@chatcode/cco-market 1.45.1

package/lib/types/skill-market/types.d.ts

@@ -0,0 +1,71 @@
+/** Sort orders accepted by the public skill catalog. */
+export type SkillSort = 'latest' | 'downloads' | 'name';
+/** Supported installation scopes. */
+export type SkillInstallLocation = 'project' | 'user';
+/** One skill returned by the public catalog. */
+export interface SkillMarketItem {
+    readonly id: number;
+    readonly name: string;
+    readonly description: string;
+    readonly category: string;
+    readonly status: string;
+    readonly downloads: number;
+    readonly views: number;
+    readonly readme: string;
+    readonly version: string;
+    readonly author: string;
+    readonly creatorName: string;
+    readonly tags: string;
+    readonly createTime: string;
+    readonly updateTime: string;
+    readonly visibility: string;
+}
+/** Catalog list filters. */
+export interface SkillListQuery {
+    readonly search?: string;
+    readonly category?: string;
+    readonly sort?: SkillSort;
+    readonly tag?: string;
+    readonly page?: number;
+    readonly pageSize?: number;
+}
+/** One page returned by the public catalog. */
+export interface SkillListResult {
+    readonly items: readonly SkillMarketItem[];
+    readonly total: number;
+    readonly page: number;
+    readonly pageSize: number;
+}
+/** Marketplace ownership metadata stored beside an installed skill. */
+export interface SkillMarketMeta {
+    readonly id: number;
+    readonly name: string;
+    readonly version?: string;
+}
+/** A skill installed in one of the roots visible to the current session. */
+export interface InstalledSkill {
+    readonly name: string;
+    readonly location: SkillInstallLocation;
+    readonly path: string;
+    readonly marketId?: number;
+    readonly version?: string;
+}
+/** Successful installation result returned to Web and terminal callers. */
+export interface SkillInstallResult {
+    readonly skillName: string;
+    readonly installPath: string;
+    readonly location: SkillInstallLocation;
+    readonly updated: boolean;
+}
+/** Resolved runtime configuration for the skill marketplace. */
+export interface ResolvedSkillMarketConfig {
+    readonly baseUrl: string;
+    readonly requestTimeoutMs: number;
+    readonly downloadTimeoutMs: number;
+    readonly defaultPageSize: number;
+    readonly maxDownloadBytes: number;
+    readonly maxArchiveEntries: number;
+    readonly maxUncompressedBytes: number;
+}
+/** Operator overrides accepted below the plugin's `skillMarket` key. */
+export type SkillMarketConfig = Partial<ResolvedSkillMarketConfig>;

package/lib/types/skill-market/web-routes.d.ts

@@ -0,0 +1,19 @@
+import type { WebServerService } from '../routes.ts';
+import type { SkillMarketRuntime } from './runtime.ts';
+interface SessionLike {
+    readonly header: {
+        readonly cwd?: string;
+    };
+}
+interface SkillMarketWebHost {
+    readonly webServer: WebServerService;
+    readonly sessions: {
+        get(id: string): SessionLike | undefined;
+    };
+    readonly logger?: {
+        warn(message: string): void;
+    };
+}
+/** Mount local-session skill catalog and installation routes. */
+export declare function mountSkillMarketRoutes(host: SkillMarketWebHost, runtime: SkillMarketRuntime): () => void;
+export {};

