notes was not this function but a caller: the note route wrote
+ * through a fresh read while the long-lived `marketState` in routes.ts still
+ * carried `notes: {}` from boot, and the next write from that object put the
+ * empty one back. The fix for that belongs at the call site, where the two
+ * copies are, not here — see the note route.
+ *
+ * Reading before writing costs one small JSON parse on an operation that is
+ * already doing filesystem work, and it is what makes "this function writes
+ * the whole document" safe for callers that only hold part of it.
+ */
+export declare function writeMarketState(profileDir: string, state: MarketState): void;
+/** Plugins the user switched off; skipped by the boot re-mount. */
+export declare function readDisabled(profileDir: string): Set<string>;
+/** Persist just the disable list, preserving groups and order. */
+export declare function writeDisabled(profileDir: string, disabled: Set<string>): void;
+/** @deprecated theme-specific alias — kept for pre-#60 callers. */
+export declare function readDisabledThemes(profileDir: string): Set<string>;
+/** @deprecated theme-specific alias — kept for pre-#60 callers. */
+export declare function writeDisabledThemes(profileDir: string, disabled: Set<string>): void;
+/** Package names currently live through a market hot mount (patch or shim). */
+export declare function listHotMounts(): string[];
+/** Outcome of one hot-mount attempt; `reason` explains non-`ok` results. */
+export interface HotMountResult {
+    ok: boolean;
+    /** Bilingual reason shown to the user instead of a bare restart banner. */
+    reason: string | null;
+}
+/**
+ * Dispose a plugin hot-mounted earlier in this session, removing it from the
+ * running composition immediately.
+ * @param packageName - package to unmount.
+ * @returns true when a live hot mount was found and disposed.
+ */
+export declare function hotUnmount(packageName: string): Promise<boolean>;
+/**
+ * Mount `packageName` (just installed into the profile) into the running
+ * composition.
+ * @param ctx - market host context; the subtree unwinds with the market's fiber.
+ * @param profileDir - profile the package was installed into.
+ * @param packageName - installed package to activate.
+ * @returns whether the plugin is live without a restart, plus the reason
+ * when it is not (P0-2: the UI must distinguish "restart will fix it" from
+ * "this package can never hot-mount").
+ */
+export declare function hotMount(ctx: HotContext, profileDir: string, packageName: string): Promise<HotMountResult>;
+/**
+ * Mount every installed client-only package (`dsh.client` without
+ * `dsh.bundle`) at market startup. The bundle reconcile skips these packages
+ * entirely, so without the market's shim their client bundles are unreachable
+ * in every boot — this is what makes them behave like normal plugins.
+ * @returns names that were mounted.
+ */
+export declare function mountClientOnlyDeps(ctx: HotContext, profileDir: string): Promise<string[]>;
+/**
+ * Row ids and package names the user's own patch layer (cordis.patch.yml)
+ * already contains. Line-wise scan on purpose: the file may hold structures
+ * the market's strict patch parser rejects, but any mention of a row id or
+ * package name is enough to know the user manages it (#58).
+ */
+export declare function readUserPatchControls(profileDir: string): {
+    ids: Set<string>;
+    names: Set<string>;
+};
+/**
+ * Whether the user patch layer manages `name` — matched by exact package
+ * name or by the plugin-manager row-id convention (strip the leading @,
+ * non-alphanumerics to '-', lowercase).
+ */
+export declare function patchLayerManages(controls: {
+    ids: Set<string>;
+    names: Set<string>;
+}, name: string): boolean;
+/**
+ * Delete the market's own state directory.
+ *
+ * `cleanHotDir` wipes the ephemeral hot-mount inputs on every boot but
+ * deliberately preserves `state.json` — the disable list and custom groups
+ * are the user's durable choices. Uninstalling the market is the one moment
+ * where removing them is the right thing, and only when the user asked.
+ * @returns true when a directory was there to remove.
+ */
+export declare function purgeMarketState(profileDir: string): boolean;
+export {};

package/lib/types/http.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Minimal HTTP helpers shared by every market route: JSON serialization,
+ * same-origin enforcement for mutating endpoints, and a size-capped JSON
+ * body reader.
