@cogenta/plugins 0.1.3 → 0.3.1

package/dist/registries/marketplace-tables.js

@@ -0,0 +1,50 @@
+import { identifier, sql, unsafeRaw, } from '@cogenta/core';
+export const MARKETPLACE_TABLES = {
+    installs: 'cogenta_marketplace_installs',
+};
+function textColumn(dialect, length) {
+    return unsafeRaw(dialect === 'sqlite' ? 'text' : `varchar(${length})`);
+}
+/**
+ * Owned by `@cogenta/plugins`, following `permissions/tables.ts`'s
+ * `ensurePluginTables` pattern exactly. One row per marketplace catalog item
+ * that has actually been installed — separate from the four submission
+ * registries (`./tables.js`), which track "may this be listed" (a review
+ * decision), never "is this active on this installation" (an install
+ * decision). `item_id` is the catalog entry's own id, not the plugin name:
+ * the catalog is the caller's concern (`createMarketplaceCatalog`), this
+ * table only remembers what was installed from it.
+ */
+export async function ensureMarketplaceTables(db) {
+    const d = db.dialect;
+    const installs = identifier(MARKETPLACE_TABLES.installs, d);
+    const t255 = textColumn(d, 255);
+    const tLong = unsafeRaw(d === 'sqlite' ? 'text' : 'text');
+    await db.query(sql `
+    create table if not exists ${installs} (
+      item_id ${t255} not null primary key,
+      kind ${t255} not null,
+      display_name ${t255} not null,
+      reference ${tLong} not null,
+      plugin_name ${t255},
+      plugin_version ${t255},
+      signature_verified ${t255} not null,
+      installed_by ${t255},
+      installed_at ${t255} not null,
+      updated_at ${t255} not null,
+      enabled ${t255} not null default 'true'
+    )`);
+    // Fiche 29 task 1 — "activer/désactiver" as a real, separate column, not
+    // a schema migration: `create table if not exists` never re-runs on an
+    // existing table, so a pre-fiche-29 install row (created before this
+    // column existed) needs it added explicitly, `default` applying only to
+    // rows the `insert` itself creates. Every dialect here supports `add
+    // column ... default` (SQLite since 3.35 for `default`-only columns,
+    // Postgres and MySQL/MariaDB unconditionally) — same portable
+    // best-effort idiom `createIndexIfMissing` already uses for "already
+    // there, not an error".
+    await db
+        .query(sql `alter table ${installs} add column enabled ${t255} not null default 'true'`)
+        .catch(() => undefined);
+}
+//# sourceMappingURL=marketplace-tables.js.map

package/dist/registries/marketplace-tables.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace-tables.js","sourceRoot":"","sources":["../../src/registries/marketplace-tables.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,UAAU,EAEV,GAAG,EACH,SAAS,GACV,MAAM,eAAe,CAAA;AAEtB,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,QAAQ,EAAE,8BAA8B;CAChC,CAAA;AAEV,SAAS,UAAU,CAAC,OAAwB,EAAE,MAAc;IAC1D,OAAO,SAAS,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,MAAM,GAAG,CAAC,CAAA;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,EAAkB;IAC9D,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAA;IACpB,MAAM,QAAQ,GAAG,UAAU,CAAC,kBAAkB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IAEzD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iCACa,QAAQ;gBACzB,IAAI;aACP,IAAI;qBACI,IAAI;kBACP,KAAK;oBACH,IAAI;uBACD,IAAI;2BACA,IAAI;qBACV,IAAI;qBACJ,IAAI;mBACN,IAAI;gBACP,IAAI;MACd,CAAC,CAAA;IAEL,yEAAyE;IACzE,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,qEAAqE;IACrE,qEAAqE;IACrE,8DAA8D;IAC9D,qEAAqE;IACrE,wBAAwB;IACxB,MAAM,EAAE;SACL,KAAK,CAAC,GAAG,CAAA,eAAe,QAAQ,uBAAuB,IAAI,0BAA0B,CAAC;SACtF,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;AAC3B,CAAC"}