package/lib/types/snapshot.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Profile snapshots — issue #98 (phase 3), implementing the snapshot half of
+ * #19: before any ordering / preset change is applied, the profile's
+ * composition-critical files are captured as a timestamped snapshot; a failed
+ * or unwanted change can be rolled back in one step.
+ *
+ * A snapshot is a single JSON document under `<profile>/.dsh-market/
+ * snapshots/<timestamp>-<seq>.json` describing the files that define the
+ * profile's composition: package.json (dependency + bundle list),
+ * cordis.patch.yml (the user patch layer) and state.json (market disable
+ * list + groups). Version 2 records optional-file absence explicitly;
+ * restoring validates every path, reconciles writes and deletions, and rolls
+ * completed actions back if a later action fails.
+ *
+ * Retention: after every create, snapshots are pruned to the most recent
+ * `maxSnapshots` (default 20); the cap is configurable through the market
+ * plugin config (`maxSnapshots`) and each snapshot can also be deleted
+ * individually from the UI.
+ */
+declare const SNAPSHOT_FORMAT = "dsh-market/profile-snapshot";
+declare const SNAPSHOT_VERSION = 2;
+interface SnapshotFile {
+    path: string;
+    /** JSON documents keep their parsed form (re-serialized on restore). */
+    json?: unknown;
+    /** Line-oriented text files (cordis.patch.yml) keep their lines. */
+    lines?: string[];
+    /** V2 records absence explicitly so restore can remove a later file. */
+    absent?: true;
+}
+export interface ProfileSnapshot {
+    /** Present on exact snapshots; omitted by legacy snapshots. */
+    format?: typeof SNAPSHOT_FORMAT;
+    /** Version 2 records all tracked paths, including explicit absence. */
+    version?: typeof SNAPSHOT_VERSION;
+    /** Snapshot id: the file basename without the .json suffix. */
+    id: string;
+    createdAt: number;
+    files: SnapshotFile[];
+}
+export type SnapshotCaptureResult = {
+    ok: true;
+    snapshot: ProfileSnapshot;
+} | {
+    ok: false;
+    error: string;
+};
+/** Default number of snapshots retained; configurable via `maxSnapshots`. */
+export declare const DEFAULT_MAX_SNAPSHOTS = 20;
+/**
+ * Prune the snapshot directory to the `max` most recent snapshots (newest
+ * first). Extra ones are deleted oldest-first. A non-positive cap is clamped
+ * to 1 — a 0/negative max must never drop the snapshot that was just created
+ * nor invert to keeping the OLDEST set (issue #98 review hardening).
+ * @returns the ids that were deleted.
+ */
+export declare function pruneSnapshots(profileDir: string, max: number): string[];
+/** @internal Deterministic newest-first order for equal-createdAt documents. */
+export declare function compareSnapshotIdsNewest(a: string, b: string): number;
+/**
+ * Capture the profile's composition into a version 2 snapshot. Missing
+ * optional files are represented explicitly. An existing optional file that
+ * cannot be read makes capture fail. Invalid market state is represented as
+ * absent because every state reader already observes it as empty and the next
+ * state write replaces it. A missing, unreadable, or invalid package.json is
+ * not snapshot-able. After creating, the directory is pruned to the most
+ * recent `maxSnapshots`.
+ */
+export declare function createProfileSnapshot(profileDir: string, maxSnapshots?: number): SnapshotCaptureResult;
+/**
+ * All snapshots for a profile, newest first. Files that are unparseable,
+ * shape-invalid (bad id/createdAt/files), or whose internal id does not match
+ * the file name are skipped — a snapshot that could never be restored is not
+ * listed (issue #98 analysis: snapshot JSON validation).
+ */
+export declare function listSnapshots(profileDir: string): ProfileSnapshot[];
+/**
+ * Restore a snapshot's files into the profile. Version 2 absence markers
+ * remove files created after capture; omitted optional files in unversioned
+ * legacy snapshots remain untouched. Every path is validated before mutation,
+ * each write uses a same-directory temp + rename, and a failure mid-restore
+ * rolls completed writes/deletions back to their pre-restore contents.
+ * @returns the paths restored; an error result when the snapshot is unsafe,
+ * unknown, or a write failed (with any partial writes rolled back).
+ */
+export declare function restoreSnapshot(profileDir: string, id: string): {
+    ok: boolean;
+    restored: string[];
+    error?: string;
+};
+/** Delete one snapshot; true only when it existed and was removed. */
+export declare function deleteSnapshot(profileDir: string, id: string): boolean;
+export {};

