@lesliechan721/aw-plugin-core 0.1.0-beta.3 → 0.1.0-beta.31

package/dist/workspace.js

@@ -2,16 +2,17 @@ import crypto from 'node:crypto';
 import path from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import fs from 'fs-extra';
-import { assertCatalogVersion, assertStrictSemVer, compareStrictSemVer, MARKETPLACE_SOURCE_PATH, SOURCE_MANIFEST_PATH, createMarketplaceManifest, createMarketplaceManifestEntry, normalizeCatalogManifestBase, normalizeCatalogMarketplaceIdentity, normalizeCatalogManifestEntries, normalizeManifestDigestInput, readMarketplaceSourceMeta, readPluginManifest, validatePlatformManifestProjection, } from './manifest-contract.js';
+import { assertCatalogVersion, assertStrictSemVer, compareStrictSemVer, parseStrictSemVer, MARKETPLACE_SOURCE_PATH, SOURCE_MANIFEST_PATH, createMarketplaceManifest, createMarketplaceManifestEntry, normalizeCatalogManifestBase, normalizeCatalogMarketplaceIdentity, normalizeCatalogManifestEntries, normalizeManifestDigestInput, readMarketplaceSourceMeta, readPluginManifest, validatePlatformManifestProjection, } from './manifest-contract.js';
 import { resolveSupportedPlatforms } from './platform-support.js';
-import { appendCatalogToPluginReleaseLedger, assertStablePluginVersion, PLUGIN_RELEASE_LEDGER_FILENAME, PLUGIN_RELEASE_LEDGER_SCHEMA_VERSION, resolveBetaPluginVersionOverrides, validatePluginReleaseLedgerAgainstManifest, } from './plugin-release.js';
-export const DEFAULT_WORKSPACE_CATALOG_VERSION = '0.1.0';
+import { createAwPluginRequirementsReceipt, normalizeAwCapabilities, parseAwPluginRequirementsReceipt, } from './aw-capabilities.js';
+export const DEFAULT_CATALOG_WORKSPACE_VERSION = '0.1.0';
 export const DEFAULT_CATALOG_OUTPUT_PATH = path.join('.aw', 'catalog');
 export const DEFAULT_PUBLISHED_CATALOG_OUTPUT_PATH = path.join('.aw', 'publish', 'catalog');
 export const DEFAULT_PLUGIN_OUTPUT_PATH = path.join('.aw', 'plugins');
 export const CATALOG_MANIFEST_FILENAME = 'catalog-manifest.json';
 export const GENERATED_OUTPUT_MARKER_FILENAME = '.aw-generated.json';
-export const WORKSPACE_MARKER_FILENAME = '.aw-workspace.json';
+export const CATALOG_WORKSPACE_MARKER_FILENAME = '.aw-workspace.json';
+const AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME = 'aw-plugin-requirements.json';
 function isInside(root, candidate) {
     const relative = path.relative(root, candidate);
     return relative === '' || (relative !== '..'
@@ -47,11 +48,11 @@ async function assertNoSymlinkPath(root, target) {
         }
     }
 }
-export async function resolveWorkspaceOutputPath(options) {
-    const workspaceRoot = await assertDirectoryWithoutSymlinks(options.workspaceRoot, 'Workspace root');
+export async function resolveCatalogWorkspaceOutputPath(options) {
+    const workspaceRoot = await assertDirectoryWithoutSymlinks(options.workspaceRoot, 'Catalog Workspace root');
     const outputRoot = path.resolve(workspaceRoot, options.outputPath);
     if (!isInside(workspaceRoot, outputRoot) || outputRoot === workspaceRoot) {
-        throw new Error(`Output must be inside the workspace: ${outputRoot}`);
+        throw new Error(`Output must be inside the Catalog Workspace: ${outputRoot}`);
     }
     await assertNoSymlinkPath(workspaceRoot, outputRoot);
     const protectedRoots = [
@@ -63,7 +64,7 @@ export async function resolveWorkspaceOutputPath(options) {
         if (protectedRoot.endsWith(`${path.sep}.aw`) && outputRoot !== protectedRoot)
             continue;
         if (isInside(protectedRoot, outputRoot) || isInside(outputRoot, protectedRoot)) {
-            throw new Error(`Output overlaps a protected workspace path: ${outputRoot}`);
+            throw new Error(`Output overlaps a protected Catalog Workspace path: ${outputRoot}`);
         }
     }
     const otherGeneratedRoot = path.join(workspaceRoot, options.kind === 'catalog' ? DEFAULT_PLUGIN_OUTPUT_PATH : DEFAULT_CATALOG_OUTPUT_PATH);
@@ -72,24 +73,24 @@ export async function resolveWorkspaceOutputPath(options) {
     }
     return { workspaceRoot, outputRoot };
 }
-function safeWorkspaceName(workspaceRoot) {
+function safeCatalogWorkspaceName(workspaceRoot) {
     const normalized = path.basename(workspaceRoot).toLowerCase()
         .replace(/[^a-z0-9]+/gu, '-')
         .replace(/^-+|-+$/gu, '');
     return normalized || 'aw-workspace';
 }
-function workspaceMetadata(options, workspaceRoot) {
-    const workspaceName = safeWorkspaceName(workspaceRoot);
+function catalogWorkspaceMetadata(options, workspaceRoot) {
+    const catalogWorkspaceName = safeCatalogWorkspaceName(workspaceRoot);
     return {
         owner: {
-            name: options.ownerName?.trim() || workspaceName,
-            url: options.ownerUrl?.trim() || `https://example.invalid/aw-workspaces/${workspaceName}`,
+            name: options.ownerName?.trim() || catalogWorkspaceName,
+            url: options.ownerUrl?.trim() || `https://example.invalid/aw-workspaces/${catalogWorkspaceName}`,
         },
         interface: {
-            displayName: options.displayName?.trim() || workspaceName,
+            displayName: options.displayName?.trim() || catalogWorkspaceName,
         },
         catalog: {
-            version: assertCatalogVersion(options.catalogVersion ?? DEFAULT_WORKSPACE_CATALOG_VERSION, 'catalog version'),
+            version: assertCatalogVersion(options.catalogVersion ?? DEFAULT_CATALOG_WORKSPACE_VERSION, 'catalog version'),
         },
     };
 }
@@ -115,41 +116,42 @@ async function writeTextAtomic(filePath, value) {
         throw error;
     }
 }
-function workspaceIdentity(workspaceRoot) {
-    return sha256(`aw-plugin-workspace-v1\0${path.resolve(workspaceRoot)}`);
-}
-function workspaceScaffoldMarker(metadata) {
+function catalogWorkspaceMarker() {
     return {
         schemaVersion: 1,
-        kind: 'aw-plugin-workspace',
+        kind: 'aw-catalog-workspace',
         workspaceIdentity: sha256(crypto.randomUUID()),
-        sourceIdentity: sha256(stableStringify(metadata)),
     };
 }
-function validateWorkspaceScaffoldMarker(value) {
+function validateCatalogWorkspaceMarker(value) {
     const marker = value;
-    const digestPattern = /^sha256:[0-9a-f]{64}$/u;
     if (!marker
         || typeof marker !== 'object'
         || Array.isArray(marker)
         || !isDeepStrictEqual(Object.keys(marker).sort(), [
-            'kind', 'schemaVersion', 'sourceIdentity', 'workspaceIdentity',
+            'kind', 'schemaVersion', 'workspaceIdentity',
         ])
         || marker.schemaVersion !== 1
-        || marker.kind !== 'aw-plugin-workspace'
+        || marker.kind !== 'aw-catalog-workspace'
         || typeof marker.workspaceIdentity !== 'string'
-        || !digestPattern.test(marker.workspaceIdentity)
-        || typeof marker.sourceIdentity !== 'string'
-        || !digestPattern.test(marker.sourceIdentity)) {
-        throw new Error('Invalid workspace scaffold marker.');
+        || marker.workspaceIdentity.trim().length === 0) {
+        throw new Error('Invalid Catalog Workspace marker.');
     }
     return { workspaceIdentity: marker.workspaceIdentity };
 }
-async function readWorkspaceOwnershipIdentity(workspaceRoot) {
-    const markerPath = path.join(workspaceRoot, WORKSPACE_MARKER_FILENAME);
-    if (!await fs.pathExists(markerPath))
-        return workspaceIdentity(workspaceRoot);
-    return validateWorkspaceScaffoldMarker(await readRegularJson(markerPath, 'Workspace marker')).workspaceIdentity;
+export async function readCatalogWorkspaceMarker(workspaceRoot) {
+    const markerPath = path.join(workspaceRoot, CATALOG_WORKSPACE_MARKER_FILENAME);
+    let value;
+    try {
+        value = await readRegularJson(markerPath, 'Catalog Workspace marker');
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            throw new Error('Invalid Catalog Workspace marker.');
+        throw error;
+    }
+    const marker = validateCatalogWorkspaceMarker(value);
+    return { markerPath, workspaceIdentity: marker.workspaceIdentity };
 }
 async function readRegularJson(filePath, label) {
     const stat = await fs.lstat(filePath).catch((error) => {
@@ -162,21 +164,24 @@ async function readRegularJson(filePath, label) {
     }
