@intentic/registry 1.224.0 → 1.225.0

package/README.md

@@ -1,6 +1,6 @@
 # @intentic/registry
 
-The **extension-registry file format** — what a registry repo contains, how its two files join, and the order
+The **extension-registry file format**: what a registry repo contains, how its two files join, and the order
 the result is shown in. Published to npm, and depended on by three otherwise-unrelated consumers, which is the
 whole reason it is a package: the daemon that clones a registry, the site that builds the public gallery, and
 the [scanner](../../_tools/registry-scan) that writes the files. One zod schema instead of three that drift.
@@ -10,7 +10,7 @@ below, and [Verification & trust](https://intentic.dev/developers/verify/) for w
 
 ## The shape of it
 
-intentic hosts no extension code, builds none, and signs none. **A registry is a git repo of pointers** —
+intentic hosts no extension code, builds none, and signs none. **A registry is a git repo of pointers**:
 each entry names somebody else's repository at a commit, and installing follows that pointer from the owner's
 sandbox straight to the author's git host. Listing costs a pull request; delisting removes a pointer and
 deletes nothing.
@@ -23,13 +23,13 @@ lists a team's agent plugins and its intentic extensions together.
 
 | File | Written by | Holds |
 | --- | --- | --- |
-| `.claude-plugin/marketplace.json` | humans + protected admission workflow | every decision — what is listed, the exact source, trust level, and source-bound security record |
+| `.claude-plugin/marketplace.json` | humans + protected admission workflow | every decision: what is listed, the exact source, trust level, and source-bound security record |
 | `.claude-plugin/registry.generated.json` | the nightly scanner | only facts read back off the source host: stars, last push |
 
 Keeping the derived data out of the curated file is load-bearing, not tidiness. Star counts in the hand-edited
 file would make every nightly refresh a merge conflict against every open listing pull request, and would bury
 the decision under churn in the review diff. A registry with no generated file is a registry with no stars,
-which renders fine — most registries are a dozen internal extensions in a private repo and run no scanner.
+which renders fine: most registries are a dozen internal extensions in a private repo and run no scanner.
 
 [`resolveRegistry`](src/registry.ts) joins them by entry name into `RegistryEntry`, which is also the daemon's
 browse wire shape, so the app's list and the website's gallery are the same rows in the same order.
@@ -48,7 +48,7 @@ with install disabled and is omitted from the public gallery; it cannot become a
 the runtime backstop behind the registry's required PR check.
 
 A blocked entry stays in the file. Deleting the row hides it from people browsing and tells the people who
-already installed it nothing, which is backwards — they are the ones at risk. Absent on a third-party registry
+already installed it nothing, which is backwards: they are the ones at risk. Absent on a third-party registry
 resolves to `listed`, because a registry that doesn't use the field hasn't asserted anything.
 Third-party registries are their own admission boundary: their non-blocked rows remain installable without
 adopting intentic's gate or policy, and the app states when they carry no audit record.
@@ -56,40 +56,40 @@ adopting intentic's gate or policy, and the app states when they carry no audit
 Installed sandboxes read these states back on a daily comparison, so trust reaches the people past the browse
 moment too: a row turned `blocked` raises an advisory on the installed extension (and, by default, switches it
 off), and `securityFix: true` on an entry marks its pinned commit as fixing a security problem in earlier ones
-— the installed side promotes its update badge from ambient to loud, because there the OLD version is the
+- the installed side promotes its update badge from ambient to loud, because there the OLD version is the
 dangerous one. Both are asserted by pull request, like `trust`, and are worth exactly that review.
 
 ## Tier, and what premium buys into
 
-`tier` is the listing's price: `free` (the default, and the whole story for most rows) or `premium` — the
+`tier` is the listing's price: `free` (the default, and the whole story for most rows) or `premium`, the
 listing opts into the **creator pool**. A premium row needs an intentic membership, both surfaces badge it
 before the click, and installing it **donates a published number of the member's credits to the publisher**
-(once, deduped monthly — updates donate again at most monthly). No usage is metered or reported anywhere;
+(once, deduped monthly: updates donate again at most monthly). No usage is metered or reported anywhere;
 the deliberate install is the whole signal. The economics live in
 [The creator pool](https://intentic.dev/earn/).
 
