@lapis-notes/api 0.1.0 → 0.1.2

package/dist/plugin-distribution/manager.js

@@ -4,12 +4,15 @@ import { checkCatalogEntryCompatibility, checkCatalogReleaseCompatibility, compa
 import { PluginDistributionError } from "./errors";
 import { InstalledPluginStateStore } from "./installed-plugin-state";
 import { VerifiedPluginInstaller, } from "./installer";
+import { parseNostrPluginBundle, } from "./plugin-bundle";
 import { PluginRegistryCache } from "./registry-cache";
 import { PluginRegistryClient } from "./registry-client";
+import { PluginRegistrySourcePreferenceStore } from "./registry-source-state";
 export const DEFAULT_OFFICIAL_PLUGIN_REGISTRY_SOURCE = {
     id: "lapis-official",
     name: "Lapis Official Plugins",
-    url: "https://registry.lapis.md/v1/index.json",
+    url: "https://registry.lapis.md/v2/index.json",
+    downloadStatsUrl: "https://registry.lapis.md/stats/summary.json",
     trustTier: "official",
     enabled: true,
     builtin: true,
@@ -34,24 +37,47 @@ export const EMBEDDED_PLUGIN_REGISTRY_KEYS = [
 export class DefaultPluginDistributionManager extends EventDispatcher {
     options;
     catalog = null;
-    registryClient;
+    httpClients = new Map();
+    sourceCatalogs = new Map();
     stateStore;
+    sourcePreferenceStore;
     installer;
     registries;
     trustedKeys;
+    registryAdapters;
+    sourceStates = new Map();
+    entrySources = new Map();
     installedIds = new Set();
     revocations = null;
+    sourcePreferencesLoaded = null;
     constructor(options) {
         super();
         this.options = options;
-        this.registries = options.registries ?? DEFAULT_PLUGIN_REGISTRY_SOURCES;
+        this.registries = (options.registries ?? DEFAULT_PLUGIN_REGISTRY_SOURCES).map((source) => ({ ...source }));
         this.trustedKeys = options.trustedKeys ?? EMBEDDED_PLUGIN_REGISTRY_KEYS;
         this.stateStore = new InstalledPluginStateStore(options.adapter);
-        this.registryClient = new PluginRegistryClient({
-            trustedKeys: this.trustedKeys,
-            fetch: options.fetch,
-            cache: new PluginRegistryCache({ adapter: options.adapter }),
-        });
+        this.sourcePreferenceStore = new PluginRegistrySourcePreferenceStore(options.adapter);
+        const httpAdapter = {
+            refresh: async (source) => {
+                const result = await this.httpClient(source).refresh(source);
+                return {
+                    index: result.index,
+                    revocations: result.revocations,
+                    installReady: true,
+                    stale: result.stale,
+                    ...(result.stale
+                        ? { message: "Using cached registry metadata" }
+                        : {}),
+                };
+            },
+            getDetail: async (source, entry) => (await this.httpClient(source).getDetail(entry)).detail,
+            getDownloadStats: (source, refreshOptions) => this.httpClient(source).getDownloadStats(source, refreshOptions),
+        };
+        this.registryAdapters = new Map([
+            ["http", httpAdapter],
+            ...Object.entries(options.registryAdapters ?? {}).filter((entry) => entry[1] !== undefined),
+        ]);
+        this.syncSourceStates();
         this.installer = new VerifiedPluginInstaller({
             adapter: options.adapter,
             trustedKeys: this.trustedKeys,
@@ -63,21 +89,131 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
         });
     }
     async refreshCatalog(_options = {}) {
+        await this.ensureSourcePreferencesLoaded();
         this.emitProgress("*", "fetching-catalog");
-        const source = this.registries.find((registry) => registry.enabled);
-        if (!source) {
+        this.entrySources.clear();
+        this.syncSourceStates();
+        const sources = this.registries.filter((registry) => registry.enabled);
+        if (!sources.length) {
             this.catalog = {
                 schemaVersion: 1,
                 generatedAt: new Date(0).toISOString(),
                 plugins: [],
             };
+            this.revocations = null;
             return this.catalog;
         }
-        const refreshed = await this.registryClient.refresh(source);
-        this.catalog = refreshed.index;
-        this.revocations = refreshed.revocations;
+        const indexes = [];
+        const errors = [];
+        for (const source of sources) {
+            const adapter = this.adapterForSource(source);
+            if (!adapter) {
+                const message = `No ${this.sourceKind(source)} registry adapter is available`;
+                this.sourceStates.set(source.id, {