package/dist/registries/marketplace.d.ts

@@ -0,0 +1,170 @@
+import { type DatabaseHandle } from '@cogenta/core';
+import { type PluginCapabilityDescription } from '../permissions/describe.js';
+import type { PluginDisableStore } from '../permissions/disabled.js';
+import type { PluginGrantStore } from '../permissions/grants.js';
+import type { PluginUsageStore } from '../permissions/usage.js';
+/**
+ * L17 task 1 — "Registre consultable (recherche, catégories)".
+ *
+ * Scoped, deliberately, as a **local/embedded** catalog: the lot doc names a
+ * dependency on L13 task 8 (API keys) "si la marketplace est un service
+ * distinct interrogé par API" — L13 task 8 was never built in this
+ * repository, so there is no real remote marketplace service to call. This
+ * is an in-memory, read-only directory of installable items the caller
+ * assembles (e.g. `@cogenta/cli` wiring already-installed local plugins
+ * alongside a small example catalog) — not a second submission-review
+ * pipeline like the four `./tables.js` registries, and not a fetch to any
+ * external host.
+ */
+export type MarketplaceItemKind = 'plugin' | 'theme' | 'skin' | 'skill';
+export interface MarketplaceChangelogEntry {
+    readonly version: string;
+    readonly notes: string;
+    /** Fiche 29 task 5 — "date de la dernière mise à jour", read off the newest changelog entry when present. */
+    readonly releasedAt?: string;
+}
+export interface MarketplaceCatalogEntry {
+    readonly id: string;
+    readonly kind: MarketplaceItemKind;
+    readonly displayName: string;
+    readonly description: string;
+    /** Free-text category, used for the catalog's category filter. */
+    readonly category: string;
+    /**
+     * Opaque to the catalog itself — for `kind: 'plugin'`, an absolute local
+     * directory `loadMarketplacePlugin` can resolve. Never interpreted here.
+     */
+    readonly reference: string;
+    /** Fiche 29 task 5 — "Auteur, source" shown on the compatibility/trust panel before install. Caller-supplied, deployer-authored catalog metadata; never derived from the manifest (which has no author field). */
+    readonly author?: string;
+    readonly screenshots?: readonly string[];
+    readonly changelog?: readonly MarketplaceChangelogEntry[];
+}
+export interface MarketplaceCatalogFilter {
+    readonly kind?: MarketplaceItemKind;
+    /** Matched, case-insensitively, against `displayName`, `description` and `category`. */
+    readonly query?: string;
+}
+export interface MarketplaceCatalog {
+    list(filter?: MarketplaceCatalogFilter): readonly MarketplaceCatalogEntry[];
+    get(id: string): MarketplaceCatalogEntry | null;
+}
+/** A read-only in-memory catalog over a caller-supplied entry list. */
+export declare function createMarketplaceCatalog(entries: readonly MarketplaceCatalogEntry[]): MarketplaceCatalog;
+/** One installed marketplace item, as persisted. */
+export interface MarketplaceInstallRecord {
+    readonly itemId: string;
+    readonly kind: MarketplaceItemKind;
+    readonly displayName: string;
+    readonly reference: string;
+    readonly pluginName: string | null;
+    readonly pluginVersion: string | null;
+    readonly signatureVerified: boolean;
+    readonly installedBy: string | null;
+    readonly installedAt: string;
+    readonly updatedAt: string;
+    /** Fiche 29 task 1 — the manual activate/deactivate toggle, independent of `@cogenta/plugins`' automatic `PluginDisableStore` (a timeout/memory/crash violation, task 6 of L7). Both can make a plugin non-runnable; this is only the human-chosen half. */
+    readonly enabled: boolean;
+}
+/** What viewing an item's "fiche détaillée" (task 3) needs, before installing. */
+export interface MarketplacePreview {
+    readonly entry: MarketplaceCatalogEntry;
+    readonly supported: boolean;
+    readonly signatureVerified: boolean;
+    readonly capabilities: readonly (PluginCapabilityDescription & {
+        readonly capability: string;
+    })[];
+    /** Set when resolution/verification failed — the real `CogentaError` code, e.g. `PLUGIN_SIGNATURE_INVALID`. */
+    readonly error?: {
+        readonly code: string;
+        readonly message: string;
+    };
+    /**
+     * Fiche 29 task 5 — "Version de Cogenta requise, vérifiée avant
+     * l'installation, avec un refus clair". `null` only when resolution
+     * itself failed (`error` is set) — there is no manifest to check
+     * compatibility against. Computed by `loadMarketplacePlugin` from the
+     * `engineVersion` this installer was constructed with; `install`/`update`
+     * refuse honestly (`MARKETPLACE_ENGINE_INCOMPATIBLE`) rather than let an
+     * incompatible plugin fail at runtime instead.
+     */
+    readonly engineCompatible: boolean | null;
+    /** The resolvable manifest's own version — `null` only when resolution failed. Compared against an installed item's `pluginVersion` to answer "is an update available" (task 2). */
+    readonly latestVersion: string | null;
+    /** Fiche 29 task 5 — "source". Always `'registry'` when `supported`: `install`/`update` always call `loadMarketplacePlugin`, which classifies every marketplace item as registry-trust regardless of whether its `reference` happens to be a local path (see that function's own doc comment). */
+    readonly source: 'registry' | null;
+}
+export interface MarketplaceUpdateResult {
+    readonly record: MarketplaceInstallRecord;
+    /** Newly-declared capabilities the previous grants don't cover — never auto-granted, ever. */
+    readonly pendingApproval: readonly (PluginCapabilityDescription & {
+        readonly capability: string;
+    })[];
+}
+export interface MarketplaceInstaller {
+    /** Resolves and verifies signature — never installs, never throws for a bad signature (returns it in `error`). */
+    preview(entry: MarketplaceCatalogEntry): Promise<MarketplacePreview>;
+    /**
+     * Installs one catalog entry. **Only `kind: 'plugin'` is supported** —
+     * L17's own "pièges connus" line ("une marketplace est une nouvelle
+     * surface de confiance") is specifically about code execution, which only
+     * a plugin does; theme/skin/skill installation is out of scope for this
+     * pass and refused honestly (`MARKETPLACE_KIND_UNSUPPORTED`) rather than
+     * silently accepted with no real verification behind it.
+     *
+     * Always calls `loadMarketplacePlugin`, which always requires (and
+     * verifies) a signature — there is no parameter here, and none upstream,
+     * that can skip that call. A missing or invalid signature throws the real
+     * `PLUGIN_SIGNATURE_MISSING`/`PLUGIN_SIGNATURE_INVALID` and nothing is
+     * persisted.
+     */
+    install(entry: MarketplaceCatalogEntry, actorId: string | null): Promise<MarketplaceInstallRecord>;
+    /**
+     * Re-verifies signature against a (possibly new) catalog entry for an
+     * already-installed item. If the resolved manifest declares a capability
+     * no existing grant covers, the update is refused
+     * (`MARKETPLACE_UPDATE_REQUIRES_APPROVAL`) unless the caller passes
+     * `confirmPendingPermissions: true` — and even then, no capability is
+     * granted here: `PluginGrantStore.grant` is a separate, explicit step, so
+     * "confirming" only unblocks the version bump, never auto-grants.
+     */
+    update(entry: MarketplaceCatalogEntry, actorId: string | null, options?: {
+        readonly confirmPendingPermissions?: boolean;
+    }): Promise<MarketplaceUpdateResult>;
+    list(): Promise<readonly MarketplaceInstallRecord[]>;
+    get(itemId: string): Promise<MarketplaceInstallRecord | null>;
+    /**
+     * Fiche 29 task 4 — "désinstallation propre". `removeData: true` also
+     * revokes every active capability grant for the plugin
+     * (`PluginGrantStore.revokeAll`) and, when a disable/usage store was
+     * supplied to this installer, clears its auto-disable record and
+     * accumulated resource usage — irreversible, matching the router's own
+     * "confirmation forte" for this path. Without it (the default), only the
+     * install row is removed: grants, the disable record and usage history
+     * all survive, which is what makes a later reinstall able to pick up
+     * exactly where the plugin left off.
+     */
+    uninstall(itemId: string, options?: {
+        readonly removeData?: boolean;
+    }): Promise<void>;
+    /** Fiche 29 task 1 — the manual half of "activer/désactiver" (`MarketplaceInstallRecord.enabled`). Activating an item still auto-disabled (`PluginDisableStore`) does not by itself make it runnable again — that decision is `PluginDisableStore.enable`'s, deliberately kept a separate, explicit action (the router composes both). */
+    activate(itemId: string): Promise<MarketplaceInstallRecord>;
+    deactivate(itemId: string): Promise<MarketplaceInstallRecord>;
+}
+export interface MarketplaceInstallerOptions {
+    readonly trustedPublicKeys?: readonly string[];
+    readonly grantStore: PluginGrantStore;
+    readonly now?: () => number;
+    /**
+     * Cogenta's own version, checked against a resolved manifest's `engine`
+     * range (fiche 29 task 5). Passed straight through to
+     * `loadMarketplacePlugin` — see `LoadPluginOptions.engineVersion` for why
+     * the default is an honest placeholder rather than a fabricated pass.
+     */
+    readonly engineVersion?: string;
+    /** Fiche 29 task 4 — only consulted by `uninstall(id, { removeData: true })`; a plain uninstall never touches either store. */
+    readonly disableStore?: PluginDisableStore;
+    readonly usageStore?: PluginUsageStore;
+}
+export declare function createMarketplaceInstaller(db: DatabaseHandle, options: MarketplaceInstallerOptions): MarketplaceInstaller;
+//# sourceMappingURL=marketplace.d.ts.map

