@lesliechan721/aw-plugin-core 0.1.0-beta.7 → 0.1.0-beta.9

package/dist/workspace.js

@@ -2,9 +2,9 @@ import crypto from 'node:crypto';
 import path from 'node:path';
 import { isDeepStrictEqual } from 'node:util';
 import fs from 'fs-extra';
-import { assertCatalogVersion, assertStrictSemVer, compareStrictSemVer, MARKETPLACE_SOURCE_PATH, SOURCE_MANIFEST_PATH, createMarketplaceManifest, createMarketplaceManifestEntry, normalizeCatalogManifestBase, normalizeCatalogMarketplaceIdentity, normalizeCatalogManifestEntries, normalizeManifestDigestInput, readMarketplaceSourceMeta, readPluginManifest, validatePlatformManifestProjection, } from './manifest-contract.js';
+import { assertCatalogVersion, assertStrictSemVer, compareStrictSemVer, parseStrictSemVer, MARKETPLACE_SOURCE_PATH, SOURCE_MANIFEST_PATH, createMarketplaceManifest, createMarketplaceManifestEntry, normalizeCatalogManifestBase, normalizeCatalogMarketplaceIdentity, normalizeCatalogManifestEntries, normalizeManifestDigestInput, readMarketplaceSourceMeta, readPluginManifest, validatePlatformManifestProjection, } from './manifest-contract.js';
 import { resolveSupportedPlatforms } from './platform-support.js';
-import { appendCatalogToPluginReleaseLedger, assertStablePluginVersion, PLUGIN_RELEASE_LEDGER_FILENAME, PLUGIN_RELEASE_LEDGER_SCHEMA_VERSION, resolveBetaPluginVersionOverrides, validatePluginReleaseLedgerAgainstManifest, } from './plugin-release.js';
+import { createAwPluginRequirementsReceipt, normalizeAwCapabilities, parseAwPluginRequirementsReceipt, } from './aw-capabilities.js';
 export const DEFAULT_CATALOG_WORKSPACE_VERSION = '0.1.0';
 export const DEFAULT_CATALOG_OUTPUT_PATH = path.join('.aw', 'catalog');
 export const DEFAULT_PUBLISHED_CATALOG_OUTPUT_PATH = path.join('.aw', 'publish', 'catalog');
@@ -12,6 +12,7 @@ export const DEFAULT_PLUGIN_OUTPUT_PATH = path.join('.aw', 'plugins');
 export const CATALOG_MANIFEST_FILENAME = 'catalog-manifest.json';
 export const GENERATED_OUTPUT_MARKER_FILENAME = '.aw-generated.json';
 export const CATALOG_WORKSPACE_MARKER_FILENAME = '.aw-workspace.json';
+const AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME = 'aw-plugin-requirements.json';
 function isInside(root, candidate) {
     const relative = path.relative(root, candidate);
     return relative === '' || (relative !== '..'
@@ -138,9 +139,18 @@ function validateCatalogWorkspaceMarker(value) {
     }
     return { workspaceIdentity: marker.workspaceIdentity };
 }
-async function readCatalogWorkspaceMarker(workspaceRoot) {
+export async function readCatalogWorkspaceMarker(workspaceRoot) {
     const markerPath = path.join(workspaceRoot, CATALOG_WORKSPACE_MARKER_FILENAME);
-    const marker = validateCatalogWorkspaceMarker(await readRegularJson(markerPath, 'Catalog Workspace marker'));
+    let value;
+    try {
+        value = await readRegularJson(markerPath, 'Catalog Workspace marker');
+    }
+    catch (error) {
+        if (error instanceof SyntaxError)
+            throw new Error('Invalid Catalog Workspace marker.');
+        throw error;
+    }
+    const marker = validateCatalogWorkspaceMarker(value);
     return { markerPath, workspaceIdentity: marker.workspaceIdentity };
 }
 async function readRegularJson(filePath, label) {
@@ -398,29 +408,54 @@ function stableStringify(value) {
 function sha256(value) {
     return `sha256:${crypto.createHash('sha256').update(value).digest('hex')}`;
 }
-function publishedContentDigest(manifest) {
-    return sha256(stableStringify({
-        schemaIdentity: { schemaVersion: manifest.schemaVersion },
-        marketplaceMetadata: {
-            name: 'aw',
-            owner: manifest.marketplace.owner,
-            interface: manifest.marketplace.interface,
-        },
-        compatibility: manifest.compatibility,
-        plugins: manifest.entries.map((entry) => ({
-            name: entry.name,
-            targetVersion: entry.version.replace(/-beta\.[1-9]\d*$/u, ''),
-            contentDigest: entry.contentDigest,
-        })).sort((left, right) => left.name.localeCompare(right.name)),
-    }));
-}
-function sourceIdentity(metadata, plugins) {
-    return sha256(stableStringify({
-        metadata,
-        plugins: [...plugins]
-            .sort((left, right) => left.manifest.name.localeCompare(right.manifest.name))
-            .map((plugin) => plugin.manifest),
-    }));
+const SOURCE_IDENTITY_EXCLUDED_DIRECTORIES = new Set([
+    '.git', '.aw', 'node_modules', 'evals', 'reports',
+]);
+const SOURCE_IDENTITY_EXCLUDED_FILES = new Set([
+    '.DS_Store', 'AGENTS.md', 'CLAUDE.md',
+]);
+async function sourceIdentityRecords(root, relative = '') {
+    const records = [];
