@lapis-notes/api 0.1.0 → 0.1.3

package/dist/index.d.ts

@@ -8,6 +8,9 @@ export * from "./menu.svelte";
 export * from "./cache.svelte";
 export * from "./plugin";
 export * from "./plugin-capability-facade";
+export * from "./sync-host";
+export * from "./sync-host-security";
+export * from "./browser-sync-security";
 export * from "./plugin-asset-server";
 export * from "./plugin-dependency-resolver";
 export * from "./plugin-dependency-scanner";
@@ -48,6 +51,7 @@ export * from "./command.svelte";
 export * from "./configuration.svelte";
 export * from "./configuration-option-source-registry";
 export * from "./configuration-option-source-providers";
+export * from "./plugin-settings";
 export * from "./editor-view-registry";
 export * from "./glob";
 export * from "./platform";
@@ -58,6 +62,7 @@ export * from "./markdown-file-surface-registry";
 export * from "./logging";
 export * from "./telemetry";
 export * from "./notifications";
+export * from "./nostr-signer";
 export * from "./status-bar.svelte";
 export * from "./app-url";
 export * from "./agent-tools";

package/dist/index.js

@@ -8,6 +8,9 @@ export * from "./menu.svelte";
 export * from "./cache.svelte";
 export * from "./plugin";
 export * from "./plugin-capability-facade";
+export * from "./sync-host";
+export * from "./sync-host-security";
+export * from "./browser-sync-security";
 export * from "./plugin-asset-server";
 export * from "./plugin-dependency-resolver";
 export * from "./plugin-dependency-scanner";
@@ -48,6 +51,7 @@ export * from "./command.svelte";
 export * from "./configuration.svelte";
 export * from "./configuration-option-source-registry";
 export * from "./configuration-option-source-providers";
+export * from "./plugin-settings";
 export * from "./editor-view-registry";
 export * from "./glob";
 export * from "./platform";
@@ -58,6 +62,7 @@ export * from "./markdown-file-surface-registry";
 export * from "./logging";
 export * from "./telemetry";
 export * from "./notifications";
+export * from "./nostr-signer";
 export * from "./status-bar.svelte";
 export * from "./app-url";
 export * from "./agent-tools";

package/dist/language-service/manager.d.ts

@@ -12,12 +12,17 @@ export declare class LanguageServiceManager {
     private readonly onBeforeResolve?;
     private diagnosticsBinding;
     private readonly openDocuments;
+    private readonly pendingDocumentReleases;
     private readonly cachedCodeActions;
+    private readonly diagnosticsRequestIds;
     private readonly providerFailures;
+    private readonly diagnosticsInvalidationListeners;
     constructor(options?: {
         onBeforeResolve?: (languageId: string) => Promise<void> | void;
     });
     registerProvider(provider: LanguageServiceProvider): () => void;
+    onDiagnosticsInvalidated(listener: (languages: readonly string[]) => void): () => void;
+    invalidateDiagnostics(providerId: string): boolean;
     bindDiagnostics(binding: LanguageServiceDiagnosticsBinding): () => void;
     reportProviderFailure(id: string, error: unknown): void;
     clearProviderFailure(id: string): void;