+ */
+import type { IncomingMessage, ServerResponse } from 'node:http';
+/** Write a JSON payload with no-store caching. */
+export declare function sendJson(response: ServerResponse, status: number, payload: unknown): void;
+/** True when the request's Origin matches its Host — required on every POST route. */
+export declare function sameOrigin(request: IncomingMessage): boolean;
+/** Read and parse a JSON request body, rejecting anything over 4 KiB. */
+export declare function readJsonBody(request: IncomingMessage, maxBytes?: number): Promise<unknown>;

package/lib/types/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * dsh-market host entry: mounts the market's HTTP routes once the profile
+ * composes the webServer and shell services.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import { type MarketConfig } from './routes.ts';
+import type { SkillMarketConfig } from './skill-market/types.ts';
+export declare const name = "dsh-market";
+/** Optional cordis.yml configuration; profile defaults to `web`. */
+export type Config = Partial<Pick<MarketConfig, 'profile' | 'allowRestart' | 'maxSnapshots'>> & {
+    /** Shared Web and terminal skill-market settings. */
+    readonly skillMarket?: SkillMarketConfig;
+};
+export declare function apply(ctx: Context, config?: Config): void;

package/lib/types/install.d.ts

@@ -0,0 +1,172 @@
+/**
+ * Install orchestration: collection-repo retargeting, post-install
+ * validation that keeps broken pieces from bricking the next boot, and
+ * update staleness detection. Every function takes the plugin runner as a
+ * parameter so tests can substitute a recording fake.
+ */
+import type { InstallResult, PluginRunner } from './dsh-cli.ts';
+/** One-shot bypass for pnpm's fresh-release hold; scoped to a single command. */
+export declare const RELEASE_AGE_OVERRIDE = "--config.minimumReleaseAge=0";
+/**
+ * Longer per-request fetch timeout for one retried command. pnpm's default
+ * 60-second limit aborts large tarball downloads (github: sources fetch the
+ * WHOLE repo even for a `#path:` subdirectory plugin) on slow networks; a
+ * plain retry fails again at the same limit, so the recovery re-runs with
+ * this override once. Scoped to a single command like RELEASE_AGE_OVERRIDE.
+ */
+export declare const FETCH_TIMEOUT_OVERRIDE = "--config.fetchTimeout=600000";
+/**
+ * Stop pnpm downloading a plugin's peer dependencies (#289 by @00080000).
+ *
+ * The last resort for a peer that cannot be downloaded because it does not
+ * exist on any registry: the dsh runtime injects several `@deepseek-ai/*`
+ * packages and never publishes them, and since pnpm 8 `auto-install-peers`
+ * defaults on, so pnpm walks the peer list and 404s on one.
+ *
+ * Only on the retry, never by default. Turning it off wholesale would also
+ * stop pnpm installing the peers a plugin legitimately needs from npm, and
+ * that failure would surface much later — as a missing module at runtime
+ * rather than a clear error at install time. Narrow beats early here.
+ *
+ * Verified against pnpm 10.29.3: `peerDependencyRules.ignoreMissing` does
+ * NOT prevent the fetch (it only silences the warning), so this flag is the
+ * only lever that actually works.
+ */
+export declare const AUTO_INSTALL_PEERS_OFF = "--config.auto-install-peers=false";
+/**
+ * Whether an unresolvable package is a host peer pnpm went looking for on
+ * its own, rather than something the profile actually asks for.
+ *
+ * The same 404 means two different things and wants two different answers.
+ * A `@deepseek-ai/*` package that IS in the profile manifest is a ghost
+ * entry — left by an earlier failed operation, or hand-added — and the user
+ * has to remove that line; retrying would only fail again. One that is NOT
+ * in the manifest was never asked for by anybody: pnpm reached it by walking
+ * an installed plugin's peerDependencies, which in this ecosystem name what
+ * the runtime provides rather than what npm carries.
+ *
+ * Reading the manifest is what separates them, so this cannot live in the
+ * pure classifier.
+ */
+export declare function isUnpublishedHostPeer(pkg: string | undefined, profile: string, explicitDir?: string): boolean;
+/**
+ * Run one plugin command with automatic recovery from three known pnpm traps:
+ *
+ * - pnpm-major drift (#20 bug 2): a modules directory built by a different
+ *   pnpm major fails mutation; pnpm's documented remedy is one `install` to
+ *   recreate it — do that silently and retry the original command once.
+ * - release-age lockfile lock (#39): once a too-young release is in the
+ *   lockfile, pnpm 11 rejects EVERY later add/remove during verification —
+ *   retry once with the one-shot minimumReleaseAge bypass (safe: the young
+ *   package is already installed; the bypass only lets pnpm touch the
+ *   lockfile again).