+    for (const entry of (await fs.readdir(path.join(root, relative), { withFileTypes: true }))
+        .sort((left, right) => left.name.localeCompare(right.name))) {
+        if (SOURCE_IDENTITY_EXCLUDED_DIRECTORIES.has(entry.name) || SOURCE_IDENTITY_EXCLUDED_FILES.has(entry.name)) {
+            continue;
+        }
+        const child = relative ? path.posix.join(relative, entry.name) : entry.name;
+        const filePath = path.join(root, child);
+        const stat = await fs.lstat(filePath);
+        if (stat.isSymbolicLink())
+            throw new Error(`Catalog source identity does not accept symbolic links: ${filePath}`);
+        if (stat.isDirectory())
+            records.push(...await sourceIdentityRecords(root, child));
+        else if (stat.isFile()) {
+            const mode = (stat.mode & 0o111) === 0 ? '100644' : '100755';
+            records.push(`${child}\0${mode}\0${sha256(await fs.readFile(filePath))}`);
+        }
+        else {
+            throw new Error(`Catalog source identity only accepts regular files and directories: ${filePath}`);
+        }
+    }
+    return records;
+}
+export async function calculateCatalogWorkspaceSourceIdentity(workspace) {
+    const roots = [workspace.metadataPath, ...workspace.plugins.map((plugin) => plugin.rootDir)];
+    const records = [];
+    for (const sourceRoot of roots.sort((left, right) => left.localeCompare(right))) {
+        const relativeRoot = path.relative(workspace.workspaceRoot, sourceRoot).split(path.sep).join('/');
+        const stat = await fs.lstat(sourceRoot);
+        if (stat.isSymbolicLink())
+            throw new Error(`Catalog source identity does not accept symbolic links: ${sourceRoot}`);
+        if (stat.isFile()) {
+            const mode = (stat.mode & 0o111) === 0 ? '100644' : '100755';
+            records.push(`${relativeRoot}\0${mode}\0${sha256(await fs.readFile(sourceRoot))}`);
+        }
+        else if (stat.isDirectory()) {
+            for (const record of await sourceIdentityRecords(sourceRoot))
+                records.push(`${relativeRoot}/${record}`);
+        }
+    }
+    return sha256(records.sort().join('\n'));
 }
 function generatedOutputMarker(options) {
     return {
@@ -451,9 +486,26 @@ async function catalogPathRecord(root, relative, versionNeutral) {
     if (!stat.isFile())
         throw new Error(`Catalog digest path must be a regular file or symlink: ${filePath}.`);
     const manifests = new Set(['.agents-plugin/plugin.json', '.claude-plugin/plugin.json', '.codex-plugin/plugin.json']);
-    const digest = versionNeutral && manifests.has(relative)
-        ? sha256(stableStringify({ ...await fs.readJson(filePath), version: '<plugin-version>' }))
-        : sha256(await fs.readFile(filePath));
+    let digest;
+    if (versionNeutral && manifests.has(relative)) {
+        digest = sha256(stableStringify({
+            ...await fs.readJson(filePath),
+            version: '<plugin-version>',
+        }));
+    }
+    else if (versionNeutral && path.posix.basename(relative) === AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME) {
+        const receipt = await fs.readJson(filePath);
+        const plugin = receipt.plugin && typeof receipt.plugin === 'object' && !Array.isArray(receipt.plugin)
+            ? receipt.plugin
+            : {};
+        digest = sha256(stableStringify({
+            ...receipt,
+            plugin: { ...plugin, version: '<plugin-version>' },
+        }));
+    }
+    else {
+        digest = sha256(await fs.readFile(filePath));
+    }
     return { path: relative, kind: 'file', mode: (stat.mode & 0o100) === 0 ? '100644' : '100755', digest };
 }
 async function calculateEntryDigest(root, versionNeutral) {
@@ -461,16 +513,44 @@ async function calculateEntryDigest(root, versionNeutral) {
     return sha256(stableStringify(await Promise.all(files.map((file) => catalogPathRecord(root, file, versionNeutral)))));
 }
 async function expectedCatalogEntry(plugin, pluginRoot) {
+    const bundleManifest = await readRegularJson(path.join(pluginRoot, SOURCE_MANIFEST_PATH), `Catalog plugin ${JSON.stringify(plugin.manifest.name)} bundle manifest`);
     return {
         ...createMarketplaceManifestEntry(plugin),
         version: plugin.manifest.version,
-        compatibility: plugin.manifest.compatibility,
+        dependencies: [...(plugin.manifest.dependencies ?? [])].sort(),
+        requires: {
+            aw: {
+                capabilities: normalizeAwCapabilities(plugin.manifest.requires?.aw.capabilities ?? []),
+            },
+        },
         artifactDigest: await calculateEntryDigest(pluginRoot, false),
-        manifestDigest: sha256(normalizeManifestDigestInput(plugin.manifest)),
