@nklisch/pi-enhanced 0.1.0

package/node_modules/@nklisch/pi-plugins/dist/domain/source.js

@@ -0,0 +1,873 @@
+import { z } from "zod";
+import { schemaValues } from "./schema.js";
+function schemasFor(registry) {
+    const schemas = Object.fromEntries(Object.entries(registry).map(([key, entry]) => [key, entry.schema]));
+    return schemaValues(schemas);
+}
+const HexByte = /^[0-9A-Fa-f]{2}$/;
+const CanonicalSourceKinds = new Set([
+    "github",
+    "git",
+    "local-git",
+    "marketplace-path",
+    "git-subdir",
+    "npm",
+]);
+const ScpGitUrl = /^(?:(?<user>[A-Za-z0-9._-]+)@)?(?<host>[A-Za-z0-9.-]+):(?<path>[^/\\\s:][^\s]*)$/;
+const CanonicalScpGitUrl = /^scp:\/\/(?:(?<user>[A-Za-z0-9._-]+)@)?(?<host>[A-Za-z0-9.-]+)\/(?<path>[^/\\\s:][^\s]*)$/;
+const GitHubOwner = /^(?=.{1,39}$)(?!-)(?!.*--)[A-Za-z0-9-]+(?<!-)$/;
+const GitHubRepositoryName = /^(?=.{1,100}$)(?!\.{1,2}$)(?!.*\.$)[A-Za-z0-9._-]+$/;
+function hasLoneSurrogate(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        const codeUnit = value.charCodeAt(index);
+        if (codeUnit >= 0xd800 && codeUnit <= 0xdbff) {
+            const next = value.charCodeAt(index + 1);
+            if (Number.isNaN(next) || next < 0xdc00 || next > 0xdfff) {
+                return true;
+            }
+            index += 1;
+        }
+        else if (codeUnit >= 0xdc00 && codeUnit <= 0xdfff) {
+            return true;
+        }
+    }
+    return false;
+}
+function issue(context, message) {
+    context.addIssue({ code: "custom", message });
+}
+function rejectLoneSurrogates(value, context) {
+    if (hasLoneSurrogate(value)) {
+        issue(context, "source strings cannot contain lone UTF-16 surrogate code units");
+    }
+}
+const SourceStringSchema = z.string().superRefine(rejectLoneSurrogates);
+const NonEmptySourceStringSchema = SourceStringSchema.min(1);
+/**
+ * Validate GitHub's shorthand grammar without turning source validation into a
+ * network lookup. Repository names may begin with a dot (for example,
+ * `.github`), but `.` and `..` are path segments rather than repository names.
+ */
+export function isValidGitHubRepository(value) {
+    const slash = value.indexOf("/");
+    if (slash <= 0 || value.indexOf("/", slash + 1) !== -1) {
+        return false;
+    }
+    const owner = value.slice(0, slash);
+    const repository = value.slice(slash + 1);
+    return GitHubOwner.test(owner) &&
+        GitHubRepositoryName.test(repository) &&
+        !repository.toLowerCase().endsWith(".git");
+}
+const GitHubRepositorySchema = SourceStringSchema.refine(isValidGitHubRepository, "GitHub repository must be exactly owner/repository with valid GitHub names");
+function hasValidPercentEscapes(value) {
+    for (let index = 0; index < value.length; index += 1) {
+        if (value[index] !== "%") {
+            continue;
+        }
+        const escape = value.slice(index + 1, index + 3);
+        if (!HexByte.test(escape)) {
+            return false;
+        }
+        index += 2;
+    }
+    return true;
+}
+function isScpGitUrl(value) {
+    const match = ScpGitUrl.exec(value);
+    if (match === null) {
+        return false;
+    }
+    const host = match.groups?.host ?? "";
+    // Require the conventional user@host form or a host-like name. This keeps
+    // data:text/... and other URI schemes from being mistaken for SCP syntax.
+    return match.groups?.user !== undefined || host.includes(".") || host === "localhost";
+}
+function validateGitUrl(value, context) {
+    // SCP is not a URI: its path is remote-home-relative and `%` is literal
+    // path text, so URL percent-escape validation must not rewrite its meaning.