     return fs.readJson(filePath);
 }
-export async function initializePluginWorkspace(options) {
-    const workspaceRoot = await assertDirectoryWithoutSymlinks(options.workspaceRoot, 'Workspace root');
+export async function initializeCatalogWorkspace(options) {
+    const workspaceRoot = await assertDirectoryWithoutSymlinks(options.workspaceRoot, 'Catalog Workspace root');
     const pluginsRoot = path.join(workspaceRoot, 'plugins');
     const metadataPath = path.join(workspaceRoot, MARKETPLACE_SOURCE_PATH);
-    const markerPath = path.join(workspaceRoot, WORKSPACE_MARKER_FILENAME);
-    const metadata = workspaceMetadata(options, workspaceRoot);
+    const markerPath = path.join(workspaceRoot, CATALOG_WORKSPACE_MARKER_FILENAME);
+    const metadata = catalogWorkspaceMetadata(options, workspaceRoot);
     const existingMetadata = await fs.pathExists(metadataPath);
     const existingMarker = await fs.pathExists(markerPath);
     if ((existingMetadata || existingMarker) && !options.force) {
-        throw new Error(`Workspace catalog scaffold already exists: ${workspaceRoot}`);
+        throw new Error(`Catalog Workspace scaffold already exists: ${workspaceRoot}`);
+    }
+    if (existingMetadata && !existingMarker) {
+        throw new Error(`Refusing to adopt Catalog Workspace metadata without a valid marker: ${metadataPath}`);
     }
     if (await fs.pathExists(pluginsRoot)) {
         const stat = await fs.lstat(pluginsRoot);
         if (!stat.isDirectory() || stat.isSymbolicLink()) {
-            throw new Error(`Workspace plugins path must be a regular directory: ${pluginsRoot}`);
+            throw new Error(`Catalog Workspace plugins path must be a regular directory: ${pluginsRoot}`);
         }
         const entries = (await fs.readdir(pluginsRoot)).filter((entry) => entry !== path.basename(metadataPath));
         if (entries.length > 0 && !existingMarker) {
@@ -186,17 +191,18 @@ export async function initializePluginWorkspace(options) {
     if (existingMetadata) {
         const current = await readMarketplaceSourceMeta(workspaceRoot);
         if (!isDeepStrictEqual(current, metadata)) {
-            throw new Error(`Refusing to replace different workspace catalog metadata: ${metadataPath}`);
+            throw new Error(`Refusing to replace different Catalog Workspace metadata: ${metadataPath}`);
         }
     }
-    const expectedMarker = workspaceScaffoldMarker(metadata);
+    const expectedMarker = catalogWorkspaceMarker();
+    let workspaceIdentity = expectedMarker.workspaceIdentity;
     if (existingMarker) {
-        const currentMarker = await readRegularJson(markerPath, 'Workspace marker');
+        const currentMarker = await readRegularJson(markerPath, 'Catalog Workspace marker');
         try {
-            validateWorkspaceScaffoldMarker(currentMarker);
+            workspaceIdentity = validateCatalogWorkspaceMarker(currentMarker).workspaceIdentity;
         }
         catch {
-            throw new Error(`Refusing to replace a workspace scaffold with a different identity: ${workspaceRoot}`);
+            throw new Error(`Refusing to replace a Catalog Workspace marker with a different identity: ${workspaceRoot}`);
         }
     }
     const gitignorePath = path.join(workspaceRoot, '.gitignore');
@@ -205,7 +211,7 @@ export async function initializePluginWorkspace(options) {
     if (gitignoreExists) {
         const stat = await fs.lstat(gitignorePath);
         if (!stat.isFile() || stat.isSymbolicLink()) {
-            throw new Error(`Workspace .gitignore must be a regular file: ${gitignorePath}`);
+            throw new Error(`Catalog Workspace .gitignore must be a regular file: ${gitignorePath}`);
         }
         previousGitignore = await fs.readFile(gitignorePath, 'utf8');
     }
@@ -236,49 +242,82 @@ export async function initializePluginWorkspace(options) {
             await fs.remove(pluginsRoot);
         throw error;
     }
-    return { workspaceRoot, metadataPath, metadata };
+    return { workspaceRoot, markerPath, workspaceIdentity, metadataPath, metadata };
 }
-export async function readPluginWorkspace(workspaceRoot, options = {}) {
-    const root = await assertDirectoryWithoutSymlinks(workspaceRoot, 'Workspace root');
+export async function readCatalogWorkspace(workspaceRoot, options = {}) {
+    const root = await assertDirectoryWithoutSymlinks(workspaceRoot, 'Catalog Workspace root');
+    const marker = await readCatalogWorkspaceMarker(root);
     const metadataPath = path.join(root, MARKETPLACE_SOURCE_PATH);
-    await readRegularJson(metadataPath, 'Workspace catalog metadata');
+    await readRegularJson(metadataPath, 'Catalog Workspace metadata');
     if (!isInside(root, await fs.realpath(metadataPath)))
-        throw new Error('Workspace catalog metadata resolves outside the workspace.');
+        throw new Error('Catalog Workspace metadata resolves outside the workspace.');
     const metadata = await readMarketplaceSourceMeta(root);
-    const pluginsRoot = await assertDirectoryWithoutSymlinks(path.join(root, 'plugins'), 'Workspace plugins directory');
+    const pluginsRoot = await assertDirectoryWithoutSymlinks(path.join(root, 'plugins'), 'Catalog Workspace plugins directory');
     if (!isInside(root, pluginsRoot))
-        throw new Error('Workspace plugins directory resolves outside the workspace.');
+        throw new Error('Catalog Workspace plugins directory resolves outside the workspace.');
     const plugins = [];
     for (const entry of (await fs.readdir(pluginsRoot, { withFileTypes: true })).sort((left, right) => left.name.localeCompare(right.name))) {
         if (entry.name === path.basename(metadataPath) || !entry.isDirectory()) {
             if (entry.isSymbolicLink())
-                throw new Error(`Workspace plugin source must not be a symbolic link: ${entry.name}`);
+                throw new Error(`Catalog Workspace plugin source must not be a symbolic link: ${entry.name}`);
             continue;
         }
         const pluginRoot = path.join(pluginsRoot, entry.name);
         const pluginStat = await fs.lstat(pluginRoot);
         if (!pluginStat.isDirectory() || pluginStat.isSymbolicLink() || !isInside(root, await fs.realpath(pluginRoot))) {
-            throw new Error(`Workspace plugin source must be a regular in-workspace directory: ${pluginRoot}`);
+            throw new Error(`Catalog Workspace plugin source must be a regular in-workspace directory: ${pluginRoot}`);
         }
         const manifestDir = path.join(pluginRoot, path.dirname(SOURCE_MANIFEST_PATH));
         const manifestPath = path.join(pluginRoot, SOURCE_MANIFEST_PATH);
         await assertDirectoryWithoutSymlinks(manifestDir, 'Plugin manifest directory');
         await readRegularJson(manifestPath, 'Plugin manifest');
         if (!isInside(root, await fs.realpath(manifestPath)))
-            throw new Error(`Plugin manifest resolves outside the workspace: ${manifestPath}`);
+            throw new Error(`Plugin manifest resolves outside the Catalog Workspace: ${manifestPath}`);
         const plugin = await readPluginManifest(pluginRoot, { mode: 'source', reservedImports: options.reservedImports });
         if (plugin.manifest.name !== entry.name) {
             throw new Error(`Plugin directory name ${JSON.stringify(entry.name)} must match manifest name ${JSON.stringify(plugin.manifest.name)}.`);
         }
         plugins.push(plugin);
     }
-    return { workspaceRoot: root, metadataPath, metadata, plugins };
+    return {
+        workspaceRoot: root,
+        markerPath: marker.markerPath,
+        workspaceIdentity: marker.workspaceIdentity,
+        metadataPath,
+        metadata,
+        plugins,
+    };
+}
+export function resolveCatalogVersionMutation(currentVersion, mutation) {
+    const current = assertCatalogVersion(currentVersion, 'current catalog version');
+    const hasVersion = mutation.version !== undefined;
+    const hasBump = mutation.bump !== undefined;
+    if (hasVersion === hasBump) {
+        throw new Error('Catalog version mutation requires exactly one of version or bump.');
+    }
+    if (mutation.version !== undefined) {
+        return assertCatalogVersion(mutation.version, 'catalog version');