+                    source,
+                    phase: "error",
+                    installReady: false,
+                    message,
+                });
+                errors.push(new Error(message));
+                continue;
+            }
+            try {
+                const result = await adapter.refresh(source, _options);
+                indexes.push({ source, result });
+                this.sourceCatalogs.set(source.id, result);
+                this.sourceStates.set(source.id, {
+                    source,
+                    phase: result.stale ? "degraded" : "ready",
+                    installReady: result.installReady,
+                    ...(result.message ? { message: result.message } : {}),
+                });
+            }
+            catch (error) {
+                errors.push(error);
+                this.sourceStates.set(source.id, {
+                    source,
+                    phase: "error",
+                    installReady: false,
+                    message: error instanceof Error ? error.message : String(error),
+                });
+            }
+        }
+        if (!indexes.length)
+            throw errors[0] ?? new Error("No registry source is available");
+        const plugins = [];
+        const seen = new Set();
+        const registries = {};
+        for (const { source, result } of [...indexes].sort((a, b) => Number(this.sourceKind(a.source) === "nostr") -
+            Number(this.sourceKind(b.source) === "nostr"))) {
+            registries[source.id] = {
+                name: source.name,
+                trustTier: source.trustTier,
+            };
+            for (const entry of result.index.plugins) {
+                if (seen.has(entry.id))
+                    continue;
+                seen.add(entry.id);
+                plugins.push(entry);
+                this.entrySources.set(entry.id, source);
+            }
+        }
+        this.catalog = {
+            schemaVersion: 2,
+            generatedAt: indexes
+                .map(({ result }) => result.index.generatedAt)
+                .sort()
+                .at(-1),
+            registries,
+            plugins,
+        };
+        this.revocations = {
+            schemaVersion: 1,
+            generatedAt: this.catalog.generatedAt,
+            revoked: indexes.flatMap(({ result }) => result.revocations?.revoked ?? []),
+        };
         await this.applyRevocationsToInstalled();
-        return refreshed.index;
+        await this.revalidateInstalledNostrProofs();
+        return this.catalog;
+    }
+    async getDownloadStats(options = {}) {
+        await this.ensureSourcePreferencesLoaded();
+        for (const source of this.registries.filter((entry) => entry.enabled)) {
+            const adapter = this.adapterForSource(source);
+            if (!adapter?.getDownloadStats)
+                continue;
+            const result = await adapter.getDownloadStats(source, options);
+            if (result)
+                return result;
+        }
+        return null;
+    }
+    listSources() {
+        return this.registries.map((source) => this.sourceStates.get(source.id) ?? {
+            source,
+            phase: "idle",
+            installReady: false,
+        });
+    }
+    async setSourceEnabled(sourceId, enabled) {
+        await this.ensureSourcePreferencesLoaded();
+        const target = this.registries.find((source) => source.id === sourceId);
+        if (!target) {
+            throw new PluginDistributionError("metadata-invalid", `Registry source ${sourceId} is not configured.`);
+        }
+        this.registries = this.registries.map((source) => source.id === sourceId ? { ...source, enabled } : source);
+        this.catalog = null;
+        this.revocations = null;
+        this.entrySources.clear();
+        this.syncSourceStates();
+        await this.sourcePreferenceStore.save({
+            schemaVersion: 1,
+            updatedAt: new Date().toISOString(),
+            sources: Object.fromEntries(this.registries.map((source) => [
+                source.id,
+                { enabled: source.enabled },
+            ])),
+        });
     }
     search(query = {}) {
         const text = query.text?.trim().toLowerCase();
@@ -110,17 +246,26 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
     getCatalogEntry(pluginId) {
         return this.catalog?.plugins.find((entry) => entry.id === pluginId);
     }
-    async getPluginDetail(pluginId) {
-        const entry = this.getCatalogEntry(pluginId);
+    async getPluginDetail(pluginId, options = {}) {
+        const entry = this.entryForSource(pluginId, options.registryId);