+        manifestDigest: sha256(normalizeManifestDigestInput(bundleManifest)),
         contentDigest: await calculateEntryDigest(pluginRoot, true),
     };
 }
-function normalizeCatalogRelease(raw, catalogVersion) {
+async function validateBundleRuntimeRequirementsReceipts(plugin, pluginRoot) {
+    const files = await listBundleFiles(pluginRoot);
+    const expectedReceiptPaths = new Set(files.flatMap((relative) => /^(?:claude|codex|agent-skills)\/skills\/[^/]+\/SKILL\.md$/u.test(relative)
+        ? [path.posix.join(path.posix.dirname(relative), AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME)]
+        : []));
+    const actualReceiptPaths = files.filter((relative) => path.posix.basename(relative) === AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME);
+    for (const relative of expectedReceiptPaths) {
+        if (!actualReceiptPaths.includes(relative)) {
+            throw new Error(`Catalog plugin ${JSON.stringify(plugin.manifest.name)} Skill root is missing ${AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME}: ${relative}.`);
+        }
+    }
+    const expected = createAwPluginRequirementsReceipt({ name: plugin.manifest.name, version: plugin.manifest.version }, plugin.manifest.requires?.aw.capabilities ?? []);
+    for (const relative of actualReceiptPaths) {
+        if (!expectedReceiptPaths.has(relative)) {
+            throw new Error(`Catalog plugin ${JSON.stringify(plugin.manifest.name)} has a reserved runtime requirements receipt outside a Skill root: ${relative}.`);
+        }
+        const receipt = parseAwPluginRequirementsReceipt(await readRegularJson(path.join(pluginRoot, ...relative.split('/')), `Catalog plugin ${JSON.stringify(plugin.manifest.name)} runtime requirements receipt`));
+        if (!isDeepStrictEqual(receipt, expected)) {
+            throw new Error(`Catalog plugin ${JSON.stringify(plugin.manifest.name)} has a mismatched runtime requirements receipt: ${relative}.`);
+        }
+    }
+}
+function normalizeCatalogRelease(raw) {
     if (!raw || typeof raw !== 'object' || Array.isArray(raw)) {
         throw new Error('Invalid catalog manifest release: expected an object.');
     }
@@ -481,33 +561,16 @@ function normalizeCatalogRelease(raw, catalogVersion) {
         }
         return { state: 'development' };
     }
-    const allowed = new Set(['state', 'targetVersion', 'planId', 'sourceHead', 'contentDigest']);
+    const allowed = new Set(['state', 'sourceHead']);
     if (release.state !== 'published' || Object.keys(release).some((key) => !allowed.has(key))) {
         throw new Error('Invalid published catalog release.');
     }
-    const targetVersion = assertStrictSemVer(release.targetVersion, 'catalog release targetVersion');
-    if (targetVersion.includes('-') || targetVersion.includes('+')) {
-        throw new Error('Invalid catalog release targetVersion: expected a stable version.');
-    }
-    if (targetVersion !== catalogVersion.replace(/-beta\.[1-9]\d*$/u, '')) {
-        throw new Error('Invalid catalog release targetVersion: must match catalogVersion.');
-    }
-    const digestPattern = /^sha256:[0-9a-f]{64}$/u;
-    if (typeof release.planId !== 'string' || !digestPattern.test(release.planId)) {
-        throw new Error('Invalid catalog release planId.');
-    }
-    if (typeof release.contentDigest !== 'string' || !digestPattern.test(release.contentDigest)) {
-        throw new Error('Invalid catalog release contentDigest.');
-    }
     if (typeof release.sourceHead !== 'string' || !/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(release.sourceHead)) {
         throw new Error('Invalid catalog release sourceHead.');
     }
     return {
         state: 'published',
-        targetVersion,
-        planId: release.planId,
         sourceHead: release.sourceHead,
-        contentDigest: release.contentDigest,
     };
 }
 export async function buildCatalogWorkspace(options) {
@@ -521,7 +584,7 @@ export async function buildCatalogWorkspace(options) {
     const catalogVersion = catalogWorkspace.metadata.catalog.version;
     const channel = deriveCatalogChannel(catalogVersion);
     const pluginNames = plugins.map((plugin) => plugin.manifest.name).sort();
-    const identity = sourceIdentity(catalogWorkspace.metadata, plugins);
+    const identity = await calculateCatalogWorkspaceSourceIdentity(catalogWorkspace);
     const marker = generatedOutputMarker({
         kind: 'catalog',
         workspaceIdentity: catalogWorkspace.workspaceIdentity,
@@ -532,6 +595,7 @@ export async function buildCatalogWorkspace(options) {
         force: options.force === true,
         build: async (stagingRoot) => {
             const bundledPlugins = [];