+    }
+    if (!['major', 'minor', 'patch'].includes(mutation.bump)) {
+        throw new Error('Catalog version bump must be major, minor, or patch.');
+    }
+    const [major, minor, patch] = current.split('-', 1)[0].split('.').map(BigInt);
+    if (mutation.bump === 'major')
+        return `${major + 1n}.0.0`;
+    if (mutation.bump === 'minor')
+        return `${major}.${minor + 1n}.0`;
+    return `${major}.${minor}.${patch + 1n}`;
 }
-export async function setWorkspaceCatalogVersion(workspaceRoot, version, options = {}) {
-    const current = await readPluginWorkspace(workspaceRoot, options);
+export async function mutateCatalogWorkspaceVersion(workspaceRoot, mutation, options = {}) {
+    const current = await readCatalogWorkspace(workspaceRoot, options);
+    const version = resolveCatalogVersionMutation(current.metadata.catalog.version, mutation);
+    if (version === current.metadata.catalog.version)
+        return current.metadata;
     const metadata = {
         ...current.metadata,
-        catalog: { version: assertCatalogVersion(version, 'catalog version') },
+        catalog: {
+            version,
+        },
     };
     await writeJsonAtomic(current.metadataPath, metadata);
     return metadata;
@@ -369,29 +408,54 @@ function stableStringify(value) {
 function sha256(value) {
     return `sha256:${crypto.createHash('sha256').update(value).digest('hex')}`;
 }
-function publishedContentDigest(manifest) {
-    return sha256(stableStringify({
-        schemaIdentity: { schemaVersion: manifest.schemaVersion },
-        marketplaceMetadata: {
-            name: 'aw',
-            owner: manifest.marketplace.owner,
-            interface: manifest.marketplace.interface,
-        },
-        compatibility: manifest.compatibility,
-        plugins: manifest.entries.map((entry) => ({
-            name: entry.name,
-            targetVersion: entry.version.replace(/-beta\.[1-9]\d*$/u, ''),
-            contentDigest: entry.contentDigest,
-        })).sort((left, right) => left.name.localeCompare(right.name)),
-    }));
-}
-function sourceIdentity(metadata, plugins) {
-    return sha256(stableStringify({
-        metadata,
-        plugins: [...plugins]
-            .sort((left, right) => left.manifest.name.localeCompare(right.manifest.name))
-            .map((plugin) => plugin.manifest),
-    }));
+const SOURCE_IDENTITY_EXCLUDED_DIRECTORIES = new Set([
+    '.git', '.aw', 'node_modules', 'evals', 'reports',
+]);
+const SOURCE_IDENTITY_EXCLUDED_FILES = new Set([
+    '.DS_Store', 'AGENTS.md', 'CLAUDE.md',
+]);
+async function sourceIdentityRecords(root, relative = '') {
+    const records = [];
+    for (const entry of (await fs.readdir(path.join(root, relative), { withFileTypes: true }))
+        .sort((left, right) => left.name.localeCompare(right.name))) {
+        if (SOURCE_IDENTITY_EXCLUDED_DIRECTORIES.has(entry.name) || SOURCE_IDENTITY_EXCLUDED_FILES.has(entry.name)) {
+            continue;
+        }
+        const child = relative ? path.posix.join(relative, entry.name) : entry.name;
+        const filePath = path.join(root, child);
+        const stat = await fs.lstat(filePath);
+        if (stat.isSymbolicLink())
+            throw new Error(`Catalog source identity does not accept symbolic links: ${filePath}`);
+        if (stat.isDirectory())
+            records.push(...await sourceIdentityRecords(root, child));
+        else if (stat.isFile()) {
+            const mode = (stat.mode & 0o111) === 0 ? '100644' : '100755';
+            records.push(`${child}\0${mode}\0${sha256(await fs.readFile(filePath))}`);
+        }
+        else {
+            throw new Error(`Catalog source identity only accepts regular files and directories: ${filePath}`);
+        }
+    }
+    return records;
+}
+export async function calculateCatalogWorkspaceSourceIdentity(workspace) {
+    const roots = [workspace.metadataPath, ...workspace.plugins.map((plugin) => plugin.rootDir)];
+    const records = [];
+    for (const sourceRoot of roots.sort((left, right) => left.localeCompare(right))) {
+        const relativeRoot = path.relative(workspace.workspaceRoot, sourceRoot).split(path.sep).join('/');
+        const stat = await fs.lstat(sourceRoot);
+        if (stat.isSymbolicLink())
+            throw new Error(`Catalog source identity does not accept symbolic links: ${sourceRoot}`);
+        if (stat.isFile()) {
+            const mode = (stat.mode & 0o111) === 0 ? '100644' : '100755';
+            records.push(`${relativeRoot}\0${mode}\0${sha256(await fs.readFile(sourceRoot))}`);
+        }
+        else if (stat.isDirectory()) {
+            for (const record of await sourceIdentityRecords(sourceRoot))
+                records.push(`${relativeRoot}/${record}`);
+        }
+    }
+    return sha256(records.sort().join('\n'));
 }
 function generatedOutputMarker(options) {
     return {
@@ -422,9 +486,26 @@ async function catalogPathRecord(root, relative, versionNeutral) {
     if (!stat.isFile())
         throw new Error(`Catalog digest path must be a regular file or symlink: ${filePath}.`);
     const manifests = new Set(['.agents-plugin/plugin.json', '.claude-plugin/plugin.json', '.codex-plugin/plugin.json']);
-    const digest = versionNeutral && manifests.has(relative)
-        ? sha256(stableStringify({ ...await fs.readJson(filePath), version: '<plugin-version>' }))
-        : sha256(await fs.readFile(filePath));
+    let digest;
+    if (versionNeutral && manifests.has(relative)) {
+        digest = sha256(stableStringify({
+            ...await fs.readJson(filePath),
+            version: '<plugin-version>',
+        }));
+    }
+    else if (versionNeutral && path.posix.basename(relative) === AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME) {
+        const receipt = await fs.readJson(filePath);
+        const plugin = receipt.plugin && typeof receipt.plugin === 'object' && !Array.isArray(receipt.plugin)
+            ? receipt.plugin
+            : {};
+        digest = sha256(stableStringify({
+            ...receipt,
+            plugin: { ...plugin, version: '<plugin-version>' },
+        }));
+    }
+    else {
+        digest = sha256(await fs.readFile(filePath));
+    }
     return { path: relative, kind: 'file', mode: (stat.mode & 0o100) === 0 ? '100644' : '100755', digest };
 }
 async function calculateEntryDigest(root, versionNeutral) {
@@ -432,16 +513,44 @@ async function calculateEntryDigest(root, versionNeutral) {
     return sha256(stableStringify(await Promise.all(files.map((file) => catalogPathRecord(root, file, versionNeutral)))));
 }
 async function expectedCatalogEntry(plugin, pluginRoot) {
+    const bundleManifest = await readRegularJson(path.join(pluginRoot, SOURCE_MANIFEST_PATH), `Catalog plugin ${JSON.stringify(plugin.manifest.name)} bundle manifest`);
     return {
         ...createMarketplaceManifestEntry(plugin),
         version: plugin.manifest.version,
-        compatibility: plugin.manifest.compatibility,
+        dependencies: [...(plugin.manifest.dependencies ?? [])].sort(),
+        requires: {
+            aw: {
+                capabilities: normalizeAwCapabilities(plugin.manifest.requires?.aw.capabilities ?? []),
+            },
+        },
         artifactDigest: await calculateEntryDigest(pluginRoot, false),
-        manifestDigest: sha256(normalizeManifestDigestInput(plugin.manifest)),
+        manifestDigest: sha256(normalizeManifestDigestInput(bundleManifest)),
         contentDigest: await calculateEntryDigest(pluginRoot, true),
     };
 }
-function normalizeCatalogRelease(raw, catalogVersion) {
+async function validateBundleRuntimeRequirementsReceipts(plugin, pluginRoot) {
+    const files = await listBundleFiles(pluginRoot);
+    const expectedReceiptPaths = new Set(files.flatMap((relative) => /^(?:claude|codex|agent-skills)\/skills\/[^/]+\/SKILL\.md$/u.test(relative)
+        ? [path.posix.join(path.posix.dirname(relative), AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME)]
+        : []));
+    const actualReceiptPaths = files.filter((relative) => path.posix.basename(relative) === AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME);