+ * - per-request fetch timeout: large tarballs (github: sources fetch the
+ *   whole repo even for a `#path:` subdirectory) on slow networks blow
+ *   pnpm's default 60-second limit; a plain retry fails again at the same
+ *   limit, so retry once with a longer fetchTimeout.
+ *
+ * Any recognized failure that survives gets its bilingual explanation
+ * appended to stderr so the UI shows an actionable message instead of a
+ * wall of text (#20 bug 3). Cancelled runs are never recovered.
+ */
+export declare function withHoistRecovery(run: PluginRunner, profile: string, pluginArgs: string[], profileDirectory?: string): Promise<InstallResult>;
+/**
+ * Whether pnpm never started at all, so the profile cannot have been touched.
+ *
+ * Worth its own question because the update route answers a failed run by
+ * reinstalling the previous build and reporting loudly when it cannot verify
+ * that (#502 by @Ztyss): three updates in a row told the user their profile
+ * might be broken and to inspect it before restarting, when in fact nothing
+ * had been written — the command line could not launch pnpm, so package.json
+ * and node_modules were exactly as they had been.
+ * @param result - the failed run.
+ * @returns true when the failure happened before pnpm could run.
+ */
+export declare function pnpmNeverStarted(result: InstallResult): boolean;
+/**
+ * The most specific description of a failed run available, for logs.
+ *
+ * pnpm's structured error beats the stderr tail whenever there is one — see
+ * withHoistRecovery above for why the tail is nearly worthless here.
+ */
+export declare function failureDetail(result: InstallResult, limit?: number): string;
+/**
+ * Some registry entries point at collection repos whose actual plugin lives
+ * in a subdirectory — the root has no package.json (or a workspace root with
+ * no dsh surface), and pnpm installs the bare fileset with exit 0. Detect
+ * that junk install, drop it, and re-add each plugin subdirectory through
+ * pnpm's `#path:` selector (#18).
+ * @returns overall success (true when nothing needed retargeting).
+ */
+export declare function retargetCollections(run: PluginRunner, profile: string, before: Set<string>, target: string, explicitDir?: string): Promise<boolean>;
+/**
+ * Fake-success guard (#18): validate every package the install added. A
+ * piece without a dsh manifest or without its declared entry artifact
+ * (source-only checkout, build blocked by pnpm allowBuilds) would brick the
+ * next boot, so it is removed on the spot.
+ *
+ * Since #122 this also covers duplicate loader entry ids: cordis refuses to
+ * load a tree containing two entries with one id, so a TUI bundle landing in
+ * a web profile (both declare `id: storage`) leaves DSH unable to START —
+ * an error naming neither plugin, from which the market's own page is
+ * unreachable. Such a package is removed like any other bricking piece.
+ * @returns names added by this run, names kept, names removed as broken,
+ * and the id conflicts found. `added` is reported separately from `keep`
+ * because an EMPTY `added` is a different failure from "everything added was
+ * unloadable": it means the install reported success without touching the
+ * profile at all, which is a broken plugin-command channel rather than
+ * anything wrong with the plugin (#258).
+ */
+export declare function validateAddedPlugins(run: PluginRunner, profile: string, before: Set<string>, explicitDir?: string): Promise<{
+    added: string[];
+    keep: string[];
+    removedBroken: string[];
+    conflicts: {
+        name: string;
+        id: string;
+        owner: string;
+    }[];
+}>;
+/**
+ * Group flat `{id, owner}` conflict hits by the installed plugin that owns
+ * them. What the user has to decide is which PLUGINS to uninstall, not which
+ * ids to resolve, so one row per owner is the unit the market renders and
+ * acts on. Flattening the other way (one row per id) also misattributes when
+ * a candidate clashes with several installed plugins at once.
+ * @param conflicts flat hits as returned by {@link validateAddedPlugins}.
+ * @returns one entry per owner, owners and ids both in first-seen order.
+ */
+export declare function groupConflictsByOwner(conflicts: readonly {
+    id: string;
+    owner: string;
+}[]): {
+    owner: string;
+    ids: string[];
+}[];
+/**
+ * Whether a clean-exit update actually changed nothing — pnpm's
+ * minimumReleaseAge silently keeps the old version and exits 0 when the new
+ * release is "too young" (#13, #22), so a clean exit alone does not mean the
+ * update happened.