+    if (isScpGitUrl(value)) {
+        return;
+    }
+    if (!hasValidPercentEscapes(value)) {
+        issue(context, "Git URL contains a malformed percent escape");
+        return;
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        issue(context, "Git URL must be an HTTPS or SSH URL");
+        return;
+    }
+    if (parsed.protocol !== "https:" && parsed.protocol !== "ssh:") {
+        issue(context, "Git URL protocol must be HTTPS or SSH");
+    }
+    if (parsed.hostname.length === 0) {
+        issue(context, "Git URL must contain a host");
+    }
+    if (parsed.protocol === "https:" && (parsed.username !== "" || parsed.password !== "")) {
+        issue(context, "HTTPS Git URLs cannot contain embedded credentials");
+    }
+    if (parsed.protocol === "ssh:" && parsed.password !== "") {
+        issue(context, "SSH Git URLs cannot contain embedded passwords");
+    }
+}
+const GitUrlSchema = NonEmptySourceStringSchema.superRefine(validateGitUrl);
+function validateNpmRegistry(value, context) {
+    if (!hasValidPercentEscapes(value)) {
+        issue(context, "npm registry contains a malformed percent escape");
+        return;
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        issue(context, "npm registry must be an HTTPS URL");
+        return;
+    }
+    if (parsed.protocol !== "https:") {
+        issue(context, "npm registry must use HTTPS");
+    }
+    if (parsed.username !== "" || parsed.password !== "") {
+        issue(context, "npm registry cannot contain embedded credentials");
+    }
+}
+const NpmRegistrySchema = NonEmptySourceStringSchema.url().superRefine(validateNpmRegistry);
+const GitRevisionInputSchema = NonEmptySourceStringSchema
+    .regex(/^[0-9a-f]{40}$/, "Git revision must be a full 40-character lowercase SHA-1")
+    .brand();
+export const MarketplaceSourceVariantRegistry = {
+    github: {
+        label: "GitHub repository",
+        schema: z
+            .object({
+            kind: z.literal("github"),
+            repository: GitHubRepositorySchema,
+            ref: NonEmptySourceStringSchema.optional(),
+        })
+            .strict(),
+    },
+    git: {
+        label: "Git repository",
+        schema: z
+            .object({
+            kind: z.literal("git"),
+            url: GitUrlSchema,
+            ref: NonEmptySourceStringSchema.optional(),
+        })
+            .strict(),
+    },
+    localGit: {
+        label: "Local Git checkout",
+        schema: z
+            .object({
+            kind: z.literal("local-git"),
+            path: NonEmptySourceStringSchema,
+            ref: NonEmptySourceStringSchema.optional(),
+        })
+            .strict(),
+    },
+};
+export const MarketplaceSourceSchema = z.discriminatedUnion("kind", schemasFor(MarketplaceSourceVariantRegistry));
+export const PluginSourceVariantRegistry = {
+    marketplacePath: {
+        label: "Marketplace path",
+        schema: z
+            .object({
+            kind: z.literal("marketplace-path"),
+            path: NonEmptySourceStringSchema,
+        })
+            .strict(),
+    },
+    git: {
+        label: "Git repository",
+        schema: z
+            .object({
+            kind: z.literal("git"),
+            url: GitUrlSchema,
+            ref: NonEmptySourceStringSchema.optional(),
+            sha: GitRevisionInputSchema.optional(),
+        })
+            .strict(),
+    },
+    gitSubdir: {
+        label: "Git repository subdirectory",
+        schema: z
+            .object({
+            kind: z.literal("git-subdir"),
+            url: GitUrlSchema,
+            path: NonEmptySourceStringSchema,
+            ref: NonEmptySourceStringSchema.optional(),
+            sha: GitRevisionInputSchema.optional(),
+        })
+            .strict(),
+    },
+    npm: {
+        label: "npm package",
+        schema: z
+            .object({
+            kind: z.literal("npm"),
+            package: NonEmptySourceStringSchema,
+            selector: NonEmptySourceStringSchema.optional(),
+            registry: NpmRegistrySchema.optional(),
+        })
+            .strict(),
+    },
+};
+export const PluginSourceSchema = z.discriminatedUnion("kind", schemasFor(PluginSourceVariantRegistry));
+export const GitRevisionSchema = GitRevisionInputSchema;
+/**
+ * Git declarations have one selector authority: an explicit SHA, then a
+ * SHA-shaped ref, then the immutable revision resolved from a named ref.