+    for (const relative of expectedReceiptPaths) {
+        if (!actualReceiptPaths.includes(relative)) {
+            throw new Error(`Catalog plugin ${JSON.stringify(plugin.manifest.name)} Skill root is missing ${AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME}: ${relative}.`);
+        }
+    }
+    const expected = createAwPluginRequirementsReceipt({ name: plugin.manifest.name, version: plugin.manifest.version }, plugin.manifest.requires?.aw.capabilities ?? []);
+    for (const relative of actualReceiptPaths) {
+        if (!expectedReceiptPaths.has(relative)) {
+            throw new Error(`Catalog plugin ${JSON.stringify(plugin.manifest.name)} has a reserved runtime requirements receipt outside a Skill root: ${relative}.`);
+        }
+        const receipt = parseAwPluginRequirementsReceipt(await readRegularJson(path.join(pluginRoot, ...relative.split('/')), `Catalog plugin ${JSON.stringify(plugin.manifest.name)} runtime requirements receipt`));
+        if (!isDeepStrictEqual(receipt, expected)) {
+            throw new Error(`Catalog plugin ${JSON.stringify(plugin.manifest.name)} has a mismatched runtime requirements receipt: ${relative}.`);
+        }
+    }
+}
+function normalizeCatalogRelease(raw) {
     if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
         throw new Error('Invalid catalog manifest release: expected an object.');
     }
@@ -452,50 +561,33 @@ function normalizeCatalogRelease(raw, catalogVersion) {
         }
         return { state: 'development' };
     }
-    const allowed = new Set(['state', 'targetVersion', 'planId', 'sourceHead', 'contentDigest']);
+    const allowed = new Set(['state', 'sourceHead']);
     if (release.state !== 'published' || Object.keys(release).some((key) => !allowed.has(key))) {
         throw new Error('Invalid published catalog release.');
     }
-    const targetVersion = assertStrictSemVer(release.targetVersion, 'catalog release targetVersion');
-    if (targetVersion.includes('-') || targetVersion.includes('+')) {
-        throw new Error('Invalid catalog release targetVersion: expected a stable version.');
-    }
-    if (targetVersion !== catalogVersion.replace(/-beta\.[1-9]\d*$/u, '')) {
-        throw new Error('Invalid catalog release targetVersion: must match catalogVersion.');
-    }
-    const digestPattern = /^sha256:[0-9a-f]{64}$/u;
-    if (typeof release.planId !== 'string' || !digestPattern.test(release.planId)) {
-        throw new Error('Invalid catalog release planId.');
-    }
-    if (typeof release.contentDigest !== 'string' || !digestPattern.test(release.contentDigest)) {
-        throw new Error('Invalid catalog release contentDigest.');
-    }
     if (typeof release.sourceHead !== 'string' || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(release.sourceHead)) {
         throw new Error('Invalid catalog release sourceHead.');
     }
     return {
         state: 'published',
-        targetVersion,
-        planId: release.planId,
         sourceHead: release.sourceHead,
-        contentDigest: release.contentDigest,
     };
 }
-export async function buildWorkspaceCatalog(options) {
-    const workspace = await readPluginWorkspace(options.workspaceRoot, { reservedImports: options.reservedImports });
-    const plugins = orderPlugins(workspace.plugins);
-    const resolved = await resolveWorkspaceOutputPath({
-        workspaceRoot: workspace.workspaceRoot,
+export async function buildCatalogWorkspace(options) {
+    const catalogWorkspace = await readCatalogWorkspace(options.workspaceRoot, { reservedImports: options.reservedImports });
+    const plugins = orderPlugins(catalogWorkspace.plugins);
+    const resolved = await resolveCatalogWorkspaceOutputPath({
+        workspaceRoot: catalogWorkspace.workspaceRoot,
         outputPath: options.outputPath ?? DEFAULT_CATALOG_OUTPUT_PATH,
         kind: 'catalog',
     });
-    const catalogVersion = workspace.metadata.catalog.version;
+    const catalogVersion = catalogWorkspace.metadata.catalog.version;
     const channel = deriveCatalogChannel(catalogVersion);
     const pluginNames = plugins.map((plugin) => plugin.manifest.name).sort();
-    const identity = sourceIdentity(workspace.metadata, plugins);
+    const identity = await calculateCatalogWorkspaceSourceIdentity(catalogWorkspace);
     const marker = generatedOutputMarker({
         kind: 'catalog',
-        workspaceIdentity: await readWorkspaceOwnershipIdentity(workspace.workspaceRoot),
+        workspaceIdentity: catalogWorkspace.workspaceIdentity,
         sourceIdentity: identity,
     });
     await replaceGeneratedOutput({
@@ -503,12 +595,13 @@ export async function buildWorkspaceCatalog(options) {
         force: options.force === true,
         build: async (stagingRoot) => {
             const bundledPlugins = [];
+            await fs.ensureDir(path.join(stagingRoot, 'plugins'));
             for (const plugin of plugins) {
                 const closure = dependencyClosure(plugin, plugins);
                 const outputRoot = path.join(stagingRoot, 'plugins', plugin.manifest.name);
                 await fs.ensureDir(outputRoot);
                 await options.adapter.build({
-                    workspaceRoot: workspace.workspaceRoot,
+                    workspaceRoot: catalogWorkspace.workspaceRoot,
                     plugin,
                     plugins,
                     dependencies: closure.slice(0, -1),
@@ -519,25 +612,19 @@ export async function buildWorkspaceCatalog(options) {
             const byPlatform = (platform) => bundledPlugins
                 .filter((plugin) => resolveSupportedPlatforms(plugin.manifest).has(platform))
                 .sort((left, right) => left.manifest.name.localeCompare(right.manifest.name));
-            await fs.outputJson(path.join(stagingRoot, '.agents', 'plugins', 'marketplace.json'), createMarketplaceManifest(workspace.metadata, byPlatform('codex')), { spaces: 2 });
-            await fs.outputJson(path.join(stagingRoot, '.claude-plugin', 'marketplace.json'), createMarketplaceManifest(workspace.metadata, byPlatform('claude')), { spaces: 2 });
-            let minVersion = '0.0.0';
-            for (const plugin of bundledPlugins) {
-                const candidate = plugin.manifest.compatibility.aw.minVersion;
-                if (compareStrictSemVer(candidate, minVersion) > 0)
-                    minVersion = candidate;
-            }
+            await fs.outputJson(path.join(stagingRoot, '.agents', 'plugins', 'marketplace.json'), createMarketplaceManifest(catalogWorkspace.metadata, byPlatform('codex')), { spaces: 2 });
+            await fs.outputJson(path.join(stagingRoot, '.claude-plugin', 'marketplace.json'), createMarketplaceManifest(catalogWorkspace.metadata, byPlatform('claude')), { spaces: 2 });
             const entries = await Promise.all([...bundledPlugins]
                 .sort((left, right) => left.manifest.name.localeCompare(right.manifest.name))
                 .map((plugin) => expectedCatalogEntry(plugin, plugin.rootDir)));
             const manifest = {
-                schemaVersion: 4,
+                schemaVersion: 7,
                 catalogVersion,
                 channel,
-                compatibility: { aw: { minVersion } },
+                requires: { aw: { capabilities: ['aw.catalog-snapshot.v7'] } },
                 marketplace: {
-                    owner: workspace.metadata.owner,
-                    interface: workspace.metadata.interface,
+                    owner: catalogWorkspace.metadata.owner,
+                    interface: catalogWorkspace.metadata.interface,
                 },
                 release: { state: 'development' },
                 entries,
@@ -545,9 +632,9 @@ export async function buildWorkspaceCatalog(options) {
             await fs.writeJson(path.join(stagingRoot, CATALOG_MANIFEST_FILENAME), manifest, { spaces: 2 });
             await fs.writeJson(path.join(stagingRoot, GENERATED_OUTPUT_MARKER_FILENAME), marker, { spaces: 2 });
         },
-        validate: async (stagingRoot) => { await validateCatalogSnapshot(stagingRoot); },
+        validate: async (stagingRoot) => { await validateCatalogSnapshotComplete(stagingRoot); },