         if (!entry)
             return null;
-        const result = await this.registryClient.getDetail(entry);
-        return result.detail;
+        const source = options.registryId
+            ? this.registries.find((candidate) => candidate.id === options.registryId)
+            : this.sourceForEntry(entry);
+        const adapter = source ? this.adapterForSource(source) : undefined;
+        if (!source || !adapter)
+            return null;
+        return adapter.getDetail(source, entry);
     }
     async install(pluginId, options = {}) {
         try {
             this.emitProgress(pluginId, "resolving", "Resolving plugin");
-            const entry = this.requireEntry(pluginId);
+            const entry = this.entryForSource(pluginId, options.registryId);
+            if (!entry)
+                throw new PluginDistributionError("metadata-invalid", `Plugin ${pluginId} is unavailable from the requested source.`);
+            if (["pending", "disabled", "revoked"].includes(entry.status ?? "active"))
+                throw new PluginDistributionError("metadata-invalid", `Plugin ${pluginId} is ${entry.status}.`);
             if (options.requireOfficial && entry.channel !== "official") {
                 throw new PluginDistributionError("metadata-invalid", `Plugin ${pluginId} is not an official registry entry.`);
             }
@@ -129,7 +274,9 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
                 throw new PluginDistributionError("compatibility-failed", `Plugin ${pluginId} is not compatible: ${entryCompatibility.reasons.join(", ")}`, { details: { reasons: entryCompatibility.reasons } });
             }
             this.emitProgress(pluginId, "fetching-release", "Fetching release metadata");
-            const detail = await this.getPluginDetail(pluginId);
+            const detail = await this.getPluginDetail(pluginId, {
+                registryId: options.registryId,
+            });
             if (!detail) {
                 throw new PluginDistributionError("metadata-invalid", `Plugin ${pluginId} is missing registry detail metadata.`);
             }
@@ -142,13 +289,17 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
                 throw new PluginDistributionError("compatibility-failed", `Plugin ${pluginId} release is not compatible: ${releaseCompatibility.reasons.join(", ")}`, { details: { reasons: releaseCompatibility.reasons } });
             }
             this.emitProgress(pluginId, "verifying-signature", "Verifying release signature");
+            const source = options.registryId
+                ? this.registries.find((candidate) => candidate.id === options.registryId)
+                : this.sourceForEntry(entry);
+            const adapter = source ? this.adapterForSource(source) : undefined;
             const installOptions = {
                 entry,
                 detail,
                 version: options.version,
                 enable: options.enable,
-                registryId: options.registryId ?? this.sourceForEntry(entry)?.id,
-                registryUrl: this.sourceForEntry(entry)?.url,
+                registryId: source?.id,
+                registryUrl: source?.url,
                 provenance: entry.channel,
                 compatibility: this.compatibilityInput(await this.isWorkspaceTrusted()),
                 signal: options.signal,
@@ -156,7 +307,32 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
                     this.emitProgress(pluginId, phase, message, details);
                 },
             };
-            const record = await this.installer.install(installOptions);
+            let record;
+            if (source && adapter?.getVerifiedBundle) {
+                const sourceState = this.sourceStates.get(source.id);
+                if (!sourceState?.installReady) {
+                    throw new PluginDistributionError("metadata-invalid", `Registry source ${source.name} has not reached install quorum.`);
+                }
+                const version = options.version ?? detail.latestVersion;
+                const payload = await adapter.getVerifiedBundle(source, entry, detail, version, { signal: options.signal });
+                if (payload.releaseManifest.pluginId !== entry.id ||
+                    payload.releaseManifest.version !== version ||
+                    payload.releaseManifest.channel !== entry.channel) {
+                    throw new PluginDistributionError("metadata-invalid", "Verified registry payload does not match catalog metadata.");
+                }
+                record = await this.installer.installVerifiedPayload(payload, {