package/dist/language-service/manager.js

@@ -36,8 +36,11 @@ export class LanguageServiceManager {
     onBeforeResolve;
     diagnosticsBinding = null;
     openDocuments = new Map();
+    pendingDocumentReleases = new Map();
     cachedCodeActions = new Map();
+    diagnosticsRequestIds = new Map();
     providerFailures = new Map();
+    diagnosticsInvalidationListeners = new Set();
     constructor(options = {}) {
         this.onBeforeResolve = options.onBeforeResolve;
     }
@@ -56,6 +59,26 @@ export class LanguageServiceManager {
             }
         };
     }
+    onDiagnosticsInvalidated(listener) {
+        this.diagnosticsInvalidationListeners.add(listener);
+        return () => {
+            this.diagnosticsInvalidationListeners.delete(listener);
+        };
+    }
+    invalidateDiagnostics(providerId) {
+        const provider = this.providers.get(providerId);
+        if (!provider)
+            return false;
+        for (const document of this.documents.values()) {
+            if (provider.metadata.languages.includes(document.languageId)) {
+                this.deleteCachedCodeActions(document.uri);
+            }
+        }
+        for (const listener of this.diagnosticsInvalidationListeners) {
+            listener([...provider.metadata.languages]);
+        }
+        return true;
+    }
     bindDiagnostics(binding) {
         this.diagnosticsBinding = binding;
         this.publishProviderFailures();
@@ -84,6 +107,7 @@ export class LanguageServiceManager {
         this.diagnosticsBinding = null;
     }
     retainDocument(uri) {
+        this.pendingDocumentReleases.delete(uri);
         this.openDocuments.set(uri, (this.openDocuments.get(uri) ?? 0) + 1);
         let released = false;
         return () => {
@@ -96,12 +120,21 @@ export class LanguageServiceManager {
                 return;
             }
             this.openDocuments.delete(uri);
-            this.documents.delete(uri);
-            this.deleteCachedCodeActions(uri);
-            const collection = this.diagnosticsBinding?.collection;
-            if (collection && !collection.disposed) {
-                collection.delete(resourceForUri(uri));
-            }
+            const release = Symbol(uri);
+            this.pendingDocumentReleases.set(uri, release);
+            queueMicrotask(() => {
+                if (this.pendingDocumentReleases.get(uri) !== release ||
+                    this.openDocuments.has(uri)) {
+                    return;
+                }
+                this.pendingDocumentReleases.delete(uri);
+                this.documents.delete(uri);
+                this.deleteCachedCodeActions(uri);
+                const collection = this.diagnosticsBinding?.collection;
+                if (collection && !collection.disposed) {
+                    collection.delete(resourceForUri(uri));
+                }
+            });
         };
     }
     buildDiagnosticItemMenu(menu, entry) {
@@ -154,24 +187,27 @@ export class LanguageServiceManager {
         return [...this.globals.values()].sort((left, right) => left.uri.localeCompare(right.uri));
     }
     async diagnostics(document) {
+        const requestId = (this.diagnosticsRequestIds.get(document.uri) ?? 0) + 1;
+        this.diagnosticsRequestIds.set(document.uri, requestId);
         this.updateDocument(document);
         await this.onBeforeResolve?.(document.languageId);
         const sorted = this.matchingProviders(document.languageId, "diagnostics");
         if (!sorted.length) {
-            this.publishDiagnostics(document, []);
+            this.publishDiagnostics(document, [], requestId);
             return [];
         }
         const skipProviderIds = new Set();
         const results = await Promise.all(sorted.map(async (provider) => {
             const result = await this.settleProviderCapability(provider, "diagnostics", provider.provideDiagnostics?.(this.context(document)), []);
-            if (result.timedOut || this.providerFailures.has(provider.metadata.id)) {
+            if (result.timedOut ||
+                this.providerFailures.has(provider.metadata.id)) {
                 skipProviderIds.add(provider.metadata.id);
             }
             return result.value;
         }));
         const diagnostics = results.flatMap((diagnostics) => diagnostics ?? []);
-        await this.cacheCodeActions(document, diagnostics, skipProviderIds);
-        this.publishDiagnostics(document, diagnostics);
+        await this.cacheCodeActions(document, diagnostics, skipProviderIds, requestId);
+        this.publishDiagnostics(document, diagnostics, requestId);
         return diagnostics;
     }
     async completions(document, position) {
@@ -279,20 +315,28 @@ export class LanguageServiceManager {
     providersFor(languageId, capability) {
         return this.matchingProviders(languageId, capability);
     }
-    publishDiagnostics(document, diagnostics) {
+    publishDiagnostics(document, diagnostics, requestId) {
         if (!this.diagnosticsBinding ||
             this.diagnosticsBinding.collection.disposed ||
-            !this.openDocuments.has(document.uri)) {
+            !this.openDocuments.has(document.uri) ||
+            this.diagnosticsRequestIds.get(document.uri) !== requestId) {
             return;
         }
         this.diagnosticsBinding.collection.set(resourceForUri(document.uri), diagnostics.map(toWorkspaceDiagnostic));
     }
-    async cacheCodeActions(document, diagnostics, skipProviderIds) {
+    async cacheCodeActions(document, diagnostics, skipProviderIds, requestId) {
+        if (requestId !== undefined &&
+            this.diagnosticsRequestIds.get(document.uri) !== requestId) {
+            return;
+        }
         this.deleteCachedCodeActions(document.uri);
         await Promise.all(diagnostics.map(async (diagnostic) => {
             const actions = await this.codeActions(document, diagnostic.range, skipProviderIds);
-            if (!this.openDocuments.has(document.uri))
+            if (!this.openDocuments.has(document.uri) ||
+                (requestId !== undefined &&
+                    this.diagnosticsRequestIds.get(document.uri) !== requestId)) {
                 return;
+            }
             this.cachedCodeActions.set(diagnosticCacheKey(document.uri, diagnostic), uniqueActionsForDiagnostic(actions, diagnostic));
         }));
     }