package/dist/registries/marketplace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace.d.ts","sourceRoot":"","sources":["../../src/registries/marketplace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAAmB,MAAM,eAAe,CAAA;AAElF,OAAO,EAAsB,KAAK,2BAA2B,EAAE,MAAM,4BAA4B,CAAA;AACjG,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AACpE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAA;AAEhE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAG/D;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,CAAA;AAEvE,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,6GAA6G;IAC7G,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,kNAAkN;IAClN,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACxC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,yBAAyB,EAAE,CAAA;CAC1D;AAED,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,CAAC,EAAE,mBAAmB,CAAA;IACnC,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,MAAM,CAAC,EAAE,wBAAwB,GAAG,SAAS,uBAAuB,EAAE,CAAA;IAC3E,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,uBAAuB,GAAG,IAAI,CAAA;CAChD;AAaD,uEAAuE;AACvE,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,SAAS,uBAAuB,EAAE,GAC1C,kBAAkB,CAUpB;AAED,oDAAoD;AACpD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,4PAA4P;IAC5P,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAC1B;AAED,kFAAkF;AAClF,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,uBAAuB,CAAA;IACvC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,YAAY,EAAE,SAAS,CAAC,2BAA2B,GAAG;QAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,EAAE,CAAA;IACjG,+GAA+G;IAC/G,QAAQ,CAAC,KAAK,CAAC,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;IACpE;;;;;;;;OAQG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAA;IACzC,oLAAoL;IACpL,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,kSAAkS;IAClS,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAAA;CACnC;AAED,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,MAAM,EAAE,wBAAwB,CAAA;IACzC,8FAA8F;IAC9F,QAAQ,CAAC,eAAe,EAAE,SAAS,CAAC,2BAA2B,GAAG;QAChE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;KAC5B,CAAC,EAAE,CAAA;CACL;AAED,MAAM,WAAW,oBAAoB;IACnC,kHAAkH;IAClH,OAAO,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACpE;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAClG;;;;;;;;OAQG;IACH,MAAM,CACJ,KAAK,EAAE,uBAAuB,EAC9B,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzD,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACnC,IAAI,IAAI,OAAO,CAAC,SAAS,wBAAwB,EAAE,CAAC,CAAA;IACpD,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAAA;IAC7D;;;;;;;;;;OAUG;IACH,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACrF,0UAA0U;IAC1U,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;IAC3D,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;CAC9D;AAED,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9C,QAAQ,CAAC,UAAU,EAAE,gBAAgB,CAAA;IACrC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAC3B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,+HAA+H;IAC/H,QAAQ,CAAC,YAAY,CAAC,EAAE,kBAAkB,CAAA;IAC1C,QAAQ,CAAC,UAAU,CAAC,EAAE,gBAAgB,CAAA;CACvC;AA+DD,wBAAgB,0BAA0B,CACxC,EAAE,EAAE,cAAc,EAClB,OAAO,EAAE,2BAA2B,GACnC,oBAAoB,CAgQtB"}