+ */
+export declare function isStaleUpdate(check: {
+    isGit: boolean;
+    beforeVersion: string | null;
+    afterVersion: string | null;
+    beforeCommit: string | null;
+    afterCommit: string | null;
+}): boolean;
+/**
+ * The package pnpm's fetcher refused to prepare because its build script is
+ * not allowlisted — `The git-hosted package "name@2.8.0" needs to execute
+ * build scripts but is not in the "allowBuilds" allowlist.` Null when the
+ * output is not this failure. Unlike ignored-builds, the package is NOT in
+ * node_modules yet (the fetcher rejects before materialization, #68).
+ */
+export declare function parsePrepareNotAllowed(stdout: string, stderr: string): string | null;
+/**
+ * Package names pnpm reported as having their build scripts ignored
+ * ("Ignored build scripts: esbuild, koffi."). Empty when none.
+ * (#6 by @qichuang321.)
+ */
+export declare function parseIgnoredBuilds(stdout: string, stderr: string): string[];

package/lib/types/log.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Event log for issue reports: what the market did and how it failed,
+ * exportable as plain text from `/dsh-market/logs`.
+ *
+ * Privacy: entries are sanitized on write — the home directory collapses to
+ * `~`, and common credential shapes (API keys, GitHub/npm tokens, bearer
+ * headers) are masked. The in-memory buffer dies with the process and holds
+ * at most {@link MAX_ENTRIES} entries; a process that also configures a
+ * persistent sink appends every event there, capped at
+ * {@link PERSISTENT_MAX_BYTES}, because the failures worth reporting most —
+ * the ones that only appear after a restart — used to take their story with
+ * them when the process died (#341).
+ */
+export type LogLevel = 'info' | 'warn' | 'error';
+/**
+ * Append one event, sanitized and truncated.
+ * @param level - severity for the export listing.
+ * @param event - short machine-ish event name (e.g. `install`, `hot-mount`).
+ * @param detail - free-form context; credentials and home paths are masked.
+ */
+export declare function logEvent(level: LogLevel, event: string, detail: string): void;
+/**
+ * Append events to a profile-owned file, or stop doing so.
+ *
+ * Called once per mount with `<profile>/.dsh-market/log.ndjson` and with
+ * `null` on dispose. An oversized file is trimmed to its newest half on
+ * configure, so one long-lived profile cannot grow it without bound.
+ * @param file - the sink file, or null to disable persistence.
+ */
+export declare function configurePersistentLog(file: string | null): void;
+/**
+ * The newest persisted lines, for the export's prior-session section.
+ * @param file - the sink file to read.
+ * @param maxLines - how many trailing lines to return.
+ * @returns parsed-or-raw lines, newest last; empty when nothing is readable.
+ */
+export declare function readPersistentLog(file: string, maxLines?: number): string[];
+/**
+ * The export document for bug reports.
+ * @param header - environment lines to prepend (version, platform — no paths).
+ * @returns plain text, newest entry last.
+ */
+export declare function exportLogs(header: Record<string, string>, snapshot?: string[], priorSessions?: string[]): string;

package/lib/types/ndjson.d.ts

@@ -0,0 +1,52 @@
+/**
+ * pnpm `--reporter=ndjson` progress parser (P1-6).
+ *
+ * pnpm's ndjson reporter is a bole stream on stdout: one JSON object per
+ * line, e.g.
+ *
+ *   {"time":...,"level":"debug","name":"pnpm:stage","prefix":"...","stage":"resolution_started"}
+ *   {"time":...,"level":"debug","name":"pnpm:progress","packageId":"...","status":"resolved"}
+ *   {"time":...,"level":"debug","name":"pnpm:fetching-progress","packageId":"...","status":"started","size":123}
+ *   {"time":...,"level":"debug","name":"pnpm:ignored-scripts","packageNames":["esbuild"]}
+ *   {"time":...,"level":"error","name":"pnpm","err":{"message":"..."}}
+ *
+ * Verified against real pnpm 11.16.0 output (2026-08). Older pnpm majors
+ * emit a different shape or nothing at all — callers fall back to human
+ * line parsing when `seen` stays false.
+ *
+ * The reducer is pure and unit-testable: `feed` mutates the tracker's
+ * internal snapshot, `snapshot` returns a serializable copy.