+            await fs.ensureDir(path.join(stagingRoot, 'plugins'));
             for (const plugin of plugins) {
                 const closure = dependencyClosure(plugin, plugins);
                 const outputRoot = path.join(stagingRoot, 'plugins', plugin.manifest.name);
@@ -550,20 +614,14 @@ export async function buildCatalogWorkspace(options) {
                 .sort((left, right) => left.manifest.name.localeCompare(right.manifest.name));
             await fs.outputJson(path.join(stagingRoot, '.agents', 'plugins', 'marketplace.json'), createMarketplaceManifest(catalogWorkspace.metadata, byPlatform('codex')), { spaces: 2 });
             await fs.outputJson(path.join(stagingRoot, '.claude-plugin', 'marketplace.json'), createMarketplaceManifest(catalogWorkspace.metadata, byPlatform('claude')), { spaces: 2 });
-            let minVersion = '0.0.0';
-            for (const plugin of bundledPlugins) {
-                const candidate = plugin.manifest.compatibility.aw.minVersion;
-                if (compareStrictSemVer(candidate, minVersion) > 0)
-                    minVersion = candidate;
-            }
             const entries = await Promise.all([...bundledPlugins]
                 .sort((left, right) => left.manifest.name.localeCompare(right.manifest.name))
                 .map((plugin) => expectedCatalogEntry(plugin, plugin.rootDir)));
             const manifest = {
-                schemaVersion: 4,
+                schemaVersion: 6,
                 catalogVersion,
                 channel,
-                compatibility: { aw: { minVersion } },
+                requires: { aw: { capabilities: ['aw.catalog-snapshot.v6'] } },
                 marketplace: {
                     owner: catalogWorkspace.metadata.owner,
                     interface: catalogWorkspace.metadata.interface,
@@ -574,9 +632,9 @@ export async function buildCatalogWorkspace(options) {
             await fs.writeJson(path.join(stagingRoot, CATALOG_MANIFEST_FILENAME), manifest, { spaces: 2 });
             await fs.writeJson(path.join(stagingRoot, GENERATED_OUTPUT_MARKER_FILENAME), marker, { spaces: 2 });
         },
-        validate: async (stagingRoot) => { await validateCatalogSnapshot(stagingRoot); },
+        validate: async (stagingRoot) => { await validateCatalogSnapshotComplete(stagingRoot); },
         assertReplaceable: async (existingRoot) => {
-            await validateCatalogSnapshot(existingRoot);
+            await validateCatalogSnapshotComplete(existingRoot);
             await assertGeneratedOutput(existingRoot, marker);
         },
     });
@@ -596,16 +654,90 @@ async function rewritePublishedPluginVersions(snapshotRoot, overrides) {
             const manifest = await fs.readJson(manifestPath);
             await fs.writeFile(manifestPath, `${JSON.stringify({ ...manifest, version }, null, 2)}\n`);
         }
+        const pluginRoot = path.join(snapshotRoot, 'plugins', pluginName);
+        for (const relative of await listBundleFiles(pluginRoot)) {
+            if (path.posix.basename(relative) !== AW_PLUGIN_REQUIREMENTS_RECEIPT_FILENAME)
+                continue;
+            const receiptPath = path.join(pluginRoot, ...relative.split('/'));
+            const receipt = parseAwPluginRequirementsReceipt(await fs.readJson(receiptPath));
+            if (receipt.plugin.name !== pluginName) {
+                throw new Error(`Catalog plugin ${JSON.stringify(pluginName)} has a mismatched runtime requirements receipt.`);
+            }
+            await fs.writeFile(receiptPath, `${JSON.stringify(createAwPluginRequirementsReceipt({ name: pluginName, version }, receipt.requiredCapabilities), null, 2)}\n`);
+        }
+    }
+}
+function assertStablePluginVersion(version, fieldName) {
+    const parsed = parseStrictSemVer(version, fieldName);
+    if (parsed.prerelease.length > 0 || parsed.build.length > 0) {
+        throw new Error(`Invalid ${fieldName}: expected a stable SemVer without prerelease or build metadata.`);
+    }
+    return version;
+}
+function stableVersionBase(version, fieldName) {
+    const parsed = parseStrictSemVer(version, fieldName);
+    return `${parsed.major}.${parsed.minor}.${parsed.patch}`;
+}
+function resolvePublishedPluginVersions(options) {
+    const previousEntries = new Map(options.previous?.entries.map((entry) => [entry.name, entry]) ?? []);
+    const versions = {};
+    for (const plugin of options.plugins) {
+        const name = plugin.manifest.name;
+        const sourceVersion = assertStablePluginVersion(plugin.manifest.version, `${name} source version`);
+        const contentDigest = options.contentDigests.get(name);
+        if (!contentDigest)