package/dist/registries/marketplace.js

@@ -0,0 +1,278 @@
+import { CogentaError, identifier, sql } from '@cogenta/core';
+import { loadMarketplacePlugin } from '../loader.js';
+import { describeCapability } from '../permissions/describe.js';
+import { detectCapabilitiesNeedingApproval } from '../permissions/resolve.js';
+import { MARKETPLACE_TABLES } from './marketplace-tables.js';
+function matches(entry, filter) {
+    if (filter.kind !== undefined && entry.kind !== filter.kind)
+        return false;
+    if (filter.query === undefined || filter.query.trim() === '')
+        return true;
+    const needle = filter.query.trim().toLowerCase();
+    return (entry.displayName.toLowerCase().includes(needle) ||
+        entry.description.toLowerCase().includes(needle) ||
+        entry.category.toLowerCase().includes(needle));
+}
+/** A read-only in-memory catalog over a caller-supplied entry list. */
+export function createMarketplaceCatalog(entries) {
+    const byId = new Map(entries.map((entry) => [entry.id, entry]));
+    return {
+        list(filter = {}) {
+            return entries.filter((entry) => matches(entry, filter));
+        },
+        get(id) {
+            return byId.get(id) ?? null;
+        },
+    };
+}
+function toRecord(row) {
+    return {
+        itemId: row.item_id,
+        kind: row.kind,
+        displayName: row.display_name,
+        reference: row.reference,
+        pluginName: row.plugin_name,
+        pluginVersion: row.plugin_version,
+        signatureVerified: row.signature_verified === 'true',
+        installedBy: row.installed_by,
+        installedAt: row.installed_at,
+        updatedAt: row.updated_at,
+        // `enabled` is nullable at the SQL level only because a row created
+        // before fiche 29's `alter table ... add column` ran has no explicit
+        // value in older engines that ignore `default` on backfill — treated as
+        // "still active", matching every pre-existing install's real state.
+        enabled: row.enabled !== 'false',
+    };
+}
+function engineIncompatible(entry, manifest) {
+    return new CogentaError({
+        code: 'MARKETPLACE_ENGINE_INCOMPATIBLE',
+        message: `"${entry.displayName}" requires Cogenta "${manifest.engine}", which this installation does not satisfy.`,
+        hint: 'Upgrade Cogenta, or choose a version of this item compatible with the current installation.',
+        details: { itemId: entry.id, engine: manifest.engine },
+    });
+}
+function unsupportedKind(entry) {
+    return new CogentaError({
+        code: 'MARKETPLACE_KIND_UNSUPPORTED',
+        message: `The marketplace does not install "${entry.kind}" items yet — only "plugin".`,
+        hint: 'Themes, skins and skills go through their own registries (@cogenta/plugins’ createThemeRegistry/createSkinGallery/createSkillRegistry) for now.',
+        details: { itemId: entry.id, kind: entry.kind },
+    });
+}
+function describeAll(capabilities) {
+    return capabilities.map((capability) => ({ capability, ...describeCapability(capability) }));
+}
+export function createMarketplaceInstaller(db, options) {
+    const installs = identifier(MARKETPLACE_TABLES.installs, db.dialect);
+    const now = options.now ?? Date.now;
+    const trustedPublicKeys = options.trustedPublicKeys ?? [];
+    const grantStore = options.grantStore;
+    const engineVersion = options.engineVersion;
+    async function getRecord(itemId) {
+        const result = await db.query(sql `
+      select * from ${installs} where item_id = ${itemId}`);
+        const row = result.rows[0];
+        return row === undefined ? null : toRecord(row);
+    }
+    async function setEnabled(itemId, enabled) {
+        await db.query(sql `
+      update ${installs} set enabled = ${String(enabled)}, updated_at = ${new Date(now()).toISOString()}
+      where item_id = ${itemId}`);
+        const record = await getRecord(itemId);
+        if (record === null) {
+            throw new CogentaError({
+                code: 'MARKETPLACE_NOT_INSTALLED',
+                message: `"${itemId}" is not installed.`,
+                hint: 'Install it first.',
+                details: { itemId },
+            });
+        }
+        return record;
+    }
+    async function resolveOrError(entry) {
+        try {
+            const resolved = await loadMarketplacePlugin(entry.reference, {
+                trustedPublicKeys,
+                ...(engineVersion === undefined ? {} : { engineVersion }),
+            });
+            return {
+                ok: true,
+                manifest: resolved.manifest,
+                signatureVerified: resolved.signatureVerified,
+                engineCompatible: engineVersion === undefined ? null : resolved.engineCompatible,
+            };
+        }
+        catch (error) {
+            if (error instanceof CogentaError) {
+                return { ok: false, error: { code: error.code, message: error.message } };
+            }
+            throw error;
+        }
+    }
+    return {
+        async preview(entry) {
+            if (entry.kind !== 'plugin') {
+                return {
+                    entry,
+                    supported: false,
+                    signatureVerified: false,
+                    capabilities: [],
+                    engineCompatible: null,
+                    latestVersion: null,
+                    source: null,
+                };
+            }
+            const resolution = await resolveOrError(entry);
+            if (!resolution.ok) {
+                return {
+                    entry,
+                    supported: true,
+                    signatureVerified: false,
+                    capabilities: [],
+                    error: resolution.error,
+                    engineCompatible: null,
+                    latestVersion: null,
+                    source: null,
+                };
+            }
+            return {
+                entry,
+                supported: true,
+                signatureVerified: resolution.signatureVerified,
+                capabilities: describeAll(resolution.manifest.capabilities),
+                engineCompatible: resolution.engineCompatible,
+                latestVersion: resolution.manifest.version,
+                source: 'registry',
+            };
+        },
+        async install(entry, actorId) {
+            if (entry.kind !== 'plugin')
+                throw unsupportedKind(entry);
+            // Never a soft catch here: an invalid/missing signature throws and
+            // nothing below runs — this is the one line the whole task hinges on.