package/dist/lapis-extension.d.ts

@@ -19,7 +19,7 @@ export interface LapisRuntimeEntryMap {
     desktop?: LapisRuntimeEntryDescriptor;
     trustedDesktop?: LapisRuntimeEntryDescriptor;
 }
-export type LapisExtensionPermission = "vault.read" | "vault.write" | "plugin.data" | "commands" | "notices" | "settings.read" | "metadata.query" | "events" | "logging";
+export type LapisExtensionPermission = "vault.read" | "vault.write" | "plugin.data" | "commands" | "notices" | "settings.read" | "metadata.query" | "metadata.identity" | "metadata.changes" | "vault.stream" | "plugin.generated-state" | "network.connect" | "crypto.nostr-sync" | "events" | "logging";
 export interface LapisCommandContribution {
     command: string;
     title: string;

package/dist/lapis-extension.js

@@ -510,6 +510,18 @@ function permissionToCapability(permission) {
             return "settings";
         case "metadata.query":
             return "metadata:query";
+        case "metadata.identity":
+            return "metadata:identity";
+        case "metadata.changes":
+            return "metadata:changes";
+        case "vault.stream":
+            return "vault:stream";
+        case "plugin.generated-state":
+            return "plugin:generated-state";
+        case "network.connect":
+            return "network:connect";
+        case "crypto.nostr-sync":
+            return "crypto:nostr-sync";
         default:
             return null;
     }