+            throw new Error(`Missing release content digest for plugin ${JSON.stringify(name)}.`);
+        const previous = previousEntries.get(name);
+        if (!previous) {
+            versions[name] = options.channel === 'beta' ? `${sourceVersion}-beta.1` : sourceVersion;
+            continue;
+        }
+        const previousVersion = assertStrictSemVer(previous.version, `${name} previous published version`);
+        if (options.channel === 'latest') {
+            const comparison = compareStrictSemVer(sourceVersion, previousVersion);
+            if (comparison < 0) {
+                throw new Error(`Plugin ${name} source version ${sourceVersion} must not be lower than previous ${previousVersion}.`);
+            }
+            if (comparison === 0 && previous.contentDigest !== contentDigest) {
+                throw new Error(`Plugin ${name} version ${sourceVersion} maps to different content. Increase the source plugin version.`);
+            }
+            versions[name] = sourceVersion;
+            continue;
+        }
+        const previousBase = stableVersionBase(previousVersion, `${name} previous published version`);
+        const baseComparison = compareStrictSemVer(sourceVersion, previousBase);
+        if (baseComparison < 0) {
+            throw new Error(`Plugin ${name} source version ${sourceVersion} must not be lower than previous base ${previousBase}.`);
+        }
+        if (baseComparison > 0) {
+            versions[name] = `${sourceVersion}-beta.1`;
+            continue;
+        }
+        const parsedPrevious = parseStrictSemVer(previousVersion, `${name} previous published version`);
+        if (parsedPrevious.prerelease.length === 0) {
+            if (previous.contentDigest !== contentDigest) {
+                throw new Error(`Plugin ${name} stable version ${sourceVersion} maps to different content. Increase the source plugin version.`);
+            }
+            versions[name] = previousVersion;
+            continue;
+        }
+        if (parsedPrevious.prerelease.length !== 2
+            || parsedPrevious.prerelease[0] !== 'beta'
+            || !/^[1-9]\d*$/u.test(parsedPrevious.prerelease[1])) {
+            throw new Error(`Plugin ${name} previous version ${previousVersion} is not a stable or beta publication version.`);
+        }
+        versions[name] = previous.contentDigest === contentDigest
+            ? previousVersion
+            : `${sourceVersion}-beta.${Number(parsedPrevious.prerelease[1]) + 1}`;
     }
+    return versions;
 }
 export async function validatePublishedCatalogSnapshot(snapshotDirectory) {
-    const validation = await validateCatalogSnapshot(snapshotDirectory);
+    const validation = await validateCatalogSnapshotComplete(snapshotDirectory);
     if (validation.manifest.release.state !== 'published') {
         throw new Error('Published Catalog snapshot must have release.state published.');
     }
-    if (!validation.ledger)
-        throw new Error('Published Catalog snapshot must include a plugin release ledger.');
-    return { ...validation, ledger: validation.ledger };
+    return validation;
 }
 export async function preparePublishedCatalogWorkspace(options) {
     if (!/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/u.test(options.sourceHead)) {
@@ -623,10 +755,6 @@ export async function preparePublishedCatalogWorkspace(options) {
     if (previous && compareStrictSemVer(catalogVersion, previous.manifest.catalogVersion) <= 0) {
         throw new Error(`Catalog version ${catalogVersion} must be higher than published ${previous.manifest.catalogVersion}.`);
     }
-    const previousLedger = previous?.ledger ?? {
-        schemaVersion: PLUGIN_RELEASE_LEDGER_SCHEMA_VERSION,
-        records: [],
-    };
     const temporaryRelative = path.join('.aw', 'publish', `.catalog-preparation-${crypto.randomUUID()}`);
     const finalRelative = options.outputPath
         ?? `${DEFAULT_PUBLISHED_CATALOG_OUTPUT_PATH}-v${catalogVersion}`;
@@ -639,15 +767,14 @@ export async function preparePublishedCatalogWorkspace(options) {
             reservedImports: options.reservedImports,
         });
         temporaryRoot = built.outputRoot;
-        const development = await validateCatalogSnapshot(temporaryRoot);
+        const development = await validateCatalogSnapshotComplete(temporaryRoot);
         const contentDigests = new Map(development.manifest.entries.map((entry) => [entry.name, entry.contentDigest]));
-        const overrides = channel === 'beta'
-            ? resolveBetaPluginVersionOverrides({
-                plugins: catalogWorkspace.plugins,
-                contentDigests,
-                ledger: previousLedger,
-            })