+            const resolved = await loadMarketplacePlugin(entry.reference, {
+                trustedPublicKeys,
+                ...(engineVersion === undefined ? {} : { engineVersion }),
+            });
+            // Fiche 29 task 5 — refused BEFORE anything is persisted, exactly
+            // like the signature check above: an incompatible version never gets
+            // a chance to fail later at runtime instead. Only enforced once this
+            // installer was configured with a real `engineVersion` — see
+            // `resolveOrError`'s doc comment for why the default placeholder
+            // must never manufacture a refusal.
+            if (engineVersion !== undefined && !resolved.engineCompatible) {
+                throw engineIncompatible(entry, resolved.manifest);
+            }
+            const timestamp = new Date(now()).toISOString();
+            // Delete-then-insert rather than a dialect-specific upsert (`on
+            // conflict` on Postgres/SQLite, `on duplicate key` on MySQL) — the
+            // same portable idiom `PluginGrantStore.grant` already uses
+            // (`../permissions/grants.js`) for the identical "re-installing is
+            // idempotent, not a duplicate row" requirement. A (re)install always
+            // resets `enabled` to `true` — a fresh install is never born disabled.
+            await db.query(sql `delete from ${installs} where item_id = ${entry.id}`);
+            await db.query(sql `
+        insert into ${installs}
+          (item_id, kind, display_name, reference, plugin_name, plugin_version,
+           signature_verified, installed_by, installed_at, updated_at, enabled)
+        values
+          (${entry.id}, ${entry.kind}, ${entry.displayName}, ${entry.reference},
+           ${resolved.manifest.name}, ${resolved.manifest.version},
+           ${String(resolved.signatureVerified)}, ${actorId}, ${timestamp}, ${timestamp}, ${'true'})`);
+            return {
+                itemId: entry.id,
+                kind: entry.kind,
+                displayName: entry.displayName,
+                reference: entry.reference,
+                pluginName: resolved.manifest.name,
+                pluginVersion: resolved.manifest.version,
+                signatureVerified: resolved.signatureVerified,
+                installedBy: actorId,
+                installedAt: timestamp,
+                updatedAt: timestamp,
+                enabled: true,
+            };
+        },
+        async update(entry, actorId, updateOptions = {}) {
+            if (entry.kind !== 'plugin')
+                throw unsupportedKind(entry);
+            const existing = await getRecord(entry.id);
+            if (existing === null) {
+                throw new CogentaError({
+                    code: 'MARKETPLACE_NOT_INSTALLED',
+                    message: `"${entry.displayName}" is not installed, so it cannot be updated.`,
+                    hint: 'Install it first.',
+                    details: { itemId: entry.id },
+                });
+            }
+            // Signature is verified before anything else here too — an update
+            // never trusts the previously-installed state as a substitute for
+            // re-checking the new reference.
+            const resolved = await loadMarketplacePlugin(entry.reference, {
+                trustedPublicKeys,
+                ...(engineVersion === undefined ? {} : { engineVersion }),
+            });
+            if (engineVersion !== undefined && !resolved.engineCompatible) {
+                throw engineIncompatible(entry, resolved.manifest);
+            }
+            const previousGrants = existing.pluginName === null ? [] : await grantStore.listGrants(existing.pluginName);
+            const pending = detectCapabilitiesNeedingApproval(resolved.manifest, previousGrants.map((grant) => grant.capability));
+            if (pending.length > 0 && updateOptions.confirmPendingPermissions !== true) {
+                throw new CogentaError({
+                    code: 'MARKETPLACE_UPDATE_REQUIRES_APPROVAL',
+                    message: `Updating "${entry.displayName}" would request ${pending.length} new permission(s) — this never applies silently.`,
+                    hint: 'Review the new permissions and retry with confirmPendingPermissions: true. No capability is granted automatically even then — grant it explicitly afterward.',
+                    details: { itemId: entry.id, pending },
+                });
+            }
+            const timestamp = new Date(now()).toISOString();
+            await db.query(sql `
+        update ${installs} set
+          display_name = ${entry.displayName},
+          reference = ${entry.reference},
+          plugin_name = ${resolved.manifest.name},
+          plugin_version = ${resolved.manifest.version},
+          signature_verified = ${String(resolved.signatureVerified)},
+          installed_by = ${actorId},
+          updated_at = ${timestamp}
+        where item_id = ${entry.id}`);
+            const record = await getRecord(entry.id);
+            if (record === null) {
+                throw new CogentaError({
+                    code: 'MARKETPLACE_NOT_INSTALLED',
+                    message: `"${entry.displayName}" disappeared during its own update.`,
+                    hint: 'Retry the update.',
+                    details: { itemId: entry.id },
+                });
+            }
+            return { record, pendingApproval: describeAll(pending) };
+        },
+        async list() {
+            const result = await db.query(sql `
+        select * from ${installs} order by installed_at asc`);
+            return result.rows.map(toRecord);
+        },
+        async get(itemId) {
+            return getRecord(itemId);
+        },
+        async uninstall(itemId, uninstallOptions = {}) {
+            if (uninstallOptions.removeData === true) {
+                const record = await getRecord(itemId);
+                if (record?.pluginName !== null && record?.pluginName !== undefined) {
+                    await grantStore.revokeAll(record.pluginName);
+                    await options.disableStore?.enable(record.pluginName);
+                    await options.usageStore?.clearUsage(record.pluginName);
+                }
+            }
+            await db.query(sql `delete from ${installs} where item_id = ${itemId}`);
+        },
+        async activate(itemId) {
+            return setEnabled(itemId, true);
+        },
+        async deactivate(itemId) {
+            return setEnabled(itemId, false);
+        },
+    };
+}
+//# sourceMappingURL=marketplace.js.map