package/lib/types/source-migration.d.ts

@@ -0,0 +1,11 @@
+export interface GitToNpmMigration {
+    kind: 'git-to-npm';
+    /** Normalized owner/repo or owner/repo#path:/subdir identity. */
+    repo: string;
+    /** Verified npm package declared by the same catalog entry. */
+    target: string;
+}
+export declare function findGitToNpmMigration<T extends {
+    url: string;
+    npm?: unknown;
+}>(plugins: readonly T[], spec: string): GitToNpmMigration | null;

package/lib/types/sources.d.ts

@@ -0,0 +1,216 @@
+/**
+ * Registry-source knowledge: how a curated registry entry's URL maps to an
+ * installable pnpm target. Pure string logic, no I/O.
+ */
+/** Registry tarball names must be plain npm package names, nothing fancier. */
+export declare const NPM_NAME_RE: RegExp;
+/**
+ * Parse a registry source url: a github repo, optionally with a
+ * `/tree/<branch>/<subpath>` suffix (how the curated list links monorepo
+ * subpackages, e.g. dsh-plugins#theme-gallery).
+ */
+export declare function parseSourceUrl(url: string): {
+    repo: string;
+    subpath: string | null;
+} | null;
+/** Parse repository forms accepted by package.json.repository. */
+export declare function parseGitHubRepository(value: string): {
+    repo: string;
+} | null;
+/**
+ * Parse a Git remote. Unlike package metadata, a local origin may contain a
+ * proxy prefix (for example `https://proxy/https://github.com/o/r.git`). In
+ * that case only the last GitHub occurrence is considered.
+ */
+export declare function parseGitHubRemote(url: string): {
+    repo: string;
+} | null;
+/** Normalized repo identity shared by server discovery and client matching. */
+export declare function githubRepoIdentity(url: string, directory?: string | null): string | null;
+/**
+ * Repository evidence used for installed-source matching. A monorepo package
+ * contributes both its collection root and exact subpath, mirroring the
+ * identities extracted from `github:owner/repo#path:/package` specs.
+ */
+export declare function githubRepoIdentities(url: string, directory?: string | null): string[];
+/** Weak identity hints from a local Git origin; never used to reject a unique match. */
+export declare function githubRemoteIdentities(url: string, directory?: string | null): string[];
+/** GitHub `owner/repo` for a registry URL, or null when it is not a GitHub repo URL. */
+export declare function repoOf(url: string): string | null;
+/**
+ * A commit-pinned codeload tarball URL, optionally behind a prefix proxy.
+ *
+ * Pinned to a SHA rather than `HEAD` on purpose. pnpm records whatever URL
+ * it was given, and the profile's version detection reads the installed
+ * commit back out of the lockfile by matching `codeload.github.com/owner/
+ * repo/tar.gz/<40 hex>` (src/profile.ts). A `HEAD` URL installs fine and
+ * then reports no version forever, which is a worse outcome than being slow.
+ *
+ * @param repo - `owner/repo`.
+ * @param sha - full 40-character commit SHA.
+ * @param proxy - prefix proxy, or null to address codeload directly.
+ */
+export declare function codeloadTarball(repo: string, sha: string, proxy: string | null): string;
+/**
+ * Extract a GitHub repo URL from a URL that may be a Release asset tarball
+ * (the format used by the catalog: releases/latest/download/ or
+ * releases/download/vX.Y.Z/).
+ *
+ * THIS IS FOR DISPLAY/LOOKUP PURPOSES ONLY — e.g., finding update notes for a
+ * plugin installed via npm. It MUST NOT be used for any decision that affects
+ * installation, rollback, duplicate detection, or build-script approval.
+ * Those paths use `repoFromTarget` / `repoOfTarget` which are stricter and
+ * intentionally do NOT recognize Release asset URLs (because the same asset
+ * URL can serve different bytes at different times).
+ */
+export declare function lookupRepoFromUrl(url: string): string | null;
+/**