package/dist/nostr-signer.d.ts

@@ -0,0 +1,68 @@
+export interface NostrUnsignedEvent {
+    kind: number;
+    created_at: number;
+    tags: string[][];
+    content: string;
+}
+export interface NostrSignedEvent extends NostrUnsignedEvent {
+    id: string;
+    pubkey: string;
+    sig: string;
+}
+export type NostrSignerAccountKind = "local" | "nip46";
+export interface NostrSignerAccount {
+    /** Opaque host-owned account identifier. */
+    id: string;
+    label: string;
+    pubkey: string;
+    kind: NostrSignerAccountKind;
+}
+export interface NostrProfileCreationRequest {
+    displayName?: string;
+}
+export interface NostrRemoteSignerRequest {
+    bunkerUrl: string;
+    label?: string;
+}
+export interface NostrPrivateKeyImportRequest {
+    privateKey: string;
+    label?: string;
+}
+export interface NostrSignerBrokerContext {
+    /** Identifies the plugin requesting a permissioned signer operation. */
+    pluginId: string;
+}
+/**
+ * Host-owned signer boundary. Implementations own consent, OS-keychain
+ * storage, NIP-46 client credentials, signature validation, and session
+ * teardown. Private keys may cross this boundary once for explicit import,
+ * but host implementations must never return them to plugin code.
+ */
+export interface NostrSignerBroker {
+    listAccounts(context: NostrSignerBrokerContext): Promise<NostrSignerAccount[]>;
+    requestProfileCreation(context: NostrSignerBrokerContext, request: NostrProfileCreationRequest): Promise<NostrSignerAccount>;
+    connectRemoteSigner(context: NostrSignerBrokerContext, request: NostrRemoteSignerRequest): Promise<NostrSignerAccount>;
+    importPrivateKey(context: NostrSignerBrokerContext, request: NostrPrivateKeyImportRequest): Promise<NostrSignerAccount>;
+    getPublicKey(context: NostrSignerBrokerContext, accountId: string): Promise<string>;
+    signEvent(context: NostrSignerBrokerContext, accountId: string, event: NostrUnsignedEvent): Promise<NostrSignedEvent>;
+    nip44Encrypt(context: NostrSignerBrokerContext, accountId: string, pubkey: string, plaintext: string): Promise<string>;
+    nip44Decrypt(context: NostrSignerBrokerContext, accountId: string, pubkey: string, ciphertext: string): Promise<string>;
+    close(context: NostrSignerBrokerContext, accountId: string): Promise<void>;
+}
+export interface NostrPluginSigner {
+    readonly pluginId: string;
+    listAccounts(): Promise<NostrSignerAccount[]>;
+    requestProfileCreation(request?: NostrProfileCreationRequest): Promise<NostrSignerAccount>;
+    connectRemoteSigner(request: NostrRemoteSignerRequest): Promise<NostrSignerAccount>;
+    importPrivateKey(request: NostrPrivateKeyImportRequest): Promise<NostrSignerAccount>;
+    getPublicKey(accountId: string): Promise<string>;
+    signEvent(accountId: string, event: NostrUnsignedEvent): Promise<NostrSignedEvent>;
+    nip44Encrypt(accountId: string, pubkey: string, plaintext: string): Promise<string>;
+    nip44Decrypt(accountId: string, pubkey: string, ciphertext: string): Promise<string>;
+    close(accountId: string): Promise<void>;
+}
+export declare class NostrSignerHost {
+    #private;
+    constructor(broker?: NostrSignerBroker);
+    forPlugin(pluginId: string): NostrPluginSigner;
+}

package/dist/nostr-signer.js

@@ -0,0 +1,49 @@
+export class NostrSignerHost {
+    #broker;
+    constructor(broker = unavailableNostrSignerBroker) {
+        this.#broker = broker;
+    }
+    forPlugin(pluginId) {
+        if (!pluginId.trim())
+            throw new TypeError("pluginId is required");
+        const context = Object.freeze({ pluginId });
+        return {
+            pluginId,
+            listAccounts: () => this.#broker.listAccounts(context),
+            requestProfileCreation: (request = {}) => this.#broker.requestProfileCreation(context, request),
+            connectRemoteSigner: (request) => this.#broker.connectRemoteSigner(context, request),
+            importPrivateKey: (request) => this.#broker.importPrivateKey(context, request),
+            getPublicKey: (accountId) => this.#broker.getPublicKey(context, accountId),
+            signEvent: async (accountId, event) => {
+                const signed = await this.#broker.signEvent(context, accountId, event);
+                assertSignedEventMatches(event, signed);
+                return signed;
+            },
+            nip44Encrypt: (accountId, pubkey, plaintext) => this.#broker.nip44Encrypt(context, accountId, pubkey, plaintext),
+            nip44Decrypt: (accountId, pubkey, ciphertext) => this.#broker.nip44Decrypt(context, accountId, pubkey, ciphertext),
+            close: (accountId) => this.#broker.close(context, accountId),
+        };
+    }
+}
+const unavailable = () => {
+    throw new Error("The host does not provide Nostr signing");
+};
+const unavailableNostrSignerBroker = {
+    listAccounts: async () => [],
+    requestProfileCreation: async () => unavailable(),
+    connectRemoteSigner: async () => unavailable(),
+    importPrivateKey: async () => unavailable(),
+    getPublicKey: async () => unavailable(),
+    signEvent: async () => unavailable(),
+    nip44Encrypt: async () => unavailable(),
+    nip44Decrypt: async () => unavailable(),
+    close: async () => undefined,
+};
+function assertSignedEventMatches(requested, signed) {
+    if (signed.kind !== requested.kind ||
+        signed.created_at !== requested.created_at ||
+        signed.content !== requested.content ||
+        JSON.stringify(signed.tags) !== JSON.stringify(requested.tags)) {
+        throw new Error("Nostr signer changed the requested event");
+    }
+}