package/dist/registries/marketplace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketplace.js","sourceRoot":"","sources":["../../src/registries/marketplace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AAClF,OAAO,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAA;AACpD,OAAO,EAAE,kBAAkB,EAAoC,MAAM,4BAA4B,CAAA;AAGjG,OAAO,EAAE,iCAAiC,EAAE,MAAM,2BAA2B,CAAA;AAE7E,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAqD5D,SAAS,OAAO,CAAC,KAA8B,EAAE,MAAgC;IAC/E,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;QAAE,OAAO,KAAK,CAAA;IACzE,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAA;IACzE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IAChD,OAAO,CACL,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChD,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC;QAChD,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC9C,CAAA;AACH,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,wBAAwB,CACtC,OAA2C;IAE3C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAA;IAC/D,OAAO;QACL,IAAI,CAAC,MAAM,GAAG,EAAE;YACd,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAA;QAC1D,CAAC;QACD,GAAG,CAAC,EAAE;YACJ,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAA;QAC7B,CAAC;KACF,CAAA;AACH,CAAC;AAmID,SAAS,QAAQ,CAAC,GAAe;IAC/B,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,OAAO;QACnB,IAAI,EAAE,GAAG,CAAC,IAA2B;QACrC,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,iBAAiB,EAAE,GAAG,CAAC,kBAAkB,KAAK,MAAM;QACpD,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,oEAAoE;QACpE,qEAAqE;QACrE,wEAAwE;QACxE,oEAAoE;QACpE,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,OAAO;KACjC,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,KAA8B,EAC9B,QAA4B;IAE5B,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,IAAI,KAAK,CAAC,WAAW,uBAAuB,QAAQ,CAAC,MAAM,8CAA8C;QAClH,IAAI,EAAE,6FAA6F;QACnG,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;KACvD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAA8B;IACrD,OAAO,IAAI,YAAY,CAAC;QACtB,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,qCAAqC,KAAK,CAAC,IAAI,8BAA8B;QACtF,IAAI,EAAE,iJAAiJ;QACvJ,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;KAChD,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAClB,YAA+B;IAE/B,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,kBAAkB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAA;AAC9F,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,EAAkB,EAClB,OAAoC;IAEpC,MAAM,QAAQ,GAAG,UAAU,CAAC,kBAAkB,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IACpE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IACnC,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAA;IACzD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAA;IACrC,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAA;IAE3C,KAAK,UAAU,SAAS,CAAC,MAAc;QACrC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAa,GAAG,CAAA;sBAC3B,QAAQ,oBAAoB,MAAM,EAAE,CAAC,CAAA;QACvD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QAC1B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,UAAU,UAAU,CAAC,MAAc,EAAE,OAAgB;QACxD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;eACP,QAAQ,kBAAkB,MAAM,CAAC,OAAO,CAAC,kBAAkB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;wBAC/E,MAAM,EAAE,CAAC,CAAA;QAC7B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;QACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,2BAA2B;gBACjC,OAAO,EAAE,IAAI,MAAM,qBAAqB;gBACxC,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,EAAE,MAAM,EAAE;aACpB,CAAC,CAAA;QACJ,CAAC;QACD,OAAO,MAAM,CAAA;IACf,CAAC;IAED,KAAK,UAAU,cAAc,CAAC,KAA8B;QAsB1D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE;gBAC5D,iBAAiB;gBACjB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;aAC1D,CAAC,CAAA;YACF,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;gBAC7C,gBAAgB,EAAE,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,gBAAgB;aACjF,CAAA;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,YAAY,EAAE,CAAC;gBAClC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAA;YAC3E,CAAC;YACD,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,KAAK;YACjB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC5B,OAAO;oBACL,KAAK;oBACL,SAAS,EAAE,KAAK;oBAChB,iBAAiB,EAAE,KAAK;oBACxB,YAAY,EAAE,EAAE;oBAChB,gBAAgB,EAAE,IAAI;oBACtB,aAAa,EAAE,IAAI;oBACnB,MAAM,EAAE,IAAI;iBACb,CAAA;YACH,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,KAAK,CAAC,CAAA;YAC9C,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;gBACnB,OAAO;oBACL,KAAK;oBACL,SAAS,EAAE,IAAI;oBACf,iBAAiB,EAAE,KAAK;oBACxB,YAAY,EAAE,EAAE;oBAChB,KAAK,EAAE,UAAU,CAAC,KAAK;oBACvB,gBAAgB,EAAE,IAAI;oBACtB,aAAa,EAAE,IAAI;oBACnB,MAAM,EAAE,IAAI;iBACb,CAAA;YACH,CAAC;YACD,OAAO;gBACL,KAAK;gBACL,SAAS,EAAE,IAAI;gBACf,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;gBAC/C,YAAY,EAAE,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAC3D,gBAAgB,EAAE,UAAU,CAAC,gBAAgB;gBAC7C,aAAa,EAAE,UAAU,CAAC,QAAQ,CAAC,OAAO;gBAC1C,MAAM,EAAE,UAAU;aACnB,CAAA;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO;YAC1B,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;YAEzD,mEAAmE;YACnE,sEAAsE;YACtE,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE;gBAC5D,iBAAiB;gBACjB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;aAC1D,CAAC,CAAA;YAEF,kEAAkE;YAClE,qEAAqE;YACrE,qEAAqE;YACrE,6DAA6D;YAC7D,iEAAiE;YACjE,oCAAoC;YACpC,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;gBAC9D,MAAM,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC/C,gEAAgE;YAChE,mEAAmE;YACnE,4DAA4D;YAC5D,mEAAmE;YACnE,qEAAqE;YACrE,uEAAuE;YACvE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,QAAQ,oBAAoB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;YACxE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,QAAQ;;;;aAIjB,KAAK,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,SAAS;aACjE,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,QAAQ,CAAC,QAAQ,CAAC,OAAO;aACpD,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC,KAAK,OAAO,KAAK,SAAS,KAAK,SAAS,KAAK,MAAM,GAAG,CAAC,CAAA;YAEhG,OAAO;gBACL,MAAM,EAAE,KAAK,CAAC,EAAE;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI;gBAClC,aAAa,EAAE,QAAQ,CAAC,QAAQ,CAAC,OAAO;gBACxC,iBAAiB,EAAE,QAAQ,CAAC,iBAAiB;gBAC7C,WAAW,EAAE,OAAO;gBACpB,WAAW,EAAE,SAAS;gBACtB,SAAS,EAAE,SAAS;gBACpB,OAAO,EAAE,IAAI;aACd,CAAA;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,aAAa,GAAG,EAAE;YAC7C,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,eAAe,CAAC,KAAK,CAAC,CAAA;YAEzD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YAC1C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,IAAI,KAAK,CAAC,WAAW,8CAA8C;oBAC5E,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE;iBAC9B,CAAC,CAAA;YACJ,CAAC;YAED,kEAAkE;YAClE,kEAAkE;YAClE,iCAAiC;YACjC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,KAAK,CAAC,SAAS,EAAE;gBAC5D,iBAAiB;gBACjB,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC;aAC1D,CAAC,CAAA;YAEF,IAAI,aAAa,KAAK,SAAS,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;gBAC9D,MAAM,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;YACpD,CAAC;YAED,MAAM,cAAc,GAClB,QAAQ,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;YACtF,MAAM,OAAO,GAAG,iCAAiC,CAC/C,QAAQ,CAAC,QAAQ,EACjB,cAAc,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,CAChD,CAAA;YAED,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,aAAa,CAAC,yBAAyB,KAAK,IAAI,EAAE,CAAC;gBAC3E,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,sCAAsC;oBAC5C,OAAO,EAAE,aAAa,KAAK,CAAC,WAAW,mBAAmB,OAAO,CAAC,MAAM,mDAAmD;oBAC3H,IAAI,EAAE,8JAA8J;oBACpK,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,OAAO,EAAE;iBACvC,CAAC,CAAA;YACJ,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAC/C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,QAAQ;2BACE,KAAK,CAAC,WAAW;wBACpB,KAAK,CAAC,SAAS;0BACb,QAAQ,CAAC,QAAQ,CAAC,IAAI;6BACnB,QAAQ,CAAC,QAAQ,CAAC,OAAO;iCACrB,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAC;2BACxC,OAAO;yBACT,SAAS;0BACR,KAAK,CAAC,EAAE,EAAE,CAAC,CAAA;YAE/B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;YACxC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,YAAY,CAAC;oBACrB,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,IAAI,KAAK,CAAC,WAAW,sCAAsC;oBACpE,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE;iBAC9B,CAAC,CAAA;YACJ,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAA;QAC1D,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAa,GAAG,CAAA;wBAC3B,QAAQ,4BAA4B,CAAC,CAAA;YACvD,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAClC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,MAAM;YACd,OAAO,SAAS,CAAC,MAAM,CAAC,CAAA;QAC1B,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,MAAM,EAAE,gBAAgB,GAAG,EAAE;YAC3C,IAAI,gBAAgB,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;gBACzC,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAA;gBACtC,IAAI,MAAM,EAAE,UAAU,KAAK,IAAI,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;oBACpE,MAAM,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;oBAC7C,MAAM,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;oBACrD,MAAM,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;gBACzD,CAAC;YACH,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA,eAAe,QAAQ,oBAAoB,MAAM,EAAE,CAAC,CAAA;QACxE,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,MAAM;YACnB,OAAO,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QACjC,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,MAAM;YACrB,OAAO,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAA;QAClC,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/registries/skills.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/registries/skills.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAGzF,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;AAEvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,sFAAsF;IACtF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAErD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAA;AAEpG,MAAM,WAAW,aAAa;IAC5B;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAClE,2EAA2E;IAC3E,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,mBAAmB,EAC7B,cAAc,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7B,YAAY,IAAI,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAA;CACtD;AAoCD,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,cAAc,EAClB,GAAG,GAAE,MAAM,MAAiB,GAC3B,aAAa,CAoGf"}
+{"version":3,"file":"skills.d.ts","sourceRoot":"","sources":["../../src/registries/skills.ts"],"names":[],"mappings":"AACA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAGzF,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,UAAU,GAAG,UAAU,CAAA;AAEvE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,qBAAqB,CAAA;IACtC,kGAAkG;IAClG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,sFAAsF;IACtF,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,MAAM,mBAAmB,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAErD,MAAM,MAAM,iBAAiB,GACzB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,GACpD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,iBAAiB,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAA;AAEpG,MAAM,WAAW,aAAa;IAC5B;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAA;IAClE,2EAA2E;IAC3E,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,QAAQ,EAAE,mBAAmB,EAC7B,cAAc,EAAE,MAAM,EACtB,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC,iBAAiB,CAAC,CAAA;IAC7B,YAAY,IAAI,OAAO,CAAC,SAAS,oBAAoB,EAAE,CAAC,CAAA;IACxD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAA;CACtD;AAoCD,wBAAgB,mBAAmB,CACjC,EAAE,EAAE,cAAc,EAClB,GAAG,GAAE,MAAM,MAAiB,GAC3B,aAAa,CAuGf"}