         assertReplaceable: async (existingRoot) => {
-            await validateCatalogSnapshot(existingRoot);
+            await validateCatalogSnapshotComplete(existingRoot);
             await assertGeneratedOutput(existingRoot, marker);
         },
     });
@@ -567,89 +654,154 @@ async function rewritePublishedPluginVersions(snapshotRoot, overrides) {
             const manifest = await fs.readJson(manifestPath);
             await fs.writeFile(manifestPath, `${JSON.stringify({ ...manifest, version }, null, 2)}\n`);
         }
+        const pluginRoot = path.join(snapshotRoot, 'plugins', pluginName);
+        for (const relative of await listBundleFiles(pluginRoot)) {
+            if (path.posix.basename(relative) !== AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME)
+                continue;
+            const receiptPath = path.join(pluginRoot, ...relative.split('/'));
+            const receipt = parseAwPluginRequirementsReceipt(await fs.readJson(receiptPath));
+            if (receipt.plugin.name !== pluginName) {
+                throw new Error(`Catalog plugin ${JSON.stringify(pluginName)} has a mismatched runtime requirements receipt.`);
+            }
+            await fs.writeFile(receiptPath, `${JSON.stringify(createAwPluginRequirementsReceipt({ name: pluginName, version }, receipt.requiredCapabilities), null, 2)}\n`);
+        }
+    }
+}
+function assertStablePluginVersion(version, fieldName) {
+    const parsed = parseStrictSemVer(version, fieldName);
+    if (parsed.prerelease.length > 0 || parsed.build.length > 0) {
+        throw new Error(`Invalid ${fieldName}: expected a stable SemVer without prerelease or build metadata.`);
+    }
+    return version;
+}
+function stableVersionBase(version, fieldName) {
+    const parsed = parseStrictSemVer(version, fieldName);
+    return `${parsed.major}.${parsed.minor}.${parsed.patch}`;
+}
+function resolvePublishedPluginVersions(options) {
+    const previousEntries = new Map(options.previousPluginEntries.map((entry) => [entry.name, entry]));
+    for (const entry of options.previous?.entries ?? [])
+        previousEntries.set(entry.name, entry);
+    const versions = {};
+    for (const plugin of options.plugins) {
+        const name = plugin.manifest.name;
+        const sourceVersion = assertStablePluginVersion(plugin.manifest.version, `${name} source version`);
+        const contentDigest = options.contentDigests.get(name);
+        if (!contentDigest)
+            throw new Error(`Missing release content digest for plugin ${JSON.stringify(name)}.`);
+        const previous = previousEntries.get(name);
+        if (!previous) {
+            versions[name] = options.channel === 'beta' ? `${sourceVersion}-beta.1` : sourceVersion;
+            continue;
+        }
+        const previousVersion = assertStrictSemVer(previous.version, `${name} previous published version`);
+        if (options.channel === 'latest') {
+            const comparison = compareStrictSemVer(sourceVersion, previousVersion);
+            if (comparison < 0) {
+                throw new Error(`Plugin ${name} source version ${sourceVersion} must not be lower than previous ${previousVersion}.`);
+            }
+            if (comparison === 0 && previous.contentDigest !== contentDigest) {
+                throw new Error(`Plugin ${name} version ${sourceVersion} maps to different content. Increase the source plugin version.`);
+            }
+            versions[name] = sourceVersion;
+            continue;
+        }
+        const previousBase = stableVersionBase(previousVersion, `${name} previous published version`);
+        const baseComparison = compareStrictSemVer(sourceVersion, previousBase);
+        if (baseComparison < 0) {
+            throw new Error(`Plugin ${name} source version ${sourceVersion} must not be lower than previous base ${previousBase}.`);
+        }
+        if (baseComparison > 0) {
+            versions[name] = `${sourceVersion}-beta.1`;
+            continue;
+        }
+        const parsedPrevious = parseStrictSemVer(previousVersion, `${name} previous published version`);
+        if (parsedPrevious.prerelease.length === 0) {
+            if (previous.contentDigest !== contentDigest) {
+                throw new Error(`Plugin ${name} stable version ${sourceVersion} maps to different content. Increase the source plugin version.`);
+            }
+            versions[name] = previousVersion;
+            continue;
+        }
+        if (parsedPrevious.prerelease.length !== 2
+            || parsedPrevious.prerelease[0] !== 'beta'
+            || !/^[1-9]\d*$/u.test(parsedPrevious.prerelease[1])) {
+            throw new Error(`Plugin ${name} previous version ${previousVersion} is not a stable or beta publication version.`);
+        }
+        versions[name] = previous.contentDigest === contentDigest
+            ? previousVersion
+            : `${sourceVersion}-beta.${Number(parsedPrevious.prerelease[1]) + 1}`;
     }
+    return versions;
 }
 export async function validatePublishedCatalogSnapshot(snapshotDirectory) {
-    const validation = await validateCatalogSnapshot(snapshotDirectory);
+    const validation = await validateCatalogSnapshotComplete(snapshotDirectory);
     if (validation.manifest.release.state !== 'published') {
         throw new Error('Published Catalog snapshot must have release.state published.');
     }
-    if (!validation.ledger)
-        throw new Error('Published Catalog snapshot must include a plugin release ledger.');
-    return { ...validation, ledger: validation.ledger };
+    return validation;
 }
-export async function preparePublishedWorkspaceCatalog(options) {
+export async function preparePublishedCatalogWorkspace(options) {
     if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(options.sourceHead)) {
         throw new Error('Published Catalog sourceHead must be a committed Git object ID.');
     }
-    const workspace = await readPluginWorkspace(options.workspaceRoot, { reservedImports: options.reservedImports });
-    for (const plugin of workspace.plugins) {
+    const catalogWorkspace = await readCatalogWorkspace(options.workspaceRoot, { reservedImports: options.reservedImports });
+    for (const plugin of catalogWorkspace.plugins) {
         assertStablePluginVersion(plugin.manifest.version, `${plugin.manifest.name} source version`);
     }
-    const catalogVersion = workspace.metadata.catalog.version;
+    const catalogVersion = catalogWorkspace.metadata.catalog.version;
     const channel = deriveCatalogChannel(catalogVersion);
     const previous = options.previousSnapshotRoot
         ? await validatePublishedCatalogSnapshot(options.previousSnapshotRoot)
         : null;
+    if (!previous && (options.historicalPluginEntries?.length ?? 0) > 0) {
+        throw new Error('Published Plugin history requires a previous Catalog snapshot.');
+    }
     if (previous && compareStrictSemVer(catalogVersion, previous.manifest.catalogVersion) <= 0) {
         throw new Error(`Catalog version ${catalogVersion} must be higher than published ${previous.manifest.catalogVersion}.`);
     }
-    const previousLedger = previous?.ledger ?? {
-        schemaVersion: PLUGIN_RELEASE_LEDGER_SCHEMA_VERSION,
-        records: [],
-    };
     const temporaryRelative = path.join('.aw', 'publish', `.catalog-preparation-${crypto.randomUUID()}`);
     const finalRelative = options.outputPath
         ?? `${DEFAULT_PUBLISHED_CATALOG_OUTPUT_PATH}-v${catalogVersion}`;
-    let temporaryRoot = path.resolve(workspace.workspaceRoot, temporaryRelative);
+    let temporaryRoot = path.resolve(catalogWorkspace.workspaceRoot, temporaryRelative);
     try {
-        const built = await buildWorkspaceCatalog({
-            workspaceRoot: workspace.workspaceRoot,
+        const built = await buildCatalogWorkspace({
+            workspaceRoot: catalogWorkspace.workspaceRoot,
             outputPath: temporaryRelative,
             adapter: options.adapter,
             reservedImports: options.reservedImports,
         });
         temporaryRoot = built.outputRoot;
-        const development = await validateCatalogSnapshot(temporaryRoot);
+        const development = await validateCatalogSnapshotComplete(temporaryRoot);