+                    enable: installOptions.enable,
+                    registryId: installOptions.registryId,
+                    registryUrl: installOptions.registryUrl,
+                    provenance: installOptions.provenance,
+                    compatibility: installOptions.compatibility,
+                    signal: installOptions.signal,
+                    onProgress: installOptions.onProgress,
+                });
+            }
+            else {
+                record = await this.installer.install(installOptions);
+            }
             this.installedIds.add(pluginId);
             this.emitProgress(pluginId, "complete", "Plugin installed");
             return record;
@@ -170,17 +346,35 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
         let progressPluginId = "*";
         try {
             this.emitProgress(progressPluginId, "verifying-signature", "Verifying plugin bundle");
-            const installOptions = {
-                bundle,
+            const onProgress = ({ phase, message, ...details }) => {
+                this.emitProgress(progressPluginId, phase, message, details);
+            };
+            const commonOptions = {
                 enable: options.enable,
-                provenance: "official",
                 compatibility: this.compatibilityInput(await this.isWorkspaceTrusted()),
                 signal: options.signal,
-                onProgress: ({ phase, message, ...details }) => {
-                    this.emitProgress(progressPluginId, phase, message, details);
-                },
+                onProgress,
             };
-            const record = await this.installer.installBundle(installOptions);
+            const portable = parseNostrPluginBundle(bundle, {
+                onProgress: commonOptions.onProgress,
+            });
+            let record;
+            if (portable) {
+                const verified = await this.verifyOfflineNostrBundle(portable, options.signal);
+                record = await this.installer.installVerifiedPayload(verified.payload, {
+                    ...commonOptions,
+                    provenance: verified.payload.releaseManifest.channel,
+                    registryId: verified.source.id,
+                    registryUrl: verified.source.url,
+                });
+            }
+            else {
+                record = await this.installer.installBundle({
+                    bundle,
+                    ...commonOptions,
+                    provenance: "official",
+                });
+            }
             progressPluginId = record.pluginId;
             this.installedIds.add(record.pluginId);
             this.emitProgress(record.pluginId, "complete", "Plugin installed");
@@ -191,10 +385,38 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
             throw error;
         }
     }
+    async verifyOfflineNostrBundle(bundle, signal) {
+        await this.ensureSourcePreferencesLoaded();
+        const failures = [];
+        for (const source of this.registries.filter((candidate) => candidate.enabled && this.sourceKind(candidate) === "nostr")) {
+            const adapter = this.adapterForSource(source);
+            if (!adapter?.verifyOfflineBundle)
+                continue;
+            try {
+                return {
+                    payload: await adapter.verifyOfflineBundle(source, bundle, {
+                        signal,
+                    }),
+                    source,
+                };
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        }
+        if (failures.length)
+            throw failures[0];
+        throw new PluginDistributionError("metadata-invalid", "No enabled Nostr source can verify this offline plugin bundle.");
+    }
     async update(pluginId, version, options = {}) {
         const installed = await this.getInstalled(pluginId);
-        const entry = this.getCatalogEntry(pluginId);
-        if (!installed || !entry)
+        const pinnedSource = installed
+            ? this.installedSource(installed)
+            : undefined;
+        const entry = pinnedSource
+            ? this.entryForSource(pluginId, pinnedSource.id)
+            : undefined;
+        if (!installed || !entry || !pinnedSource)
             return null;
         const targetVersion = version ?? installed.revoked?.replacementVersion ?? entry.latestVersion;
         if (compareVersions(targetVersion, installed.installedVersion) <= 0) {
@@ -203,6 +425,7 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
         const wasEnabled = Boolean(this.options.pluginManager?.isPluginEnabled?.(pluginId));