package/dist/plugin-asset-server.d.ts

@@ -53,6 +53,7 @@ export declare function parseWebPluginAssetUrl(value: string, base?: string): Pl
 export declare function getInstalledPluginAssetVersion(record: InstalledPluginRecord): string;
 export declare function getInstalledPluginAssetHash(record: InstalledPluginRecord, relativePath: string): string;
 export declare function getInstalledPluginAssetFingerprint(record: InstalledPluginRecord): string;
+export declare function getInstalledPluginAssetFingerprintSha256(record: InstalledPluginRecord): Promise<string>;
 export declare function isSupportedPluginAssetPath(path: string): boolean;
 export declare function assertSupportedPluginAssetPath(path: string): void;
 export declare function getPluginAssetContentType(path: string): string;

package/dist/plugin-asset-server.js

@@ -66,6 +66,9 @@ export function getInstalledPluginAssetFingerprint(record) {
         .map((file) => `${file.path}:${file.size}:${file.sha256}`)
         .join("|");
 }
+export async function getInstalledPluginAssetFingerprintSha256(record) {
+    return sha256Hex(new TextEncoder().encode(getInstalledPluginAssetFingerprint(record)));
+}
 export function isSupportedPluginAssetPath(path) {
     return /\.(?:mjs|js|cjs|css|json|wasm|svg|png|jpg|jpeg|gif)$/iu.test(path);
 }

package/dist/plugin-capability-facade.d.ts

@@ -1,4 +1,4 @@
-export type HostedPluginCapability = "vault:read" | "vault:write" | "plugin:data" | "commands" | "notices" | "settings" | "metadata:query" | "events" | "logging";
+export type HostedPluginCapability = "vault:read" | "vault:write" | "plugin:data" | "commands" | "notices" | "settings" | "metadata:query" | "metadata:identity" | "metadata:changes" | "vault:stream" | "plugin:generated-state" | "network:connect" | "crypto:nostr-sync" | "events" | "logging";
 export declare const HOSTED_PLUGIN_CAPABILITIES: readonly HostedPluginCapability[];
 export type HostedPluginLogLevel = "trace" | "debug" | "info" | "warn" | "error";
 export interface HostedPluginCapabilityRequest<TPayload extends Record<string, unknown> = Record<string, unknown>> {

package/dist/plugin-capability-facade.js

@@ -6,6 +6,12 @@ export const HOSTED_PLUGIN_CAPABILITIES = [
     "notices",
     "settings",
     "metadata:query",
+    "metadata:identity",
+    "metadata:changes",
+    "vault:stream",
+    "plugin:generated-state",
+    "network:connect",
+    "crypto:nostr-sync",
     "events",
     "logging",
 ];

package/dist/plugin-distribution/catalog-media.d.ts

@@ -0,0 +1,4 @@
+import { resolveRegistryMedia, type RegistryMediaV2 } from "../registry-schema/index.js";
+export { resolveRegistryMedia };
+export type { RegistryMediaV2 };
+export declare function fetchVerifiedPluginImage(reference: ReturnType<typeof resolveRegistryMedia>, fetchImpl?: typeof fetch, signal?: AbortSignal): Promise<Blob>;