+ * Normalized identity of an install target, for comparing two targets that
+ * may be spelled differently — lowercased, matching `githubRepoIdentity`.
+ *
+ * @returns the identity, or null when the spec is not a GitHub source (an
+ * npm package name, a `file:` link, anything else).
+ */
+export declare function repoOfTarget(spec: string): string | null;
+/**
+ * The branch or tag a GitHub spec selects, or null for the default branch.
+ *
+ * Update detection has to ask about the same ref the install used, or it
+ * compares the installed commit against a line the user never chose (#446).
+ * A commit pin yields null: the answer for a pinned install is the default
+ * branch, which is what "is there something newer" means there.
+ */
+export declare function githubRefOfTarget(spec: string): string | null;
+/**
+ * An immutable GitHub commit already carried by an install target.
+ *
+ * Build-script approval on pnpm below 11.21 needs the exact commit-pinned
+ * codeload key. Re-resolving HEAD after an install can race a repository push
+ * and approve a different URL, so consume an existing pin whenever the spec
+ * has one (#285/#385).
+ */
+export declare function githubCommitOfTarget(spec: string): string | null;
+/**
+ * Pin a GitHub shortcut to one immutable commit without losing its subpath.
+ * Revision selectors are replaced; one valid `path:` selector is preserved.
+ */
+export declare function githubTargetAtCommit(spec: string, sha: string): string | null;
+/**
+ * The allowBuilds key that actually authorizes a git-hosted dependency's
+ * build scripts. Verified against pnpm 11.21 (#68 by @yzr278892): for a
+ * `github:owner/repo` install, a bare `name: true` entry does NOT match —
+ * pnpm's own hint names a commit-pinned codeload URL that changes on every
+ * push; the stable form that matches is `name@git+https://github.com/owner/repo.git`.
+ *
+ * A legacy China-region install may address the SAME repo through a proxied
+ * codeload URL, and must authorize under the same key: the plugin a user
+ * approved build scripts for does not become a different plugin because its
+ * stored source spelling differs.
+ *
+ * @param name - installed package name.
+ * @param spec - the dependency spec from package.json, or the install target.
+ * @returns the stable key, or null when the spec is not github-hosted.
+ */
+export declare function gitAllowBuildsKey(name: string, spec: string): string | null;
+/**
+ * The OTHER allowBuilds key form, for pnpm below 11.21 (#285 by @omdsh-dev,
+ * following #267).
+ *
+ * The stable `name@git+https://…` key above is what pnpm 11.21+ matches, and
+ * it is the better key precisely because it does not change when the
+ * repository is pushed to. Older pnpm does not match it at all: 11.8.0 — the
+ * version DSH Desktop still bundles — matches only the commit-pinned
+ * codeload URL it names in its own `ERR_PNPM_GIT_DEP_PREPARE_NOT_ALLOWED`
+ * message. On those versions the "allow build scripts and retry" button
+ * could never work, because the key it wrote was one pnpm would never read.
+ *
+ * Both are written. The pinned form goes stale the moment the repository
+ * moves, which is why it cannot REPLACE the stable one — but a stale entry
+ * costs a line in a YAML file, and a missing one costs the user the only
+ * button that could have unblocked them.
+ *
+ * @param sha - the commit the install will actually fetch.
+ * @returns the key, or null when the spec is not github-hosted.
+ */
+export declare function codeloadAllowBuildsKey(name: string, spec: string, sha: string): string | null;
+/**
+ * The pnpm install target for a registry entry. Repo-verified npm packages
+ * win, followed by author-supplied prebuilt GitHub Release tarballs; both avoid
+ * full-repo downloads and local build scripts.
+ * @returns the target spec, or null when the source url is unsupported.
+ */