package/dist/registries/skills.js

@@ -32,7 +32,10 @@ export function createSkillRegistry(db, now = Date.now) {
             try {
                 const { metadata } = parseSkillFile(input.displayName, input.rawContent);
                 skillName = metadata.name;
-                skillVersion = metadata.version;
+                // `version` is optional on a skill file since L24 task 4 (a real
+                // Claude Code/Codex `SKILL.md` never carries one) — the marketplace
+                // still records whatever the submitter provided, `null` if absent.
+                skillVersion = metadata.version ?? null;
             }
             catch (error) {
                 status = 'rejected';

package/dist/registries/skills.js.map

@@ -1 +1 @@
-{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/registries/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAwE7C,SAAS,OAAO,CAAC,GAAa;IAC5B,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;IAC5F,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,eAAe,EAAE,GAAG,CAAC,gBAAgB;QACrC,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,WAAW,EAAE,GAAG,CAAC,YAAY;KAC9B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,MAAM,GAAG,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE7D,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAEjD,IAAI,MAAM,GAA0B,SAAS,CAAA;YAC7C,IAAI,SAAS,GAAkB,IAAI,CAAA;YACnC,IAAI,YAAY,GAAkB,IAAI,CAAA;YACtC,IAAI,aAAa,GAAkB,IAAI,CAAA;YACvC,IAAI,eAAe,GAAkB,IAAI,CAAA;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;gBACxE,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAA;gBACzB,YAAY,GAAG,QAAQ,CAAC,OAAO,CAAA;YACjC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,UAAU,CAAA;gBACnB,aAAa,GAAG,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAA;gBACvF,eAAe,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC1E,CAAC;YAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAA;YAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,MAAM;;;;aAIf,EAAE,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,KAAK,WAAW,KAAK,KAAK,CAAC,UAAU;aACnF,SAAS,KAAK,YAAY,KAAK,MAAM,KAAK,aAAa,KAAK,eAAe;aAC3E,IAAI,KAAK,IAAI,KAAK,WAAW,GAAG,CAAC,CAAA;YAExC,OAAO;gBACL,EAAE;gBACF,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW;gBACX,MAAM;gBACN,SAAS;gBACT,YAAY;gBACZ,aAAa;gBACb,eAAe;gBACf,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,WAAW;aACZ,CAAA;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK;YAC9C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAW,GAAG,CAAA;;;eAGlC,MAAM,eAAe,EAAE,EAAE,CAAC,CAAA;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAEhE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;YAEjE,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAChD,MAAM,UAAU,GAA0B,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;YACzF,MAAM,eAAe,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAEtE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,MAAM;uBACA,UAAU,wBAAwB,eAAe;4BAC5C,cAAc,mBAAmB,UAAU;qBAClD,EAAE,EAAE,CAAC,CAAA;YAEpB,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACL,GAAG,OAAO;oBACV,MAAM,EAAE,UAAU;oBAClB,eAAe;oBACf,UAAU,EAAE,cAAc;oBAC1B,UAAU;iBACX;aACF,CAAA;QACH,CAAC;QAED,KAAK,CAAC,YAAY;YAChB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAW,GAAG,CAAA;;;eAGlC,MAAM,sDAAsD,CAAC,CAAA;YACtE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAW,GAAG,CAAA;;;eAGlC,MAAM,eAAe,EAAE,EAAE,CAAC,CAAA;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"skills.js","sourceRoot":"","sources":["../../src/registries/skills.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAuB,UAAU,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,eAAe,CAAA;AACzF,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAwE7C,SAAS,OAAO,CAAC,GAAa;IAC5B,MAAM,MAAM,GACV,GAAG,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAA;IAC5F,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,YAAY;QAC7B,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,MAAM;QACN,SAAS,EAAE,GAAG,CAAC,UAAU;QACzB,YAAY,EAAE,GAAG,CAAC,aAAa;QAC/B,aAAa,EAAE,GAAG,CAAC,cAAc;QACjC,eAAe,EAAE,GAAG,CAAC,gBAAgB;QACrC,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,UAAU,EAAE,GAAG,CAAC,WAAW;QAC3B,WAAW,EAAE,GAAG,CAAC,YAAY;KAC9B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,EAAkB,EAClB,GAAG,GAAiB,IAAI,CAAC,GAAG;IAE5B,MAAM,MAAM,GAAG,UAAU,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,CAAA;IAE7D,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK;YAChB,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAA;YACrB,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAEjD,IAAI,MAAM,GAA0B,SAAS,CAAA;YAC7C,IAAI,SAAS,GAAkB,IAAI,CAAA;YACnC,IAAI,YAAY,GAAkB,IAAI,CAAA;YACtC,IAAI,aAAa,GAAkB,IAAI,CAAA;YACvC,IAAI,eAAe,GAAkB,IAAI,CAAA;YACzC,IAAI,CAAC;gBACH,MAAM,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;gBACxE,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAA;gBACzB,iEAAiE;gBACjE,oEAAoE;gBACpE,mEAAmE;gBACnE,YAAY,GAAG,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAA;YACzC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,GAAG,UAAU,CAAA;gBACnB,aAAa,GAAG,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,0BAA0B,CAAA;gBACvF,eAAe,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YAC1E,CAAC;YAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,IAAI,CAAA;YAC7C,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;sBACF,MAAM;;;;aAIf,EAAE,KAAK,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,KAAK,WAAW,KAAK,KAAK,CAAC,UAAU;aACnF,SAAS,KAAK,YAAY,KAAK,MAAM,KAAK,aAAa,KAAK,eAAe;aAC3E,IAAI,KAAK,IAAI,KAAK,WAAW,GAAG,CAAC,CAAA;YAExC,OAAO;gBACL,EAAE;gBACF,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,WAAW;gBACX,MAAM;gBACN,SAAS;gBACT,YAAY;gBACZ,aAAa;gBACb,eAAe;gBACf,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,IAAI;gBAChB,WAAW;aACZ,CAAA;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK;YAC9C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAW,GAAG,CAAA;;;eAGlC,MAAM,eAAe,EAAE,EAAE,CAAC,CAAA;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,IAAI,GAAG,KAAK,SAAS;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YAEhE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;gBAC9B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,OAAO,EAAE,CAAA;YAEjE,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAA;YAChD,MAAM,UAAU,GAA0B,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAA;YACzF,MAAM,eAAe,GAAG,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAEtE,MAAM,EAAE,CAAC,KAAK,CAAC,GAAG,CAAA;iBACP,MAAM;uBACA,UAAU,wBAAwB,eAAe;4BAC5C,cAAc,mBAAmB,UAAU;qBAClD,EAAE,EAAE,CAAC,CAAA;YAEpB,OAAO;gBACL,EAAE,EAAE,IAAI;gBACR,KAAK,EAAE;oBACL,GAAG,OAAO;oBACV,MAAM,EAAE,UAAU;oBAClB,eAAe;oBACf,UAAU,EAAE,cAAc;oBAC1B,UAAU;iBACX;aACF,CAAA;QACH,CAAC;QAED,KAAK,CAAC,YAAY;YAChB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAW,GAAG,CAAA;;;eAGlC,MAAM,sDAAsD,CAAC,CAAA;YACtE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;QACjC,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,EAAE;YACV,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,KAAK,CAAW,GAAG,CAAA;;;eAGlC,MAAM,eAAe,EAAE,EAAE,CAAC,CAAA;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC1B,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAChD,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/registries/skins.d.ts