         const contentDigests = new Map(development.manifest.entries.map((entry) => [entry.name, entry.contentDigest]));
-        const overrides = channel === 'beta'
-            ? resolveBetaPluginVersionOverrides({
-                plugins: workspace.plugins,
-                contentDigests,
-                ledger: previousLedger,
-            })
-            : Object.fromEntries(workspace.plugins.map((plugin) => [plugin.manifest.name, plugin.manifest.version]));
+        const overrides = resolvePublishedPluginVersions({
+            channel,
+            plugins: catalogWorkspace.plugins,
+            contentDigests,
+            previous: previous?.manifest ?? null,
+            previousPluginEntries: options.historicalPluginEntries ?? [],
+        });
         await rewritePublishedPluginVersions(temporaryRoot, overrides);
-        const bundledPlugins = await Promise.all(workspace.plugins.map((plugin) => readPluginManifest(path.join(temporaryRoot, 'plugins', plugin.manifest.name), { mode: 'bundle' })));
+        const bundledPlugins = await Promise.all(catalogWorkspace.plugins.map((plugin) => readPluginManifest(path.join(temporaryRoot, 'plugins', plugin.manifest.name), { mode: 'bundle' })));
         const entries = await Promise.all(bundledPlugins.sort((left, right) => left.manifest.name.localeCompare(right.manifest.name))
             .map((plugin) => expectedCatalogEntry(plugin, plugin.rootDir)));
         const manifestWithoutRelease = {
             ...development.manifest,
+            catalogVersion,
+            channel,
             entries,
         };
-        const contentDigest = publishedContentDigest(manifestWithoutRelease);
         const manifest = {
             ...manifestWithoutRelease,
             release: {
                 state: 'published',
-                targetVersion: catalogVersion.replace(/-beta\.[1-9]\d*$/u, ''),
-                planId: contentDigest,
                 sourceHead: options.sourceHead,
-                contentDigest,
             },
         };
-        const ledger = appendCatalogToPluginReleaseLedger({
-            previous: previousLedger,
-            manifest,
-            contentDigests,
-        });
-        await Promise.all([
-            fs.writeFile(path.join(temporaryRoot, CATALOG_MANIFEST_FILENAME), `${JSON.stringify(manifest, null, 2)}\n`),
-            fs.writeFile(path.join(temporaryRoot, PLUGIN_RELEASE_LEDGER_FILENAME), `${JSON.stringify(ledger, null, 2)}\n`),
-        ]);
+        await fs.writeFile(path.join(temporaryRoot, CATALOG_MANIFEST_FILENAME), `${JSON.stringify(manifest, null, 2)}\n`);
         const prepared = await validatePublishedCatalogSnapshot(temporaryRoot);
-        const resolved = await resolveWorkspaceOutputPath({
-            workspaceRoot: workspace.workspaceRoot,
+        const resolved = await resolveCatalogWorkspaceOutputPath({
+            workspaceRoot: catalogWorkspace.workspaceRoot,
             outputPath: finalRelative,
             kind: 'catalog',
         });
@@ -670,8 +822,6 @@ export async function preparePublishedWorkspaceCatalog(options) {
             channel,
             pluginNames: built.pluginNames,
             snapshotDigest: prepared.snapshotDigest,
-            contentDigest,
-            planId: contentDigest,
         };
     }
     finally {
@@ -697,27 +847,27 @@ function dependencyClosure(plugin, all) {
     visit(plugin);
     return result;
 }
-export async function buildWorkspacePlugin(options) {
-    const workspace = await readPluginWorkspace(options.workspaceRoot, { reservedImports: options.reservedImports });
-    assertDependencyGraph(workspace.plugins);
-    const requestedPluginRoot = path.resolve(workspace.workspaceRoot, options.pluginDirectory);
+export async function buildCatalogWorkspacePlugin(options) {
+    const catalogWorkspace = await readCatalogWorkspace(options.workspaceRoot, { reservedImports: options.reservedImports });
+    assertDependencyGraph(catalogWorkspace.plugins);
+    const requestedPluginRoot = path.resolve(catalogWorkspace.workspaceRoot, options.pluginDirectory);
     const pluginRoot = await fs.realpath(requestedPluginRoot);
-    if (!isInside(workspace.workspaceRoot, pluginRoot))
-        throw new Error('Plugin directory must stay inside the workspace.');
-    const plugin = workspace.plugins.find((entry) => entry.rootDir === pluginRoot);
+    if (!isInside(catalogWorkspace.workspaceRoot, pluginRoot))
+        throw new Error('Plugin directory must stay inside the Catalog Workspace.');
+    const plugin = catalogWorkspace.plugins.find((entry) => entry.rootDir === pluginRoot);
     if (!plugin) {
-        throw new Error(`Plugin directory is not part of this workspace source: ${pluginRoot}`);
+        throw new Error(`Plugin directory is not part of this Catalog Workspace source: ${pluginRoot}`);
     }
-    const closure = dependencyClosure(plugin, workspace.plugins);
+    const closure = dependencyClosure(plugin, catalogWorkspace.plugins);
     const identity = sha256(normalizeManifestDigestInput(plugin.manifest));
     const marker = generatedOutputMarker({
         kind: 'plugin',
-        workspaceIdentity: await readWorkspaceOwnershipIdentity(workspace.workspaceRoot),
+        workspaceIdentity: catalogWorkspace.workspaceIdentity,
         sourceIdentity: identity,
         sourceName: plugin.manifest.name,
     });
-    const resolved = await resolveWorkspaceOutputPath({
-        workspaceRoot: workspace.workspaceRoot,
+    const resolved = await resolveCatalogWorkspaceOutputPath({
+        workspaceRoot: catalogWorkspace.workspaceRoot,
         outputPath: options.outputPath ?? path.join(DEFAULT_PLUGIN_OUTPUT_PATH, plugin.manifest.name),
         kind: 'plugin',
     });
@@ -725,9 +875,9 @@ export async function buildWorkspacePlugin(options) {
         outputRoot: resolved.outputRoot,
         force: options.force === true,
         build: (stagingRoot) => options.adapter.build({
-            workspaceRoot: workspace.workspaceRoot,
+            workspaceRoot: catalogWorkspace.workspaceRoot,
             plugin,
-            plugins: workspace.plugins,
+            plugins: catalogWorkspace.plugins,
             dependencies: closure.slice(0, -1),
             outputRoot: stagingRoot,
         }).then(() => fs.writeJson(path.join(stagingRoot, GENERATED_OUTPUT_MARKER_FILENAME), marker, { spaces: 2 })),
@@ -765,7 +915,7 @@ async function assertGeneratedOutput(root, expected) {
     if (!isDeepStrictEqual(Object.keys(marker).sort(), expectedKeys)
         || marker.schemaVersion !== 1
         || typeof marker.workspaceIdentity !== 'string'
-        || !digestPattern.test(marker.workspaceIdentity)
+        || marker.workspaceIdentity.trim().length === 0
         || typeof marker.sourceIdentity !== 'string'
         || !digestPattern.test(marker.sourceIdentity)) {
         throw new Error(`Refusing to replace foreign plugin output: ${root}`);
@@ -797,7 +947,7 @@ async function digestDirectory(root) {
     await walk(root);
     return `sha256:${crypto.createHash('sha256').update(entries.join('\n')).digest('hex')}`;
 }
-export async function validateCatalogSnapshot(snapshotDirectory) {
+async function validateCatalogSnapshotTransportInternal(snapshotDirectory) {
     const rootDir = await assertDirectoryWithoutSymlinks(snapshotDirectory, 'Catalog snapshot');
     const allowed = new Set([
         CATALOG_MANIFEST_FILENAME,
@@ -805,7 +955,6 @@ export async function validateCatalogSnapshot(snapshotDirectory) {
         '.agents',
         '.claude-plugin',
         'plugins',
-        'plugin-release-ledger.json',
     ]);
     const entries = await fs.readdir(rootDir);
     const unexpected = entries.filter((entry) => !allowed.has(entry));
@@ -815,19 +964,7 @@ export async function validateCatalogSnapshot(snapshotDirectory) {
         throw new Error(`Invalid catalog snapshot root layout: missing [${missing.join(', ')}], unexpected [${unexpected.join(', ')}].`);
     }
     if (entries.includes(GENERATED_OUTPUT_MARKER_FILENAME)) {
-        const marker = await readRegularJson(path.join(rootDir, GENERATED_OUTPUT_MARKER_FILENAME), 'Catalog generated output marker');