+export declare function installTargetFor(entry: {
+    url: string;
+    npm?: unknown;
+    tarball?: unknown;
+}): string | null;
+/** True for profile specs that are a local checkout or tarball, not a registry pin. */
+export declare function isLocalSpec(spec: string): boolean;
+/**
+ * True when the install came from a git remote — GitHub shortcuts, codeload
+ * tarballs, and any other host (Gitea, GitLab self-host, raw `git+https://…`).
+ *
+ * Update detection used to ask only `repoOfTarget` (GitHub spellings). A
+ * private-host URL then fell through to the npm branch and was looked up by
+ * package name; a colliding registry package read as an "update" and
+ * `name@latest` replaced the git install (#525).
+ */
+export declare function isGitHostedSpec(spec: string): boolean;
+/**
+ * Immutable commit already carried by a non-shortcut git URL (`…git#<sha>`).
+ * GitHub shortcuts keep using `githubCommitOfTarget`.
+ */
+export declare function gitCommitOfTarget(spec: string): string | null;
+/**
+ * pnpm add target for updating a non-shortcut git install: drop a full-SHA
+ * pin so the remote re-resolves to HEAD, keep any branch/tag fragment.
+ * GitHub-hosted `git+https://github.com/…` is rewritten to `github:` — the
+ * market's canonical spelling — so a successful update rematerializes the
+ * dependency that way and later check/update/rollback can use the first-class
+ * GitHub path. This turn still installs through the generic-git target slot
+ * (no region acceleration on the rewritten shortcut itself).
+ */
+export declare function gitUpdateTarget(spec: string): string | null;
+/**
+ * Smart-HTTP info/refs URL for a git-hosted install target, or null when the
+ * transport cannot be probed with `fetch` (scp / git:// / ssh://).
+ * Userinfo is stripped so update checks do not resend embedded credentials.
+ */
+export declare function gitUploadPackUrl(spec: string): string | null;
+export { findCatalogEntryForLocal, resolveCatalogRestore } from './catalog-local-match.ts';
+/**
+ * pnpm add target for restoring a local checkout onto a catalog entry.
+ * When the catalog only lists the collection root but the checkout declared
+ * `repository.directory`, keep that subdirectory — otherwise we install the
+ * repo tarball and get the wrong package name (and its build scripts).
+ */
+export declare function restoreTargetForLocal(entry: {
+    url: string;
+    npm?: unknown;
+}, identities?: readonly string[]): string | null;
+/**
+ * Dependency names that use pnpm's `workspace:` protocol.
+ * Those specs only resolve inside the author's monorepo; a git `#path:`
+ * install into a profile cannot see the sibling packages. pnpm installs
+ * optional dependencies and auto-installs peers too, so all three maps are
+ * scanned; devDependencies are never installed and stay out.
+ */
+export declare function workspaceProtocolDeps(manifest: unknown): string[];
+/** Git subdirectory restores cannot satisfy `workspace:` dependencies. npm can. */
+export declare function restoreBlockedByWorkspace(target: string, workspaceDeps: readonly string[]): boolean;
+/**
+ * The name an entry is ALREADY installed under, or null — the server-side
+ * duplicate guard (#27): the same plugin listed under an alias entry must
+ * never install twice (two loader entries with one id brick the next boot).
+ *
+ * Identity is subpath-aware so monorepo siblings stay independent: an entry
+ * with a /tree/ subpath identifies as repo#path:/sub (never the bare repo),
+ * while an installed dependency contributes its bare repo AND its #path:
+ * form — so a collection root still matches the pieces it was retargeted
+ * into, but two different subpackages of one repo never cross-match.
+ */
+export declare function findInstalledAlias(entry: {
+    name: string;
+    npm?: unknown;
+    url: string;
+}, installed: Record<string, string>): string | null;