package/dist/plugin-distribution/catalog-media.js

@@ -0,0 +1,40 @@
+import { resolveRegistryMedia, } from "../registry-schema/index.js";
+import { verifySha256 } from "./hashes";
+import { PluginDistributionError } from "./errors";
+export { resolveRegistryMedia };
+export async function fetchVerifiedPluginImage(reference, fetchImpl = fetch, signal) {
+    if (reference.size > 5 * 1024 * 1024 || reference.size < 1)
+        throw new PluginDistributionError("metadata-invalid", "Plugin image exceeds the supported size.");
+    const response = await fetchImpl(reference.url, { signal });
+    if (!response.ok || !response.body)
+        throw new PluginDistributionError("metadata-invalid", "Plugin image request failed.");
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    try {
+        while (true) {
+            const chunk = await reader.read();
+            if (chunk.done)
+                break;
+            size += chunk.value.byteLength;
+            if (size > reference.size) {
+                await reader.cancel();
+                throw new PluginDistributionError("metadata-invalid", "Plugin image size does not match signed metadata.");
+            }
+            chunks.push(chunk.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    if (size !== reference.size)
+        throw new PluginDistributionError("metadata-invalid", "Plugin image size does not match signed metadata.");
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    await verifySha256(bytes, reference.sha256);
+    return new Blob([bytes], { type: reference.mediaType });
+}

package/dist/plugin-distribution/download-stats.d.ts

@@ -0,0 +1,4 @@
+import type { PluginDownloadCounts, PluginDownloadStatsSummary } from "./types";
+export declare const PLUGIN_DOWNLOAD_STATS_MAX_AGE_DAYS = 5;
+export declare function isUsablePluginDownloadStatsSummary(summary: PluginDownloadStatsSummary, now?: Date): boolean;
+export declare function pluginDownloadCounts(summary: PluginDownloadStatsSummary, pluginId: string): PluginDownloadCounts;

package/dist/plugin-distribution/download-stats.js

@@ -0,0 +1,19 @@
+export const PLUGIN_DOWNLOAD_STATS_MAX_AGE_DAYS = 5;
+const ONE_DAY_MS = 86_400_000;
+export function isUsablePluginDownloadStatsSummary(summary, now = new Date()) {
+    if (!summary.through || summary.trackedSince > summary.through)
+        return false;
+    if (Object.values(summary.periods).some((period) => !period.from || !period.through)) {
+        return false;
+    }
+    const today = Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate());
+    const through = Date.parse(`${summary.through}T00:00:00.000Z`);
+    const ageDays = (today - through) / ONE_DAY_MS;
+    return ageDays >= 0 && ageDays <= PLUGIN_DOWNLOAD_STATS_MAX_AGE_DAYS;
+}
+export function pluginDownloadCounts(summary, pluginId) {
+    return {
+        lifetime: summary.periods.lifetime.plugins[pluginId]?.total ?? 0,
+        recent: summary.periods["30d"].plugins[pluginId]?.total ?? 0,
+    };
+}

package/dist/plugin-distribution/index.d.ts

@@ -1,11 +1,14 @@
 export * from "./canonical-json";
 export * from "./compatibility";
+export * from "./download-stats";
 export * from "./errors";
 export * from "./hashes";
 export * from "./installed-plugin-state";
 export * from "./installer";
 export * from "./manager";
+export * from "./nostr-registry-adapter";
 export * from "./path-safety";
+export * from "./plugin-markdown";
 export * from "./plugin-bundle";
 export * from "./plugin-bundle-verifier";
 export * from "./plugin-bundle-worker";
@@ -16,3 +19,4 @@ export * from "./runtime-validation";
 export * from "./schemas";
 export * from "./signing";
 export * from "./types";
+export * from "./catalog-media";

package/dist/plugin-distribution/index.js

@@ -1,11 +1,14 @@
 export * from "./canonical-json";
 export * from "./compatibility";
+export * from "./download-stats";
 export * from "./errors";
 export * from "./hashes";
 export * from "./installed-plugin-state";
 export * from "./installer";
 export * from "./manager";
+export * from "./nostr-registry-adapter";
 export * from "./path-safety";
+export * from "./plugin-markdown";
 export * from "./plugin-bundle";
 export * from "./plugin-bundle-verifier";
 export * from "./plugin-bundle-worker";
@@ -16,3 +19,4 @@ export * from "./runtime-validation";
 export * from "./schemas";
 export * from "./signing";
 export * from "./types";
+export * from "./catalog-media";