+ * Keeping this predicate in the source domain prevents acquisition and
+ * inspection from developing different handoff rules.
+ */
+export function isFullGitRevision(value) {
+    return GitRevisionSchema.safeParse(value).success;
+}
+export function matchesGitRevisionSelector(declared, revision) {
+    if (declared.sha !== undefined)
+        return revision === declared.sha;
+    if (declared.ref !== undefined && isFullGitRevision(declared.ref))
+        return revision === declared.ref;
+    return true;
+}
+export const NpmIntegritySchema = SourceStringSchema
+    // A SHA-512 digest is exactly 64 bytes, represented by 86 data characters
+    // and two padding characters. The final data character also has only two
+    // meaningful bits; rejecting non-canonical pad bits avoids alternate text
+    // encodings of the same digest.
+    .regex(/^sha512-[A-Za-z0-9+/]{85}[AQgw]==$/, "SHA-512 integrity must be a canonical 64-byte base64 digest")
+    .brand();
+function readUtf8Value(input, start, byteLength) {
+    let next = start;
+    let consumed = 0;
+    while (next < input.length && consumed < byteLength) {
+        const codePoint = input.codePointAt(next);
+        if (codePoint === undefined) {
+            return undefined;
+        }
+        const character = String.fromCodePoint(codePoint);
+        consumed += new TextEncoder().encode(character).byteLength;
+        next += character.length;
+        if (consumed > byteLength) {
+            return undefined;
+        }
+    }
+    return consumed === byteLength
+        ? { value: input.slice(start, next), next }
+        : undefined;
+}
+const CanonicalFieldSignatures = {
+    github: [["repository"], ["repository", "ref"], ["repository", "revision"]],
+    git: [
+        ["url"],
+        ["url", "ref"],
+        ["url", "sha"],
+        ["url", "ref", "sha"],
+        ["url", "revision"],
+    ],
+    "local-git": [["path"], ["path", "ref"], ["path", "revision"]],
+    "marketplace-path": [["path"], ["path", "marketplaceRevision"]],
+    "git-subdir": [
+        ["url", "path"],
+        ["url", "path", "ref"],
+        ["url", "path", "sha"],
+        ["url", "path", "ref", "sha"],
+        ["url", "path", "revision"],
+    ],
+    npm: [
+        ["package"],
+        ["package", "selector"],
+        ["package", "registry"],
+        ["package", "selector", "registry"],
+        ["package", "version", "integrity", "registry"],
+    ],
+};
+function canonicalSignatureIsAllowed(kind, fields) {
+    return (CanonicalFieldSignatures[kind] ?? []).some((signature) => signature.length === fields.length &&
+        signature.every((name, index) => name === fields[index]?.[0]));
+}
+function isCanonicalFieldValue(kind, name, value) {
+    if (hasLoneSurrogate(value)) {
+        return false;
+    }
+    switch (name) {
+        case "url":
+            return kind === "git" || kind === "git-subdir"
+                ? isCanonicalGitUrl(value)
+                : false;
+        case "registry":
+            return kind === "npm" && isCanonicalNpmRegistry(value);
+        case "path":
+            return isCanonicalEncodedPath(value);
+        case "repository":
+            return GitHubRepositorySchema.safeParse(value).success;
+        case "sha":
+        case "revision":
+        case "marketplaceRevision":
+            return GitRevisionInputSchema.safeParse(value).success;
+        case "integrity":
+            return NpmIntegritySchema.safeParse(value).success;
+        case "ref":
+        case "selector":
+        case "package":
+        case "version":
+            return NonEmptySourceStringSchema.safeParse(value).success;
+        default:
+            return false;
+    }
+}
+function parseCanonicalSource(value) {
+    if (!value.startsWith("source-v1|") || hasLoneSurrogate(value)) {
+        return false;
+    }
+    const kindStart = "source-v1|".length;
+    const kindEnd = value.indexOf("|", kindStart);
