@hanamesh/dsh-app-host 0.2.0-rc.2 → 0.6.14

package/schemas/catalog-source.schema.json

@@ -1,8 +1,8 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "urn:dsh-community-market:schema:catalog-source:1.0.0",
+  "$id": "urn:dsh-community-market:schema:catalog-source:1.1.0",
   "title": "DSH Community Market catalog source manifest",
-  "description": "A provider-neutral declaration for one user-selectable HTTPS JSON catalog endpoint. A user registers its manifest URL; selection and all other user-owned state stay local. The smallest recommended profile supports q, category, cursor, and limit and uses 50 as an example page size, not a global cap.",
+  "description": "A provider-neutral declaration for one user-selectable JSON catalog endpoint (standard-port HTTPS or loopback HTTP on 127.0.0.1, ::1 or localhost). A user registers its manifest URL; selection and all other user-owned state stay local. The smallest recommended profile supports q, category, cursor, and limit and uses 50 as an example page size, not a global cap.",
   "type": "object",
   "additionalProperties": false,
   "required": [
@@ -15,7 +15,9 @@
   ],
   "properties": {
     "manifestVersion": {
-      "const": "1.0.0"
+      "type": "string",
+      "pattern": "^1\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9][0-9]*|[0-9]*[A-Za-z-][0-9A-Za-z-]*))*)?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$(?![\\s\\S])",
+      "description": "Valid SemVer with major 1. Minor and patch additions preserve the validated shape; other majors are refused."
     },
     "providerId": {
       "type": "string",
@@ -39,7 +41,7 @@
       "type": "string",
       "format": "uri",
       "maxLength": 2048,
-      "pattern": "^https://(?![^/?#]*@)(?![^/?#]*:)[^#]+$"
+      "pattern": "^(?:https://(?![^/?#]*@)(?![^/?#]*:)[^/?#\\s]+|http://(?:127\\.0\\.0\\.1|\\[::1\\]|localhost)(?::[0-9]+)?)(?:/[^#]*)?$"
     },
     "attribution": {
       "type": "object",
@@ -59,7 +61,7 @@
           "type": "string",
           "format": "uri",
           "maxLength": 2048,
-          "pattern": "^https://(?![^/?#]*@)(?![^/?#]*:)[^#]+$"
+          "pattern": "^(?:https://(?![^/?#]*@)(?![^/?#]*:)[^/?#\\s]+|http://(?:127\\.0\\.0\\.1|\\[::1\\]|localhost)(?::[0-9]+)?)(?:/[^#]*)?$"
         },
         "notice": {
           "type": "string",
@@ -84,8 +86,8 @@
           "type": "string",
           "format": "uri",
           "maxLength": 2048,
-          "pattern": "^https://(?![^/?#]*@)(?![^/?#]*:)[^/?#\\s]+(?:/[^?#\\s]*)?/v1/plugins$",
-          "description": "Absolute HTTPS endpoint on standard port 443 with no query or fragment. It must share the user-approved manifest origin, and the standard endpoint path ends in /v1/plugins."
+          "pattern": "^(?:https://(?![^/?#]*@)(?![^/?#]*:)[^/?#\\s]+|http://(?:127\\.0\\.0\\.1|\\[::1\\]|localhost)(?::[0-9]+)?)(?:/[^?#\\s]*)?/v1/plugins$",
+          "description": "Standard-port HTTPS, or HTTP on 127.0.0.1, ::1 or localhost at any port, without credentials, query or fragment. Endpoint must share the exact user-approved manifest origin and end in /v1/plugins. URL parsing and port validity are enforced by the consumer."
         },
         "method": {
           "const": "GET"