-        const digestPattern = /^sha256:[0-9a-f]{64}$/u;
-        if (!isDeepStrictEqual(Object.keys(marker).sort(), [
-            'kind', 'schemaVersion', 'sourceIdentity', 'workspaceIdentity',
-        ])
-            || marker.schemaVersion !== 1
-            || marker.kind !== 'catalog'
-            || typeof marker.workspaceIdentity !== 'string'
-            || !digestPattern.test(marker.workspaceIdentity)
-            || typeof marker.sourceIdentity !== 'string'
-            || !digestPattern.test(marker.sourceIdentity)) {
-            throw new Error('Invalid catalog generated output marker.');
-        }
+        validateCatalogGeneratedOutputMarker(await readRegularJson(path.join(rootDir, GENERATED_OUTPUT_MARKER_FILENAME), 'Catalog generated output marker'));
     }
     const assertLayout = async (directory, expected) => {
         const real = await assertDirectoryWithoutSymlinks(directory, 'Catalog snapshot directory');
@@ -845,16 +982,117 @@ export async function validateCatalogSnapshot(snapshotDirectory) {
     await readRegularJson(path.join(rootDir, '.agents', 'plugins', 'marketplace.json'), 'Codex marketplace');
     await readRegularJson(path.join(rootDir, '.claude-plugin', 'marketplace.json'), 'Claude marketplace');
     const snapshotDigest = await digestDirectory(rootDir);
-    const raw = await fs.readJson(path.join(rootDir, CATALOG_MANIFEST_FILENAME));
+    const manifest = normalizeCatalogManifestV7(await readRegularJson(path.join(rootDir, CATALOG_MANIFEST_FILENAME), 'Catalog manifest v7'));
+    const normalizedEntries = manifest.entries;
+    const marketplaceIdentity = manifest.marketplace;
+    const pluginNames = normalizedEntries.map((entry) => entry.name);
+    const diskNames = (await fs.readdir(path.join(rootDir, 'plugins'))).sort();
+    if (diskNames.join('\0') !== [...pluginNames].sort().join('\0'))
+        throw new Error('Invalid catalog snapshot plugin inventory.');
+    const platformEntries = {
+        claude: [],
+        codex: [],
+    };
+    for (const [index, name] of pluginNames.entries()) {
+        const pluginRoot = path.join(rootDir, 'plugins', name);
+        await assertDirectoryWithoutSymlinks(pluginRoot, `Catalog plugin ${JSON.stringify(name)}`);
+        const entry = normalizedEntries[index];
+        const rawBundleManifest = await readRegularJson(path.join(pluginRoot, SOURCE_MANIFEST_PATH), `Catalog plugin ${JSON.stringify(name)} bundle manifest`);
+        const expectedDigests = {
+            artifactDigest: await calculateEntryDigest(pluginRoot, false),
+            manifestDigest: sha256(normalizeManifestDigestInput(rawBundleManifest)),
+            contentDigest: await calculateEntryDigest(pluginRoot, true),
+        };
+        for (const field of Object.keys(expectedDigests)) {
+            if (entry[field] !== expectedDigests[field]) {
+                throw new Error(`Catalog entry ${field} for ${JSON.stringify(name)} does not match its plugin bundle.`);
+            }
+        }
+        for (const platform of ['claude', 'codex']) {
+            const platformManifest = path.join(pluginRoot, `.${platform}-plugin`, 'plugin.json');
+            const exists = await fs.pathExists(platformManifest);
+            if (exists) {
+                await readRegularJson(platformManifest, `${platform} plugin manifest`);
+                platformEntries[platform].push(entry);
+            }
+        }
+    }
+    const agentsMarketplace = await fs.readJson(path.join(rootDir, '.agents', 'plugins', 'marketplace.json'));
+    const claudeMarketplace = await fs.readJson(path.join(rootDir, '.claude-plugin', 'marketplace.json'));
+    const marketplaceEntry = (entry) => ({
+        name: entry.name,
+        source: entry.source,
+        description: entry.description,
+        interface: entry.interface,
+        category: entry.category,
+        tags: entry.tags,
+        strict: entry.strict,
+        policy: entry.policy,
+    });
+    const expectedMarketplace = (platform) => ({
+        name: 'aw',
+        owner: marketplaceIdentity.owner,
+        interface: marketplaceIdentity.interface,
+        plugins: platformEntries[platform].map(marketplaceEntry),
+    });
+    const expectedAgents = expectedMarketplace('codex');
+    const expectedClaude = expectedMarketplace('claude');
+    const normalizeMarketplaceOrder = (marketplace) => {
+        const canonical = JSON.parse(JSON.stringify(marketplace));
+        return {
+            ...canonical,
+            plugins: Array.isArray(canonical.plugins)
+                ? [...canonical.plugins].sort((left, right) => String(left?.name).localeCompare(String(right?.name)))
+                : canonical.plugins,
+        };
+    };
+    if (!isDeepStrictEqual(normalizeMarketplaceOrder(agentsMarketplace), normalizeMarketplaceOrder(expectedAgents))) {
+        throw new Error('Codex marketplace metadata or plugin inventory does not match the snapshot bundles.');
+    }
+    if (!isDeepStrictEqual(normalizeMarketplaceOrder(claudeMarketplace), normalizeMarketplaceOrder(expectedClaude))) {
+        throw new Error('Claude marketplace metadata or plugin inventory does not match the snapshot bundles.');
+    }
+    return { rootDir, manifest, snapshotDigest };
+}
+function validateCatalogGeneratedOutputMarker(raw) {
+    const marker = raw;
+    const digestPattern = /^sha256:[0-9a-f]{64}$/u;
+    if (!marker
+        || typeof marker !== 'object'
+        || Array.isArray(marker)
+        || !isDeepStrictEqual(Object.keys(marker).sort(), [
+            'kind', 'schemaVersion', 'sourceIdentity', 'workspaceIdentity',
+        ])
+        || marker.schemaVersion !== 1
+        || marker.kind !== 'catalog'
+        || typeof marker.workspaceIdentity !== 'string'
+        || marker.workspaceIdentity.trim().length === 0
+        || typeof marker.sourceIdentity !== 'string'
+        || !digestPattern.test(marker.sourceIdentity)) {
+        throw new Error('Invalid catalog generated output marker.');
+    }
+    return {
+        workspaceIdentity: marker.workspaceIdentity,
+        sourceIdentity: marker.sourceIdentity,
+    };
+}
+function normalizeCatalogManifestV7(rawValue) {
+    if (!rawValue || typeof rawValue !== 'object' || Array.isArray(rawValue)) {
+        throw new Error('Invalid catalog manifest v7: expected an object.');
+    }
+    const raw = rawValue;
     const allowedManifestKeys = new Set([
-        'schemaVersion', 'catalogVersion', 'channel', 'compatibility', 'marketplace', 'release', 'entries',
+        'schemaVersion', 'catalogVersion', 'channel', 'requires', 'marketplace', 'release', 'entries',
     ]);
     for (const key of Object.keys(raw))
         if (!allowedManifestKeys.has(key))
             throw new Error(`Invalid catalog manifest: unknown field ${JSON.stringify(key)}.`);
-    if (raw.schemaVersion !== 4)
-        throw new Error('Invalid catalog manifest schemaVersion: expected 4.');
-    const base = normalizeCatalogManifestBase(raw, 'catalog manifest v4');
+    if (raw.schemaVersion !== 7)
+        throw new Error('Invalid catalog manifest schemaVersion: expected 7.');
+    const base = normalizeCatalogManifestBase(raw, 'catalog manifest v7');
+    if (!(base.requires.aw.capabilities ?? []).includes('aw.catalog-snapshot.v7')) {
+        throw new Error('Invalid catalog manifest requires.aw.capabilities: expected aw.catalog-snapshot.v7.');
+    }
     const marketplaceIdentity = normalizeCatalogMarketplaceIdentity(raw.marketplace);
     if (!Array.isArray(raw.entries))
         throw new Error('Invalid catalog manifest entries: expected an array.');
@@ -870,94 +1108,84 @@ export async function validateCatalogSnapshot(snapshotDirectory) {
         delete copy.contentDigest;
         return copy;
     });
-    const normalizedEntries = normalizeCatalogManifestEntries(entriesWithoutContentDigest, base, 'catalog manifest v4')
+    const normalizedEntries = normalizeCatalogManifestEntries(entriesWithoutContentDigest, base, 'catalog manifest v7')
         .map((entry, index) => ({ ...entry, contentDigest: contentDigests[index] }));
     const pluginNames = normalizedEntries.map((entry, index) => {
         if (typeof entry.name !== 'string')