package/lib/types/store.d.ts

@@ -0,0 +1,30 @@
+/**
+ * pnpm store hygiene: reclaim staging directories orphaned by aborted runs.
+ *
+ * pnpm extracts every fetched tarball under the store's `tmp/` directory as
+ * `tmp/_tmp_<pid>_<hex>/`. A run that is killed, cancelled, or timed out —
+ * or one that hard-fails mid-fetch — never finishes that staging step, so
+ * the directory survives. For `github:` sources the staged payload is the
+ * WHOLE repository tarball, so a single aborted install can leave hundreds
+ * of megabytes behind (e.g. an OpenViking monorepo install killed at ~88MB).
+ *
+ * The directory name carries the owning pnpm process id, which makes
+ * reclamation safe by construction: when that pid is gone, no live download
+ * can be using the directory. Live pnpm tmp dirs are never touched.
+ */
+import type { PluginRunner } from './dsh-cli.ts';
+/**
+ * Remove every orphaned staging directory under a pnpm store's `tmp/` whose
+ * owning pid is no longer alive. Directories that do not match the pnpm
+ * staging shape, and any that are locked or in use, are left alone.
+ * @param storePath - the pnpm store root (as printed by `pnpm store path`).
+ * @returns the removed directory names.
+ */
+export declare function cleanOrphanedStoreTmp(storePath: string): string[];
+/**
+ * Resolve the active profile's pnpm store root through the same runner the
+ * market uses for installs (so both the web and Desktop pnpm paths agree)
+ * and reclaim its orphaned staging directories.
+ * @returns the removed directory names, empty when the store cannot be resolved.
+ */
+export declare function cleanOrphanedStore(run: PluginRunner, profile: string): Promise<string[]>;

package/lib/types/themes.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Theme lifecycle: classifying installed packages as themes (by the
+ * registry's theme category), live-toggling bundle-layer entries through
+ * the loader, and keeping exactly one theme active with the choice
+ * persisted across restarts.
+ */
+/** The slice of a cordis loader entry the market needs for live enable/disable. */
+export interface LoaderEntry {
+    options: {
+        id?: string;
+        name?: string;
+        disabled?: boolean | null;
+    };
+    fiber?: unknown;
+    update(options: {
+        disabled: boolean | null;
+    }, create?: boolean, force?: boolean): Promise<void>;
+}
+/** The host surface the theme manager needs (loader entries + hot-mount context). */
+export interface ThemeHost {
+    loader: {
+        entries(): Iterable<LoaderEntry>;
+    };
+    plugin(plugin: unknown, config: unknown): {
+        await(): Promise<unknown>;
+        dispose(): Promise<unknown> | void;
+    };
+}
+/** Manages theme exclusivity for one profile. */
+export interface ThemeManager {
+    installedThemeNames(): Promise<Set<string>>;
+    setEntryDisabled(name: string, disabledFlag: boolean): Promise<boolean>;
+    activateTheme(name: string): Promise<boolean>;
+}
+/**
+ * Create the theme manager. `disabledThemes` is the live, shared set of
+ * themes the user switched off — the caller owns reading it at boot and
+ * replaying it; the manager mutates and persists it on switches.
+ */
+export declare function createThemeManager(host: ThemeHost, profile: string, disabledThemes: Set<string>, explicitDir?: string): ThemeManager;