package/schemas/install-target.schema.json

@@ -0,0 +1,298 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://hanamesh.com/schemas/app-host/install-target.schema.json",
+  "title": "HanaMesh AppHost install target",
+  "description": "Public identifiers a caller may hand to the AppHost market. The market resolves its own catalog, shows its own confirmation and performs the install; callers never supply versions, download locations or confirmation. Lengths are JavaScript string lengths.",
+  "x-hanamesh-contract": {
+    "name": "hanamesh.install-target",
+    "version": "1",
+    "supported": ["1"],
+    "package": "@hanamesh/dsh-app-host",
+    "since": "0.2.0-rc.8",
+    "fragmentPrefix": "#hanamesh-install?",
+    "routes": {
+      "resolve": "GET /hanamesh/library/target",
+      "install": "POST /hanamesh/library/install"
+    },
+    "loopback": {
+      "since": "0.2.0-rc.9",
+      "scope": "library HTTP routes and install-target navigation",
+      "aliases": [
+        "127.0.0.1",
+        "localhost"
+      ],
+      "sameInstanceSamePort": true,
+      "host": "Only exact alias:<configured parentOrigin port> Host headers are accepted; no extra Host, port or spelling. The configured parentOrigin remains the canonical 127.0.0.1 origin.",
+      "origin": "When supplied, Origin must exactly match the request Host with the configured http scheme. The aliases are separate browser origins: cross-alias, cross-port, foreign and opaque origins are refused.",
+      "install": "POST still requires exact request Origin, X-HanaMesh-Client: workspace-v1, non-iframe, host authentication and authorization; only explicit market confirmation installs.",
+      "authentication": "Each alias uses its own normal DSH authentication; no cookie/token copying or authentication bypass."
+    },
+    "clientEntry": "openInstallTarget",
+    "versionField": "contractVersion",
+    "unversioned": "An input without contractVersion keeps the v1 semantics shipped in 0.2.0-rc.7.",
+    "mismatch": "Any contractVersion other than a supported value is refused with CONTRACT_VERSION_UNSUPPORTED (HTTP 400, details.supported) before other field checks; nothing is resolved or installed.",
+    "installRecovery": {
+      "since": "0.2.0-rc.10",
+      "scope": "Result of a failed install started by POST /hanamesh/library/install (and plugins/install): the library.install-failed event of GET /hanamesh/library/events carries the original error code and a recovery object.",
+      "transaction": "baseline (profile spec, bundle selection, lockfile, resolved module; runtime ledger before provision) → official dsh plugin add --save-exact → profile readback → application definition → runtime provision. One profile writer at a time in this host; dsh plugin locks per command.",
+      "compensation": "New install: dsh plugin remove (or dsh plugin install when only residue remains); runtime items newly claimed by this operation are removed by lib-provision ownership, unowned files and dataRoot are never deleted. Upgrade: dsh plugin add of the original spec (--save-exact when exact); a replaced runtime item is provisioned again from the restored definition. Concurrent writes by other profile writers are never undone. No automatic retry; no manual profile/store/metadata edit.",
+      "readback": "restored and not-needed are reported only when every check row equals the baseline. Anything else is failed with residue rows, the recovery error (if the compensation itself failed) and originals: the pre-operation package.json/pnpm-lock.yaml/runtime ledger kept under <dataRoot>/library-recovery/<operationId>/.",
+      "presentation": "A failed install is never presented as installed. failed is never presented as restored or rolled back. An event without recovery (provider before rc.10) is not presented as restored."
+    }
+  },
+  "$ref": "#/$defs/target",
+  "$defs": {
+    "itemId": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 160,
+      "pattern": "^[^\\u0000-\\u001f\\u007f]+$"
+    },
+    "packageName": {
+      "type": "string",
+      "minLength": 1,
+      "maxLength": 214,
+      "pattern": "^(?:@[a-z0-9][a-z0-9._-]*\\/)?[a-z0-9][a-z0-9._-]*$"
+    },
+    "contractVersion": {
+      "description": "Optional declaration of the contract version the caller speaks.",
+      "type": "string",
+      "enum": ["1"]
+    },
+    "target": {
+      "description": "openInstallTarget input, GET /hanamesh/library/target query and #hanamesh-install? fragment fields. At least one identifier; both must name the same catalog item. Every other field is refused.",
+      "type": "object",
+      "properties": {
+        "itemId": { "$ref": "#/$defs/itemId" },
+        "packageName": { "$ref": "#/$defs/packageName" },
+        "contractVersion": { "$ref": "#/$defs/contractVersion" }
+      },
+      "additionalProperties": false,
+      "anyOf": [
+        { "required": ["itemId"] },
+        { "required": ["packageName"] }
+      ]
+    },
+    "receipt": {
+      "description": "openInstallTarget resolution receipt; not an install result.",
+      "type": "object",
+      "properties": {
+        "status": { "type": "string", "enum": ["confirmation-required", "installing", "already-installed", "superseded"] },
+        "itemId": { "type": "string" },
+        "packageName": { "type": "string" }
+      },
+      "required": ["status"],
+      "additionalProperties": false
+    },
+    "resolution": {
+      "description": "GET /hanamesh/library/target 200 body. contractVersion is the provider's declaration (added in 0.2.0-rc.8).",
+      "type": "object",
+      "properties": {
+        "contractVersion": { "type": "string", "enum": ["1"] },
+        "item": {
+          "type": "object",
+          "properties": {
+            "id": { "$ref": "#/$defs/itemId" },
+            "displayName": { "type": "string" },
+            "latestVersion": { "type": "string" },
+            "kind": { "type": "string", "enum": ["application", "plugin", "listing"] },
+            "upgradeAvailable": { "type": "boolean" },
+            "package": {
+              "type": "object",
+              "properties": {
+                "registry": { "type": "string", "const": "npm" },
+                "name": { "$ref": "#/$defs/packageName" }
+              },
+              "required": ["registry", "name"]
+            }
+          },
+          "required": ["id", "kind", "package", "upgradeAvailable"]
+        },
+        "source": {
+          "type": "object",
+          "properties": { "kind": { "type": "string" } },
+          "required": ["kind"]
+        },
+        "traceId": { "type": "string" }
+      },
+      "required": ["contractVersion", "item", "source", "traceId"]
+    },
+    "error": {
+      "description": "Refusal body of the HTTP routes; the client rejects with the same code.",
+      "type": "object",
+      "properties": {
+        "error": {
+          "type": "object",
+          "properties": {
+            "code": {
+              "type": "string",
+              "enum": ["INVALID_INPUT", "CONTRACT_VERSION_UNSUPPORTED", "CATALOG_ITEM_MISSING", "NOT_INSTALLABLE", "PACKAGE_DENIED", "HOST_DENIED", "ORIGIN_DENIED", "FRAME_CONTROL_DENIED", "CSRF_DENIED", "UNAUTHENTICATED", "FORBIDDEN", "METHOD_NOT_ALLOWED", "LIBRARY_INSTALL_UNAVAILABLE"]
+            },
+            "message": { "type": "string" }
+          },
+          "required": ["code"]
+        },
+        "traceId": { "type": "string" }
+      },
+      "required": ["error"]
+    },
+    "providerDeclaration": {
+      "description": "package.json hanamesh.installTarget of a provider package.",
+      "type": "object",
+      "properties": {
+        "contract": { "type": "string", "const": "hanamesh.install-target" },
+        "contractVersion": { "type": "string" },
+        "supported": { "type": "array", "items": { "type": "string" } },
+        "schema": { "type": "string" }
+      },
+      "required": ["contract", "contractVersion", "supported"]
+    },
+    "recovery": {
+      "description": "library.install-failed recovery result (added in 0.2.0-rc.10).",
+      "type": "object",
+      "properties": {
+        "status": {
+          "type": "string",
+          "enum": [
+            "not-needed",
+            "restored",
+            "failed"
+          ]
+        },
+        "mode": {
+          "type": "string",
+          "enum": [
+            "new-install",
+            "upgrade",
+            "unknown"
+          ]
+        },
+        "stage": {
+          "type": "string",
+          "enum": [
+            "baseline",
+            "before-add",
+            "add",
+            "readback",
+            "definition",
+            "provision"
+          ]
+        },
+        "previousVersion": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "actions": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "checks": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "item": {
+                "type": "string"
+              },
+              "ok": {
+                "type": "boolean"
+              },
+              "reason": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "item",
+              "ok"
+            ]
+          }
+        },
+        "residue": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "item": {
+                "type": "string"
+              },
+              "reason": {
+                "type": "string"
+              }
+            },
+            "required": [
+              "item",
+              "reason"
+            ]
+          }
+        },
+        "error": {
+          "type": "object",
+          "properties": {
+            "code": {
+              "type": "string"
+            },
+            "message": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "code"
+          ]
+        },
+        "originals": {
+          "type": "object",
+          "properties": {
+            "dir": {
+              "type": "string"
+            },
+            "files": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            },
+            "error": {
+              "type": "object"
+            }
+          }
+        }
+      },
+      "required": [
+        "status",
+        "mode",
+        "stage",
+        "previousVersion",
+        "actions",
+        "checks",
+        "residue"
+      ]
+    },
+    "installFailed": {
+      "description": "library.install-failed event of GET /hanamesh/library/events for an install operation. code is always the original failure; recovery added in 0.2.0-rc.10.",
+      "type": "object",
+      "properties": {
+        "type": {
+          "type": "string",
+          "const": "library.install-failed"
+        },
+        "operationId": {
+          "type": "string"
+        },
+        "code": {
+          "type": "string"
+        },
+        "recovery": {
+          "$ref": "#/$defs/recovery"
+        }
+      },
+      "required": [
+        "type",
+        "code"
+      ]
+    }
+  }
+}