package/dist/plugin-distribution/installer.d.ts

@@ -1,6 +1,7 @@
 import type { DataAdapter } from "../storage/fs";
 import { InstalledPluginStateStore } from "./installed-plugin-state";
 import { type PluginBundleVerificationMode } from "./plugin-bundle-worker";
+import { type VerifiedPluginBundlePayload } from "./plugin-bundle-verifier";
 import type { InstalledPluginRecord, PluginCatalogDetail, PluginCatalogEntry, PluginCompatibilityInput, PluginProvenance, TrustedSigningKey } from "./types";
 export type PluginBinaryFetch = (url: string, init?: RequestInit) => Promise<PluginBinaryResponse>;
 export type PluginBinaryResponse = Pick<Response, "ok" | "status" | "statusText" | "arrayBuffer" | "text"> & {
@@ -75,6 +76,8 @@ export declare class VerifiedPluginInstaller {
     private assertReleaseMatchesCatalog;
     private fetchBundle;
     private verifyPluginBundle;
+    /** Install payload bytes already verified by a trusted registry adapter. */
+    installVerifiedPayload(payload: VerifiedPluginBundlePayload, options: Omit<InstallVerifiedPluginBundleOptions, "bundle">): Promise<InstalledPluginRecord>;
     private installVerifiedBundlePayload;
     private readBundleResponseBytes;
     private emitBundleDownloadProgress;

package/dist/plugin-distribution/installer.js

@@ -23,7 +23,23 @@ export class VerifiedPluginInstaller {
         throwIfAborted(options.signal);
         const release = this.resolveRelease(options.detail, options.version);
         const bundleUrl = new URL(release.bundle.url, options.entry.detail).toString();
-        const bundle = await this.fetchBundle(bundleUrl, release.bundle, options);
+        let bundle;
+        const downloadUrl = release.bundle.downloadUrl
+            ? new URL(release.bundle.downloadUrl, options.entry.detail).toString()
+            : bundleUrl;
+        try {
+            bundle = await this.fetchBundle(downloadUrl, release.bundle, options);
+        }
+        catch (error) {
+            throwIfAborted(options.signal);
+            if (downloadUrl === bundleUrl ||
+                isAbortError(error) ||
+                (error instanceof PluginDistributionError &&
+                    error.details?.status === 410)) {
+                throw error;
+            }
+            bundle = await this.fetchBundle(bundleUrl, release.bundle, options);
+        }
         const payload = await this.verifyPluginBundle(bundle, {
             ...options,
             expectedBundle: release.bundle,
@@ -118,8 +134,12 @@ export class VerifiedPluginInstaller {
         }
         return verifyPluginBundlePayload(verifierOptions);
     }
+    /** Install payload bytes already verified by a trusted registry adapter. */
+    async installVerifiedPayload(payload, options) {
+        return this.installVerifiedBundlePayload(payload, options);
+    }
     async installVerifiedBundlePayload(payload, options) {
-        const { releaseEnvelope, releaseManifest, releaseManifestSha256, files } = payload;
+        const { releaseEnvelope, releaseManifest, releaseManifestSha256, files, nostrProof, } = payload;
         if (options.compatibility) {
             const compatibility = checkReleaseManifestCompatibility(releaseManifest, options.compatibility);
             if (!compatibility.compatible) {
@@ -193,7 +213,10 @@ export class VerifiedPluginInstaller {
             ...(runtimeValidation.warnings.length
                 ? { runtimeWarnings: runtimeValidation.warnings }
                 : {}),
-            signature: releaseEnvelope.signatures[0],
+            ...(releaseEnvelope.signatures[0]
+                ? { signature: releaseEnvelope.signatures[0] }
+                : {}),
+            ...(nostrProof ? { nostrProof } : {}),
             restartRequired: Boolean(this.options.pluginManager),
         };
         await this.stateStore.upsert(record);