@@ -17,6 +17,16 @@ export interface SkinGalleryEntry {
     readonly rejectionCode: string | null;
     readonly rejectionReason: string | null;
     readonly submittedAt: string;
+    /**
+     * The token JSON the submitter sent, parsed back out — the caller that
+     * turns this into an admin-facing gallery card (fiche 14 task 1) needs
+     * more than a name and a verdict to actually render a swatch or apply the
+     * skin. `null` on a rejected entry: a rejected skin never made it past
+     * `validateSkin`, so nothing here can be trusted to be a well-shaped token
+     * tree, and offering it anyway would invite a caller to render or apply a
+     * skin the gate has already refused.
+     */
+    readonly tokens: Record<string, unknown> | null;
 }
 export interface SkinGallery {
     /**

package/dist/registries/skins.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skins.d.ts","sourceRoot":"","sources":["../../src/registries/skins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAIzF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,UAAU,CAAA;AAE1D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC,qGAAqG;IACrG,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC7D,YAAY,IAAI,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAA;IACpD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;CAClD;AA0BD,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,WAAW,CAqD/F"}
+{"version":3,"file":"skins.d.ts","sourceRoot":"","sources":["../../src/registries/skins.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,KAAK,cAAc,EAA0B,MAAM,eAAe,CAAA;AAIzF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,UAAU,CAAA;AAE1D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;IACrC,qGAAqG;IACrG,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAA;CAChD;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;OAKG;IACH,MAAM,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAC7D,YAAY,IAAI,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC,CAAA;IACpD,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAA;CAClD;AAgCD,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,cAAc,EAAE,GAAG,GAAE,MAAM,MAAiB,GAAG,WAAW,CAsD/F"}

package/dist/registries/skins.js

@@ -2,15 +2,19 @@ import { CogentaError, identifier, newId, sql } from '@cogenta/core';
 import { validateSkin } from '@cogenta/render';
 import { REGISTRY_TABLES } from './tables.js';
 function toEntry(row) {
+    const status = row.status === 'accepted' ? 'accepted' : 'rejected';
     return {
         id: row.id,
         submitterId: row.submitter_id,
         displayName: row.display_name,
         description: row.description,
-        status: row.status === 'accepted' ? 'accepted' : 'rejected',
+        status,
         rejectionCode: row.rejection_code,
         rejectionReason: row.rejection_reason,
         submittedAt: row.submitted_at,
+        tokens: status === 'accepted' && typeof row.tokens_json === 'string'
+            ? JSON.parse(row.tokens_json)
+            : null,
     };
 }
 export function createSkinGallery(db, now = Date.now) {
@@ -44,18 +48,19 @@ export function createSkinGallery(db, now = Date.now) {
                 status,
                 rejectionCode,
                 rejectionReason,
+                tokens: status === 'accepted' ? input.tokens : null,
                 submittedAt,
             };
         },
         async listAccepted() {
             const result = await db.query(sql `
-        select id, submitter_id, display_name, description, status, rejection_code, rejection_reason, submitted_at
+        select id, submitter_id, display_name, description, tokens_json, status, rejection_code, rejection_reason, submitted_at
         from ${skins} where status = 'accepted' order by submitted_at asc`);
             return result.rows.map(toEntry);
         },
         async get(id) {
             const result = await db.query(sql `
-        select id, submitter_id, display_name, description, status, rejection_code, rejection_reason, submitted_at
+        select id, submitter_id, display_name, description, tokens_json, status, rejection_code, rejection_reason, submitted_at
         from ${skins} where id = ${id}`);
             const row = result.rows[0];
             return row === undefined ? null : toEntry(row);