-            : Object.fromEntries(catalogWorkspace.plugins.map((plugin) => [plugin.manifest.name, plugin.manifest.version]));
+        const overrides = resolvePublishedPluginVersions({
+            channel,
+            plugins: catalogWorkspace.plugins,
+            contentDigests,
+            previous: previous?.manifest ?? null,
+        });
         await rewritePublishedPluginVersions(temporaryRoot, overrides);
         const bundledPlugins = await Promise.all(catalogWorkspace.plugins.map((plugin) => readPluginManifest(path.join(temporaryRoot, 'plugins', plugin.manifest.name), { mode: 'bundle' })));
         const entries = await Promise.all(bundledPlugins.sort((left, right) => left.manifest.name.localeCompare(right.manifest.name))
@@ -658,26 +785,14 @@ export async function preparePublishedCatalogWorkspace(options) {
             channel,
             entries,
         };
-        const contentDigest = publishedContentDigest(manifestWithoutRelease);
         const manifest = {
             ...manifestWithoutRelease,
             release: {
                 state: 'published',
-                targetVersion: catalogVersion.replace(/-beta\.[1-9]\d*$/u, ''),
-                planId: contentDigest,
                 sourceHead: options.sourceHead,
-                contentDigest,
             },
         };
-        const ledger = appendCatalogToPluginReleaseLedger({
-            previous: previousLedger,
-            manifest,
-            contentDigests,
-        });
-        await Promise.all([
-            fs.writeFile(path.join(temporaryRoot, CATALOG_MANIFEST_FILENAME), `${JSON.stringify(manifest, null, 2)}\n`),
-            fs.writeFile(path.join(temporaryRoot, PLUGIN_RELEASE_LEDGER_FILENAME), `${JSON.stringify(ledger, null, 2)}\n`),
-        ]);
+        await fs.writeFile(path.join(temporaryRoot, CATALOG_MANIFEST_FILENAME), `${JSON.stringify(manifest, null, 2)}\n`);
         const prepared = await validatePublishedCatalogSnapshot(temporaryRoot);
         const resolved = await resolveCatalogWorkspaceOutputPath({
             workspaceRoot: catalogWorkspace.workspaceRoot,
@@ -701,8 +816,6 @@ export async function preparePublishedCatalogWorkspace(options) {
             channel,
             pluginNames: built.pluginNames,
             snapshotDigest: prepared.snapshotDigest,
-            contentDigest,
-            planId: contentDigest,
         };
     }
     finally {
@@ -828,7 +941,7 @@ async function digestDirectory(root) {
     await walk(root);
     return `sha256:${crypto.createHash('sha256').update(entries.join('\n')).digest('hex')}`;
 }
-export async function validateCatalogSnapshot(snapshotDirectory) {
+async function validateCatalogSnapshotTransportInternal(snapshotDirectory) {
     const rootDir = await assertDirectoryWithoutSymlinks(snapshotDirectory, 'Catalog snapshot');
     const allowed = new Set([
         CATALOG_MANIFEST_FILENAME,
@@ -836,7 +949,6 @@ export async function validateCatalogSnapshot(snapshotDirectory) {
         '.agents',
         '.claude-plugin',
         'plugins',
-        'plugin-release-ledger.json',
     ]);
     const entries = await fs.readdir(rootDir);
     const unexpected = entries.filter((entry) => !allowed.has(entry));
@@ -878,14 +990,17 @@ export async function validateCatalogSnapshot(snapshotDirectory) {
     const snapshotDigest = await digestDirectory(rootDir);
     const raw = await fs.readJson(path.join(rootDir, CATALOG_MANIFEST_FILENAME));
     const allowedManifestKeys = new Set([
-        'schemaVersion', 'catalogVersion', 'channel', 'compatibility', 'marketplace', 'release', 'entries',
+        'schemaVersion', 'catalogVersion', 'channel', 'requires', 'marketplace', 'release', 'entries',
     ]);
     for (const key of Object.keys(raw))
         if (!allowedManifestKeys.has(key))
             throw new Error(`Invalid catalog manifest: unknown field ${JSON.stringify(key)}.`);
-    if (raw.schemaVersion !== 4)
-        throw new Error('Invalid catalog manifest schemaVersion: expected 4.');
-    const base = normalizeCatalogManifestBase(raw, 'catalog manifest v4');
+    if (raw.schemaVersion !== 6)
+        throw new Error('Invalid catalog manifest schemaVersion: expected 6.');
+    const base = normalizeCatalogManifestBase(raw, 'catalog manifest v6');
+    if (!(base.requires.aw.capabilities ?? []).includes('aw.catalog-snapshot.v6')) {
+        throw new Error('Invalid catalog manifest requires.aw.capabilities: expected aw.catalog-snapshot.v6.');
+    }
     const marketplaceIdentity = normalizeCatalogMarketplaceIdentity(raw.marketplace);
     if (!Array.isArray(raw.entries))
         throw new Error('Invalid catalog manifest entries: expected an array.');