package/lib/types/trial.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Trial validation for composition changes — issue #98 (phase 3), the
+ * "trial boot" half of #19 reduced to what is safe and offline: before any
+ * bundle-order or preset change is written to the profile, replay the
+ * composition with the CANDIDATE order using the same entry-list machinery
+ * the real boot uses (src/check.ts's buildBundleLayers + composeLayers), and
+ * refuse the change when the composed tree would fail to boot (duplicate
+ * loader entry ids, unresolvable bundle layers, unparseable patches).
+ *
+ * No process, no network, no writes to the profile: the real profile is only
+ * read; if the candidate is bad, the failure is reported and nothing is
+ * applied (the caller then skips the write-back entirely).
+ *
+ * Issue #125 review: the CURRENT composition is replayed alongside the
+ * candidate, so the response also carries a current-vs-candidate diff
+ * (overrides / orphans / duplicates the reorder introduces) — not just
+ * whether it boots.
+ *
+ * Bundle resolution is deliberately SHARED with the check report
+ * (check.ts's buildBundleLayers): the dsh installation anchor first, then
+ * Node's module search from the profile (workspace-root hoisting) — so the
+ * trial can never disagree with the diagnostics about what a bundle is or
+ * where it lives, and official bundles resolve even when they are only
+ * hoisted to the workspace root.
+ */
+import { type DuplicateId, type OrphanRow, type OverrideRow } from './check.ts';
+export interface TrialIssue {
+    layer: string;
+    message: string;
+}
+/** Current-vs-candidate composition diff (issue #125 review). */
+export interface TrialDiff {
+    /** Override relationships introduced by the candidate (not present in the current composition). */
+    overrides: OverrideRow[];
+    /** Orphan rows introduced by the candidate. */
+    orphans: OrphanRow[];
+    /** Duplicate loader entry ids introduced by the candidate. */
+    duplicates: DuplicateId[];
+}
+export interface TrialResult {
+    ok: boolean;
+    errors: TrialIssue[];
+    warnings: TrialIssue[];
+    duplicates: DuplicateId[];
+    /** The composed loader rows under the candidate order. */
+    rows: {
+        id: string;
+        layer: string;
+    }[];
+    /** What the reorder would change vs the current composition (issue #125 review). */
+    diff: TrialDiff;
+}
+/**
+ * Replay the profile composition with `newCommunityOrder` (the candidate
+ * community-bundle order; official bundles keep their exact positions) and
+ * report anything that would break the boot. Pure read.
+ */
+export declare function trialValidate(profileDir: string, newCommunityOrder: string[], options?: {
+    dshInstallDir?: string | null;
+    homeDir?: string;
+}): TrialResult;

package/lib/types/update-api-v1.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Stable, versioned contract for plugin-owned update surfaces.
+ *
+ * The market UI has richer internal response shapes that evolve with its UI.
+ * Third-party plugins must not depend on those shapes, so this module owns the
+ * small JSON envelope exposed under `/dsh-market/api/v1`.
+ */
+import type { InstallProgress } from './dsh-cli.ts';
+export declare const UPDATE_API_V1_SCHEMA: 'dsh-market/update-api/v1';
+export declare const MAX_UPDATE_OPERATIONS_V1 = 50;
+export type UpdateOperationState = 'queued' | 'running' | 'succeeded' | 'failed' | 'cancelled' | 'rolled-back';
+export interface UpdateFailureV1 {
+    code: string;
+    message: string;
+    retryable: boolean;
+}
+export interface UpdateOperationV1 {
+    schema: typeof UPDATE_API_V1_SCHEMA;
+    operationId: string;
+    kind: 'update';
+    packageName: string;
+    state: UpdateOperationState;
+    createdAt: number;
+    startedAt: number | null;
+    finishedAt: number | null;
+    beforeVersion: string | null;
+    installedVersion: string | null;
+    progress: {
+        phase: string | null;
+        done: number;
+        total: number | null;
+        percent: number | null;
+        currentPackage: string | null;
+        detail: string | null;
+        downloaded: number | null;
+        size: number | null;
+    };
+    outcome: {
+        refreshRequired: boolean;
+        restartRequired: boolean;
+        rollback: {
+            available: boolean;
+            state: 'unavailable' | 'available' | 'running' | 'succeeded' | 'failed';
+            detail: string | null;
+        };
+    };
+    failure: UpdateFailureV1 | null;
+}
+/** Process-local operation registry. A boot id scopes ids across restarts. */
+export declare class UpdateOperationStoreV1 {
+    private readonly bootId;
+    private readonly now;
+    private readonly maxOperations;
+    private sequence;
+    private readonly operations;
+    private activeId;
+    constructor(bootId: string, now?: () => number, maxOperations?: number);
+    hasActive(): boolean;
+    create(packageName: string, beforeVersion: string | null): UpdateOperationV1;
+    start(operationId: string): void;
+    finish(operationId: string, status: number, payload: unknown, installedVersion: string | null): UpdateOperationV1 | null;
+    beginRollback(operationId: string): string | null;
+    finishRollback(operationId: string, status: number, payload: unknown, installedVersion?: string | null): UpdateOperationV1 | null;
+    get(operationId: string, progress?: InstallProgress): UpdateOperationV1 | null;
+    private snapshot;
+}