package/dist/provision/LICENSE

@@ -1,6 +0,0 @@
-@hanamesh/lib-provision@0.1.0-rc.1
-Copyright (c) 2026 HanaMesh. All rights reserved.
-License identifier in the source package: UNLICENSED.
-The copyright owner has confirmed distribution of this inlined component
-within @hanamesh/dsh-app-host. No MIT or other open-source license is
-granted for this component by this notice.

package/dist/provision/THIRD_PARTY_NOTICES.md

@@ -1,13 +0,0 @@
-# 第三方声明
-
-`@hanamesh/lib-provision` 0.1.0-rc.1 **没有运行时依赖**。tar / zip 读取、CRC32、sha256、HTTP 下载全部基于 Node.js 内置模块（`zlib`、`crypto`、`fs`、`fetch`）。
-
-开发依赖（不随包分发）：
-
-| 包 | 版本 | 许可证 | 用途 |
-|---|---|---|---|
-| typescript | 5.9.3 | Apache-2.0 | 构建 `lib/` 与 `.d.ts` |
-| @types/node | 22.19.7 | MIT | 类型声明 |
-| undici-types | 6.21.0 | MIT | `@types/node` 的锁定传递依赖 |
-
-测试 fixture 里的自签证书（`tests/fixtures/fixture-cert.pem` / `fixture-key.pem`）由本仓生成，仅供本地 HTTPS fixture 使用，不随包分发。