@@ -901,7 +1016,7 @@ export async function validateCatalogSnapshot(snapshotDirectory) {
         delete copy.contentDigest;
         return copy;
     });
-    const normalizedEntries = normalizeCatalogManifestEntries(entriesWithoutContentDigest, base, 'catalog manifest v4')
+    const normalizedEntries = normalizeCatalogManifestEntries(entriesWithoutContentDigest, base, 'catalog manifest v6')
         .map((entry, index) => ({ ...entry, contentDigest: contentDigests[index] }));
     const pluginNames = normalizedEntries.map((entry, index) => {
         if (typeof entry.name !== 'string')
@@ -915,39 +1030,57 @@ export async function validateCatalogSnapshot(snapshotDirectory) {
     const diskNames = (await fs.readdir(path.join(rootDir, 'plugins'))).sort();
     if (diskNames.join('\0') !== [...pluginNames].sort().join('\0'))
         throw new Error('Invalid catalog snapshot plugin inventory.');
-    const plugins = [];
+    const platformEntries = {
+        claude: [],
+        codex: [],
+    };
     for (const [index, name] of pluginNames.entries()) {
         const pluginRoot = path.join(rootDir, 'plugins', name);
-        const plugin = await readPluginManifest(pluginRoot, { mode: 'bundle' });
+        await assertDirectoryWithoutSymlinks(pluginRoot, `Catalog plugin ${JSON.stringify(name)}`);
+        const entry = normalizedEntries[index];
+        if (entry.source !== `./plugins/${name}`) {
+            throw new Error(`Catalog entry source for ${JSON.stringify(name)} does not match its plugin bundle.`);
+        }
+        const rawBundleManifest = await readRegularJson(path.join(pluginRoot, SOURCE_MANIFEST_PATH), `Catalog plugin ${JSON.stringify(name)} bundle manifest`);
+        const expectedDigests = {
+            artifactDigest: await calculateEntryDigest(pluginRoot, false),
+            manifestDigest: sha256(normalizeManifestDigestInput(rawBundleManifest)),
+            contentDigest: await calculateEntryDigest(pluginRoot, true),
+        };
+        for (const field of Object.keys(expectedDigests)) {
+            if (entry[field] !== expectedDigests[field]) {
+                throw new Error(`Catalog entry ${field} for ${JSON.stringify(name)} does not match its plugin bundle.`);
+            }
+        }
         for (const platform of ['claude', 'codex']) {
             const platformManifest = path.join(pluginRoot, `.${platform}-plugin`, 'plugin.json');
             const exists = await fs.pathExists(platformManifest);
-            if (exists !== resolveSupportedPlatforms(plugin.manifest).has(platform)) {
-                throw new Error(`Catalog plugin ${JSON.stringify(name)} has an inconsistent ${platform} bundle projection.`);
-            }
             if (exists) {
-                const rawPlatformManifest = await readRegularJson(platformManifest, `${platform} plugin manifest`);
-                await validatePlatformManifestProjection(plugin, platform, rawPlatformManifest);
-            }
-        }
-        const expected = await expectedCatalogEntry(plugin, pluginRoot);
-        for (const field of Object.keys(expected)) {
-            if (!isDeepStrictEqual(normalizedEntries[index][field], expected[field])) {
-                throw new Error(`Catalog entry ${field} for ${JSON.stringify(name)} does not match its plugin bundle.`);
+                await readRegularJson(platformManifest, `${platform} plugin manifest`);
+                platformEntries[platform].push(entry);
             }
         }
-        plugins.push(plugin);
     }
-    assertDependencyGraph(plugins);
     const agentsMarketplace = await fs.readJson(path.join(rootDir, '.agents', 'plugins', 'marketplace.json'));
     const claudeMarketplace = await fs.readJson(path.join(rootDir, '.claude-plugin', 'marketplace.json'));
-    const marketplaceMetadata = {
+    const marketplaceEntry = (entry) => ({
+        name: entry.name,
+        source: entry.source,
+        description: entry.description,
+        interface: entry.interface,
+        category: entry.category,
+        tags: entry.tags,
+        strict: entry.strict,
+        policy: entry.policy,
+    });
+    const expectedMarketplace = (platform) => ({
+        name: 'aw',
         owner: marketplaceIdentity.owner,
         interface: marketplaceIdentity.interface,
-        catalog: { version: base.catalogVersion },
-    };
-    const expectedAgents = createMarketplaceManifest(marketplaceMetadata, plugins.filter((plugin) => resolveSupportedPlatforms(plugin.manifest).has('codex')));
-    const expectedClaude = createMarketplaceManifest(marketplaceMetadata, plugins.filter((plugin) => resolveSupportedPlatforms(plugin.manifest).has('claude')));
+        plugins: platformEntries[platform].map(marketplaceEntry),