         const updated = await this.install(pluginId, {
             version: targetVersion,
+            registryId: pinnedSource.id,
             enable: wasEnabled,
             signal: options.signal,
         });
@@ -231,7 +454,10 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
         for (const record of installed) {
             if (record.provenance !== "official")
                 continue;
-            const entry = this.getCatalogEntry(record.pluginId);
+            const pinnedSource = this.installedSource(record);
+            const entry = pinnedSource
+                ? this.entryForSource(record.pluginId, pinnedSource.id)
+                : undefined;
             const revoked = this.revocationFor(record) ?? record.revoked;
             if (!entry) {
                 if (revoked) {
@@ -257,7 +483,9 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
             if (!hasNewerTarget && !revoked)
                 continue;
             let compatibility = checkCatalogEntryCompatibility(entry, this.compatibilityInput(false));
-            const detail = await this.getPluginDetail(record.pluginId);
+            const detail = await this.getPluginDetail(record.pluginId, {
+                registryId: pinnedSource?.id,
+            });
             const targetRelease = detail?.versions[targetVersion];
             if (targetRelease) {
                 compatibility = checkCatalogReleaseCompatibility(targetRelease, this.compatibilityInput(false));
@@ -291,6 +519,46 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
         this.on("progress", listener);
         return () => this.off("progress", listener);
     }
+    httpClient(source) {
+        const key = `${source.id}:${source.url}`;
+        let client = this.httpClients.get(key);
+        if (!client) {
+            client = new PluginRegistryClient({
+                trustedKeys: this.trustedKeys.filter((key) => key.trustTier === source.trustTier),
+                fetch: this.options.fetch,
+                cache: new PluginRegistryCache({
+                    adapter: this.options.adapter,
+                    cachePath: `.obsidian/plugin-registry-cache/${encodeURIComponent(source.id)}/${encodeURIComponent(source.url)}.json`,
+                }),
+            });
+            this.httpClients.set(key, client);
+        }
+        return client;
+    }
+    entryForSource(pluginId, registryId) {
+        if (!registryId)
+            return this.getCatalogEntry(pluginId);
+        const state = this.sourceStates.get(registryId);
+        if (!state?.source.enabled || !state.installReady)
+            return undefined;
+        return this.sourceCatalogs
+            .get(registryId)
+            ?.index.plugins.find((entry) => entry.id === pluginId);
+    }
+    installedSource(record) {
+        const source = record.registryId
+            ? this.registries.find((candidate) => candidate.id === record.registryId)
+            : this.registries.find((candidate) => candidate.url === record.registryUrl);
+        if (!source)
+            return undefined;
+        if (!record.registryUrl || record.registryUrl === source.url)
+            return source;
+        if (source.id === "lapis-official" &&
+            source.url === "https://registry.lapis.md/v2/index.json" &&
+            record.registryUrl === "https://registry.lapis.md/v1/index.json")
+            return source;
+        return undefined;
+    }
     requireEntry(pluginId) {
         const entry = this.getCatalogEntry(pluginId);
         if (!entry) {
@@ -299,8 +567,13 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
         return entry;
     }
     sourceForEntry(entry) {
-        return (this.registries.find((source) => source.enabled &&
-            (entry.channel === "official") === (source.trustTier === "official")) ?? null);
+        return this.entrySources.get(entry.id) ?? null;
+    }
+    sourceKind(source) {
+        return source.kind ?? "http";
+    }
+    adapterForSource(source) {
+        return this.registryAdapters.get(this.sourceKind(source));
     }
     compatibilityInput(workspaceTrusted) {
         return {
@@ -316,11 +589,50 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
     async isWorkspaceTrusted() {
         return Boolean(await this.options.workspaceTrusted?.());
     }
+    ensureSourcePreferencesLoaded() {
+        this.sourcePreferencesLoaded ??= this.loadSourcePreferences();
+        return this.sourcePreferencesLoaded;
+    }
+    async loadSourcePreferences() {
+        const preferences = await this.sourcePreferenceStore.load();
+        this.registries = this.registries.map((source) => {