 ## The mark
 
-A row carries the two display tiers the manifest declares — `logo` (a simple-icons slug) and `icon` (a glyph
-from the app's own set) — and the [scanner](../../_tools/registry-scan) copies whichever is set into the listing it
+A row carries the two display tiers the manifest declares: `logo` (a simple-icons slug) and `icon` (a glyph
+from the app's own set): and the [scanner](../../_tools/registry-scan) copies whichever is set into the listing it
 proposes, exactly as it copies the version. A row with neither is drawn as the extension's initials.
 
 They ride the **curated** file, which looks wrong for a copied value until you ask what the two files are for:
 the mark is part of how a listing presents itself, so it belongs in the row a human reviews and can correct.
-It also has to be here to be worth anything — the gallery and the app's browse list render this row and have
+It also has to be here to be worth anything: the gallery and the app's browse list render this row and have
 no access to the manifest, because the whole point of browsing is that the code has not been cloned yet.
 
 ## The order
 
 [`compareEntries`](src/registry.ts): verified first, then stars, then most-recently-pushed, then name. Stars
-are the obvious sort and the wrong one alone — every listing sits at nought to three of them for months, so a
+are the obvious sort and the wrong one alone: every listing sits at nought to three of them for months, so a
 pure star sort is a random order wearing a merit badge, and it is the most purchasable number on GitHub.
 Recency is what actually does the ordering early on. Stars stay visible; they just don't get to be the
 ranking.
 
 ## Identity
 
-An entry's `name` is `publisher.name` from the manifest — [`extensionIdOf`](../extension-api/src/manifest.ts),
+An entry's `name` is `publisher.name` from the manifest: [`extensionIdOf`](../extension-api/src/manifest.ts),
 the same identity the app installs under. It is derived, never declared by the registry, so a registry entry
 cannot rename or spoof an extension, and a repo that copies somebody else's manifest collides with their
 listing instead of shadowing it.
@@ -107,6 +107,6 @@ exists because neither those signatures nor manifest validation can answer malic
 
 ## Key files
 
-- [src/registry.ts](src/registry.ts) — the file format: what a registry repo contains.
-- [src/source.ts](src/source.ts) — how a sha-pinned pointer names an extension.
-- [src/index.ts](src/index.ts) — the public surface.
+- [src/registry.ts](src/registry.ts), the file format: what a registry repo contains.
+- [src/source.ts](src/source.ts): how a sha-pinned pointer names an extension.
+- [src/index.ts](src/index.ts): the public surface.

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@intentic/registry",
-  "version": "1.224.0",
-  "description": "The extension-registry file format — a git repo of sha-pinned pointers, shared by the daemon, the site gallery and the scanner",
+  "version": "1.225.0",
+  "description": "The extension-registry file format, a git repo of sha-pinned pointers, shared by the daemon, the site gallery and the scanner",
   "license": "MIT",
   "type": "module",
   "repository": {

package/src/registry.test.ts

@@ -113,9 +113,9 @@ describe(`resolveRegistry`, () => {
         expect(resolveRegistry(premium, undefined, REGISTRY)[0]?.tier).toBe(`premium`);
     });
 
-    // Blocked rows must survive the resolve — deleting them is what hides a warning from the people who
+    // Blocked rows must survive the resolve: deleting them is what hides a warning from the people who
     /* The staleness rule the checks ride on: a fact is bound to the sha it was derived from, and a listing
-     * repointed since the last scan renders no checks at all — the honest gap — rather than yesterday's verdict
+     * repointed since the last scan renders no checks at all (the honest gap) rather than yesterday's verdict
      * describing today's pointer. */
     it(`joins checks only when they were derived from the sha the listing still pins`, () => {
         const facts = RegistryFactsSchema.parse({

package/src/source.test.ts

@@ -31,7 +31,7 @@ describe(`resolveSource`, () => {
         });
     });
 
-    // An unclonable source is a row we still show — undefined here becomes "not installable", not a dropped entry.
+    // An unclonable source is a row we still show: undefined here becomes "not installable", not a dropped entry.
     it(`gives up on shapes it cannot clone rather than throwing`, () => {
         expect(resolveSource({ source: `npm`, package: `@acme/incidents` }, REGISTRY, undefined)).toBeUndefined();
         expect(resolveSource({ source: `github` }, REGISTRY, undefined)).toBeUndefined();