+    });
+    const expectedAgents = expectedMarketplace('codex');
+    const expectedClaude = expectedMarketplace('claude');
     const normalizeMarketplaceOrder = (marketplace) => {
         const canonical = JSON.parse(JSON.stringify(marketplace));
         return {
@@ -963,32 +1096,60 @@ export async function validateCatalogSnapshot(snapshotDirectory) {
     if (!isDeepStrictEqual(normalizeMarketplaceOrder(claudeMarketplace), normalizeMarketplaceOrder(expectedClaude))) {
         throw new Error('Claude marketplace metadata or plugin inventory does not match the snapshot bundles.');
     }
-    const release = normalizeCatalogRelease(raw.release, base.catalogVersion);
+    const release = normalizeCatalogRelease(raw.release);
     const manifest = {
-        schemaVersion: 4,
+        schemaVersion: 6,
         catalogVersion: base.catalogVersion,
         channel: base.channel,
-        compatibility: base.compatibility,
+        requires: base.requires,
         marketplace: marketplaceIdentity,
         release,
         entries: normalizedEntries,
     };
-    if (release.state === 'published') {
-        const contentDigest = publishedContentDigest(manifest);
-        if (release.contentDigest !== contentDigest) {
-            throw new Error('Published catalog release contentDigest does not match the snapshot.');
+    return { rootDir, manifest, snapshotDigest };
+}
+export async function validateCatalogSnapshotTransport(snapshotDirectory) {
+    return validateCatalogSnapshotTransportInternal(snapshotDirectory);
+}
+async function validateCatalogPluginEntriesComplete(validation, pluginNames) {
+    const entriesByName = new Map(validation.manifest.entries.map((entry) => [entry.name, entry]));
+    const plugins = [];
+    for (const name of pluginNames) {
+        const entry = entriesByName.get(name);
+        if (!entry)
+            throw new Error(`Catalog plugin ${JSON.stringify(name)} does not exist.`);
+        const pluginRoot = path.join(validation.rootDir, 'plugins', entry.name);
+        const plugin = await readPluginManifest(pluginRoot, { mode: 'bundle' });
+        await validateBundleRuntimeRequirementsReceipts(plugin, pluginRoot);
+        for (const platform of ['claude', 'codex']) {
+            const platformManifestPath = path.join(pluginRoot, `.${platform}-plugin`, 'plugin.json');
+            const exists = await fs.pathExists(platformManifestPath);
+            if (exists !== resolveSupportedPlatforms(plugin.manifest).has(platform)) {
+                throw new Error(`Catalog plugin ${JSON.stringify(entry.name)} has an inconsistent ${platform} bundle projection.`);
+            }
+            if (exists) {
+                const rawPlatformManifest = await readRegularJson(platformManifestPath, `${platform} plugin manifest`);
+                await validatePlatformManifestProjection(plugin, platform, rawPlatformManifest);
+            }
         }
+        const expected = await expectedCatalogEntry(plugin, pluginRoot);
+        for (const field of Object.keys(expected)) {
+            if (!isDeepStrictEqual(entry[field], expected[field])) {
+                throw new Error(`Catalog entry ${field} for ${JSON.stringify(entry.name)} does not match its plugin bundle.`);
+            }
+        }
+        plugins.push(plugin);
     }
-    const hasLedger = entries.includes(PLUGIN_RELEASE_LEDGER_FILENAME);
-    if (release.state === 'published' && !hasLedger) {
-        throw new Error('Published Catalog snapshot must include plugin-release-ledger.json.');
-    }
-    if (release.state === 'development' && hasLedger) {
-        throw new Error('Development Catalog snapshot must not include plugin-release-ledger.json.');
-    }
-    const ledger = hasLedger
-        ? validatePluginReleaseLedgerAgainstManifest(await readRegularJson(path.join(rootDir, PLUGIN_RELEASE_LEDGER_FILENAME), 'Plugin release ledger'), manifest)
-        : undefined;
-    return { rootDir, manifest, ...(ledger ? { ledger } : {}), snapshotDigest };
+    assertDependencyGraph(plugins);
+}
+export async function validateCatalogSnapshotPluginEntriesComplete(snapshotDirectory, pluginNames) {
+    const validation = await validateCatalogSnapshotTransport(snapshotDirectory);
+    await validateCatalogPluginEntriesComplete(validation, pluginNames);
+    return validation;
+}
+export async function validateCatalogSnapshotComplete(snapshotDirectory) {
+    const validation = await validateCatalogSnapshotTransport(snapshotDirectory);
+    await validateCatalogPluginEntriesComplete(validation, validation.manifest.entries.map((entry) => entry.name));
+    return validation;
 }
 //# sourceMappingURL=workspace.js.map