+            const preference = preferences.sources[source.id];
+            return preference
+                ? { ...source, enabled: preference.enabled }
+                : { ...source };
+        });
+        this.syncSourceStates();
+    }
+    syncSourceStates() {
+        const configuredIds = new Set(this.registries.map((source) => source.id));
+        for (const sourceId of this.sourceStates.keys()) {
+            if (!configuredIds.has(sourceId))
+                this.sourceStates.delete(sourceId);
+        }
+        for (const source of this.registries) {
+            const previous = this.sourceStates.get(source.id);
+            this.sourceStates.set(source.id, {
+                source,
+                phase: source.enabled ? (previous?.phase ?? "idle") : "idle",
+                installReady: source.enabled
+                    ? (previous?.installReady ?? false)
+                    : false,
+                ...(source.enabled && previous?.message
+                    ? { message: previous.message }
+                    : {}),
+            });
+        }
+    }
     async applyRevocationsToInstalled() {
         const installed = await this.stateStore.list();
         for (const record of installed) {
             if (record.provenance !== "official")
                 continue;
+            const source = this.installedSource(record);
+            if (!source ||
+                this.sourceStates.get(source.id)?.phase !== "ready" ||
+                !this.sourceCatalogs.get(source.id)?.revocations)
+                continue;
             const revoked = this.revocationFor(record);
             if (sameRevocation(record.revoked, revoked))
                 continue;
@@ -337,8 +649,35 @@ export class DefaultPluginDistributionManager extends EventDispatcher {
             await this.stateStore.upsert(next);
         }
     }
+    async revalidateInstalledNostrProofs() {
+        const installed = await this.stateStore.list();
+        for (const record of installed) {
+            if (!record.nostrProof?.requiresRelayRefresh || !record.registryId) {
+                continue;
+            }
+            const state = this.sourceStates.get(record.registryId);
+            if (!state?.installReady || state.phase !== "ready")
+                continue;
+            const adapter = this.adapterForSource(state.source);
+            if (!adapter?.revalidateInstalledProof)
+                continue;
+            try {
+                const nostrProof = await adapter.revalidateInstalledProof(state.source, record);
+                await this.stateStore.upsert({
+                    ...record,
+                    nostrProof,
+                    updatedAt: new Date().toISOString(),
+                });
+            }
+            catch {
+                // A live source must positively revalidate the same release before the
+                // offline warning can be cleared. Failures retain the warning.
+            }
+        }
+    }
     revocationFor(record) {
-        const match = this.revocations?.revoked.find((revocation) => revocation.pluginId === record.pluginId &&
+        const source = this.installedSource(record);
+        const match = (source ? this.sourceCatalogs.get(source.id)?.revocations : undefined)?.revoked.find((revocation) => revocation.pluginId === record.pluginId &&
             revocation.versions.includes(record.installedVersion));
         if (!match)
             return undefined;

package/dist/plugin-distribution/nostr-registry-adapter.d.ts

@@ -0,0 +1,29 @@
+import type { PluginBinaryFetch } from "./installer";
+import type { PluginRegistryAdapter } from "./manager";
+import { type NostrReleaseProofVerifier } from "./plugin-bundle-verifier";
+import type { PluginCatalogEntry } from "./types";
+export interface NostrRegistryCatalogSource {
+    loadIndex(options?: {
+        signal?: AbortSignal;
+    }): Promise<unknown>;
+    loadPluginDetail(entry: PluginCatalogEntry, options?: {
+        signal?: AbortSignal;
+    }): Promise<unknown>;
+    loadReleaseProof(pluginId: string, version: string, options?: {
+        signal?: AbortSignal;
+    }): Promise<unknown>;
+    getStatus(): {
+        installReady: boolean;
+        fresh: boolean;
+        message?: string;
+    };
+    refresh?(options?: {
+        signal?: AbortSignal;
+    }): Promise<void>;
+}
+export interface CreateNostrPluginRegistryAdapterOptions {
+    catalogSource: NostrRegistryCatalogSource;
+    verifyReleaseProof: NostrReleaseProofVerifier;
+    fetch?: PluginBinaryFetch;
+}
+export declare function createNostrPluginRegistryAdapter(options: CreateNostrPluginRegistryAdapterOptions): PluginRegistryAdapter;