             throw new Error(`Invalid catalog manifest entries[${index}].name.`);
+        if (entry.source !== `./plugins/${entry.name}`) {
+            throw new Error(`Catalog entry source for ${JSON.stringify(entry.name)} does not match its plugin bundle.`);
+        }
         return entry.name;
     });
     if (new Set(pluginNames).size !== pluginNames.length)
         throw new Error('Invalid catalog manifest entries: duplicate plugin name.');
     if (pluginNames.join('\0') !== [...pluginNames].sort().join('\0'))
         throw new Error('Invalid catalog manifest entries: expected stable name order.');
-    const diskNames = (await fs.readdir(path.join(rootDir, 'plugins'))).sort();
-    if (diskNames.join('\0') !== [...pluginNames].sort().join('\0'))
-        throw new Error('Invalid catalog snapshot plugin inventory.');
+    const release = normalizeCatalogRelease(raw.release);
+    return {
+        schemaVersion: 7,
+        catalogVersion: base.catalogVersion,
+        channel: base.channel,
+        requires: base.requires,
+        marketplace: marketplaceIdentity,
+        release,
+        entries: normalizedEntries,
+    };
+}
+export async function validatePublishedCatalogSnapshotMetadata(snapshotDirectory) {
+    const rootDir = await assertDirectoryWithoutSymlinks(snapshotDirectory, 'Catalog snapshot metadata');
+    const [marker, manifest] = await Promise.all([
+        readRegularJson(path.join(rootDir, GENERATED_OUTPUT_MARKER_FILENAME), 'Catalog generated output marker').then(validateCatalogGeneratedOutputMarker),
+        readRegularJson(path.join(rootDir, CATALOG_MANIFEST_FILENAME), 'Catalog manifest v7').then(normalizeCatalogManifestV7),
+    ]);
+    if (manifest.release.state !== 'published') {
+        throw new Error('Published Catalog snapshot must have release.state published.');
+    }
+    return { rootDir, workspaceIdentity: marker.workspaceIdentity, manifest };
+}
+export async function validateCatalogSnapshotTransport(snapshotDirectory) {
+    return validateCatalogSnapshotTransportInternal(snapshotDirectory);
+}
+async function validateCatalogPluginEntriesComplete(validation, pluginNames) {
+    const entriesByName = new Map(validation.manifest.entries.map((entry) => [entry.name, entry]));
     const plugins = [];
-    for (const [index, name] of pluginNames.entries()) {
-        const pluginRoot = path.join(rootDir, 'plugins', name);
+    for (const name of pluginNames) {
+        const entry = entriesByName.get(name);
+        if (!entry)
+            throw new Error(`Catalog plugin ${JSON.stringify(name)} does not exist.`);
+        const pluginRoot = path.join(validation.rootDir, 'plugins', entry.name);
         const plugin = await readPluginManifest(pluginRoot, { mode: 'bundle' });
+        await validateBundleRuntimeRequirementsReceipts(plugin, pluginRoot);
         for (const platform of ['claude', 'codex']) {
-            const platformManifest = path.join(pluginRoot, `.${platform}-plugin`, 'plugin.json');
-            const exists = await fs.pathExists(platformManifest);
+            const platformManifestPath = path.join(pluginRoot, `.${platform}-plugin`, 'plugin.json');
+            const exists = await fs.pathExists(platformManifestPath);
             if (exists !== resolveSupportedPlatforms(plugin.manifest).has(platform)) {
-                throw new Error(`Catalog plugin ${JSON.stringify(name)} has an inconsistent ${platform} bundle projection.`);
+                throw new Error(`Catalog plugin ${JSON.stringify(entry.name)} has an inconsistent ${platform} bundle projection.`);
             }
             if (exists) {
-                const rawPlatformManifest = await readRegularJson(platformManifest, `${platform} plugin manifest`);
+                const rawPlatformManifest = await readRegularJson(platformManifestPath, `${platform} plugin manifest`);
                 await validatePlatformManifestProjection(plugin, platform, rawPlatformManifest);
             }
         }
         const expected = await expectedCatalogEntry(plugin, pluginRoot);
         for (const field of Object.keys(expected)) {
-            if (!isDeepStrictEqual(normalizedEntries[index][field], expected[field])) {
-                throw new Error(`Catalog entry ${field} for ${JSON.stringify(name)} does not match its plugin bundle.`);
+            if (!isDeepStrictEqual(entry[field], expected[field])) {
+                throw new Error(`Catalog entry ${field} for ${JSON.stringify(entry.name)} does not match its plugin bundle.`);
             }
         }
         plugins.push(plugin);
     }
     assertDependencyGraph(plugins);
-    const agentsMarketplace = await fs.readJson(path.join(rootDir, '.agents', 'plugins', 'marketplace.json'));
-    const claudeMarketplace = await fs.readJson(path.join(rootDir, '.claude-plugin', 'marketplace.json'));
-    const marketplaceMetadata = {
-        owner: marketplaceIdentity.owner,
-        interface: marketplaceIdentity.interface,
-        catalog: { version: base.catalogVersion },
-    };
-    const expectedAgents = createMarketplaceManifest(marketplaceMetadata, plugins.filter((plugin) => resolveSupportedPlatforms(plugin.manifest).has('codex')));
-    const expectedClaude = createMarketplaceManifest(marketplaceMetadata, plugins.filter((plugin) => resolveSupportedPlatforms(plugin.manifest).has('claude')));
-    const normalizeMarketplaceOrder = (marketplace) => {
-        const canonical = JSON.parse(JSON.stringify(marketplace));
-        return {
-            ...canonical,
-            plugins: Array.isArray(canonical.plugins)
-                ? [...canonical.plugins].sort((left, right) => String(left?.name).localeCompare(String(right?.name)))
-                : canonical.plugins,
-        };
-    };
-    if (!isDeepStrictEqual(normalizeMarketplaceOrder(agentsMarketplace), normalizeMarketplaceOrder(expectedAgents))) {
-        throw new Error('Codex marketplace metadata or plugin inventory does not match the snapshot bundles.');
-    }
-    if (!isDeepStrictEqual(normalizeMarketplaceOrder(claudeMarketplace), normalizeMarketplaceOrder(expectedClaude))) {
-        throw new Error('Claude marketplace metadata or plugin inventory does not match the snapshot bundles.');
-    }
-    const release = normalizeCatalogRelease(raw.release, base.catalogVersion);
-    const manifest = {
-        schemaVersion: 4,
-        catalogVersion: base.catalogVersion,
-        channel: base.channel,
-        compatibility: base.compatibility,
-        marketplace: marketplaceIdentity,
-        release,
-        entries: normalizedEntries,
-    };
-    if (release.state === 'published') {
-        const contentDigest = publishedContentDigest(manifest);
-        if (release.contentDigest !== contentDigest) {
-            throw new Error('Published catalog release contentDigest does not match the snapshot.');
-        }
-    }
-    const hasLedger = entries.includes(PLUGIN_RELEASE_LEDGER_FILENAME);
-    if (release.state === 'published' && !hasLedger) {
-        throw new Error('Published Catalog snapshot must include plugin-release-ledger.json.');
-    }
-    if (release.state === 'development' && hasLedger) {
-        throw new Error('Development Catalog snapshot must not include plugin-release-ledger.json.');
-    }
-    const ledger = hasLedger
-        ? validatePluginReleaseLedgerAgainstManifest(await readRegularJson(path.join(rootDir, PLUGIN_RELEASE_LEDGER_FILENAME), 'Plugin release ledger'), manifest)
-        : undefined;
-    return { rootDir, manifest, ...(ledger ? { ledger } : {}), snapshotDigest };
+}
+export async function validateCatalogSnapshotPluginEntriesComplete(snapshotDirectory, pluginNames) {
+    const validation = await validateCatalogSnapshotTransport(snapshotDirectory);
+    await validateCatalogPluginEntriesComplete(validation, pluginNames);
+    return validation;
+}
+export async function validateCatalogSnapshotComplete(snapshotDirectory) {
+    const validation = await validateCatalogSnapshotTransport(snapshotDirectory);
+    await validateCatalogPluginEntriesComplete(validation, validation.manifest.entries.map((entry) => entry.name));
+    return validation;
 }
 //# sourceMappingURL=workspace.js.map