+ */
+export type ProgressPhase = 'resolving' | 'downloading' | 'linking' | 'building' | null;
+export interface ProgressSnapshot {
+    phase: ProgressPhase;
+    /** Distinct packages resolved/fetched so far. */
+    done: number;
+    /** Package-count total; pnpm 11's stream carries no per-run total. */
+    total: number | null;
+    /** Package being fetched/linked right now (its `packageId`), or null. */
+    currentPackage: string | null;
+    /** Bytes downloaded for the current package, when known. */
+    downloaded: number | null;
+    /** Total bytes for the current package, when known. */
+    size: number | null;
+    /** True once any structured pnpm event was parsed (ndjson works). */
+    seen: boolean;
+    /** Last fatal error message carried by the stream, if any. */
+    error: string | null;
+    /**
+     * pnpm's own error CODE from that same event (`ERR_PNPM_…`), when it
+     * carried one. The code is the part that classifies reliably: the message
+     * is prose and gets reworded between pnpm releases (#244).
+     */
+    errorCode: string | null;
+    /** Package names pnpm reported as having ignored build scripts. */
+    ignoredBuilds: string[];
+}
+export declare function emptyProgress(): ProgressSnapshot;
+export interface ProgressTracker {
+    readonly snapshot: ProgressSnapshot;
+    feed(line: string): void;
+    reset(): void;
+}
+export declare function createProgressTracker(): ProgressTracker;

package/lib/types/net.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Outbound HTTP for the market's own server-side calls.
+ *
+ * Node's global `fetch` ignores `HTTP_PROXY` / `HTTPS_PROXY` entirely
+ * (measured on Node 25: a request with an unreachable proxy configured still
+ * succeeds directly, and setting `NODE_USE_ENV_PROXY` at runtime changes
+ * nothing — it is read at startup). On a machine whose route out is a local
+ * proxy, that is not a slowdown but a different network: the catalog fetch
+ * took 9.9s direct on a reporter's machine, seconds from the 15s timeout,
+ * while their proxy sat unused a millisecond away.
+ *
+ * `setGlobalDispatcher` from the `undici` PACKAGE cannot fix this, because
+ * `globalThis.fetch` runs on Node's INTERNAL copy of undici — a different
+ * instance. Verified: with a dispatcher installed, a global fetch still
+ * produced no CONNECT at a local proxy, while undici's own fetch produced
+ * `CONNECT awesome-dsh-plugin.com:443`.
+ *
+ * So the market calls undici's fetch with an explicit dispatcher. The scope
+ * is deliberate: only requests made by this module change, and the host's
+ * own networking is left exactly as the host configured it.
+ */
+/**
+ * The proxy this process would use for the catalog, if any.
+ *
+ * The standard variables mirror `EnvHttpProxyAgent`'s own resolution
+ * deliberately, rather than picking the order that reads best, because the
+ * same answer does two jobs: it decides whether to route through undici at
+ * all, and it is what the failure message CLAIMS was tried. A helper that
+ * named a proxy undici would not have used would put a false statement in
+ * every bug report. `npm_config_*` is an additional source on top of that:
+ * npm holds its proxy in its own config namespace (a machine set up with
+ * `npm config set proxy` has the proxy in `npm_config_proxy` and nowhere
+ * else), and undici does not read it — so it is resolved here and handed to
+ * the agent explicitly in `marketFetch`.
+ *
+ * Three details are undici's, not ours (env-http-proxy-agent.js):
+ *   - lowercase wins over uppercase (`https_proxy ?? HTTPS_PROXY`)
+ *   - an https request falls back to the http proxy when no https one is set
+ *   - the value is tested for truthiness, so `HTTPS_PROXY=` — which is how
+ *     people turn a proxy off — falls through instead of masking HTTP_PROXY
+ *
+ * Blank-is-unset is ours, and only widens that last one: undici would hand a
+ * whitespace-only value to `new URL()` and throw out of the constructor.
+ * Scheme-less host:port values are also common in Windows proxy fields and
+ * npm config; proxy agents require URLs, so those default to `http://`.
+ */
+export declare function configuredProxy(): string | null;
+/**
+ * Fetch through the proxy this machine is configured to use.
+ *
+ * Falls back to the global fetch when no proxy is set, which keeps the
+ * ordinary case on the runtime's own path rather than routing it through a
+ * second HTTP stack for no reason.
+ */
+export declare function marketFetch(url: string, init?: {
+    signal?: AbortSignal;
+    headers?: Record<string, string>;
+}): Promise<Response>;