+    if (kindEnd === -1) {
+        return false;
+    }
+    const kind = value.slice(kindStart, kindEnd);
+    if (!/^[a-z][a-z0-9-]*$/.test(kind) || !CanonicalSourceKinds.has(kind)) {
+        return false;
+    }
+    let cursor = kindEnd + 1;
+    const fieldNames = new Set();
+    const fields = [];
+    while (cursor < value.length) {
+        const nameEnd = value.indexOf(":", cursor);
+        if (nameEnd === -1 || !/^[a-zA-Z][a-zA-Z0-9-]*$/.test(value.slice(cursor, nameEnd))) {
+            return false;
+        }
+        const fieldName = value.slice(cursor, nameEnd);
+        if (fieldNames.has(fieldName)) {
+            return false;
+        }
+        fieldNames.add(fieldName);
+        const lengthStart = nameEnd + 1;
+        const lengthEnd = value.indexOf(":", lengthStart);
+        const lengthText = lengthEnd === -1
+            ? ""
+            : value.slice(lengthStart, lengthEnd);
+        if (lengthEnd === -1 || !/^[1-9]\d*$/.test(lengthText)) {
+            return false;
+        }
+        const byteLength = Number(lengthText);
+        if (!Number.isSafeInteger(byteLength)) {
+            return false;
+        }
+        const parsed = readUtf8Value(value, lengthEnd + 1, byteLength);
+        if (parsed === undefined || parsed.value.length === 0) {
+            return false;
+        }
+        fields.push([fieldName, parsed.value]);
+        cursor = parsed.next;
+        if (cursor === value.length) {
+            break;
+        }
+        if (value[cursor] !== "|") {
+            return false;
+        }
+        cursor += 1;
+        if (cursor === value.length) {
+            return false;
+        }
+    }
+    return fields.length > 0 &&
+        canonicalSignatureIsAllowed(kind, fields) &&
+        fields.every(([name, fieldValue]) => isCanonicalFieldValue(kind, name, fieldValue));
+}
+export const CanonicalSourceSchema = z
+    .string()
+    .refine(parseCanonicalSource, "canonical source has an invalid source-v1 encoding")
+    .brand();
+export const SourceHashSchema = z
+    .string()
+    .regex(/^sha256:[0-9a-f]{64}$/)
+    .brand();
+function isCanonicalScpUrl(value) {
+    const match = CanonicalScpGitUrl.exec(value);
+    if (match === null) {
+        return false;
+    }
+    const host = match.groups?.host ?? "";
+    // Mirror declared SCP eligibility exactly: a user-qualified host, a
+    // DNS-like host, or localhost. Canonical validation must not admit values
+    // that no accepted declaration can produce.
+    return match.groups?.user !== undefined || host.includes(".") || host === "localhost";
+}
+function normalizeScpUrl(value) {
+    const match = ScpGitUrl.exec(value);
+    if (match !== null && isScpGitUrl(value)) {
+        const user = match.groups?.user;
+        const prefix = user === undefined ? "" : `${user}@`;
+        return `scp://${prefix}${(match.groups?.host ?? "").toLowerCase()}/${match.groups?.path ?? ""}`;
+    }
+    const canonicalMatch = CanonicalScpGitUrl.exec(value);
+    if (canonicalMatch !== null) {
+        const user = canonicalMatch.groups?.user;
+        const prefix = user === undefined ? "" : `${user}@`;
+        return `scp://${prefix}${(canonicalMatch.groups?.host ?? "").toLowerCase()}/${canonicalMatch.groups?.path ?? ""}`;
+    }
+    return value;
+}
+function decodeUrlSegment(value) {
+    // Validation happens before URL normalization. Do not fall back to treating
+    // malformed percent escapes as literals: `%zz` and `%25zz` would otherwise
+    // become the same canonical path bytes.
+    if (!hasValidPercentEscapes(value)) {
+        throw new TypeError("URL contains a malformed percent escape");
+    }
+    const decoded = decodeURIComponent(value);
+    if (hasLoneSurrogate(decoded)) {
+        throw new TypeError("URL contains a lone UTF-16 surrogate code unit");
+    }
+    return decoded;
+}
+const encoder = new TextEncoder();
+const hex = "0123456789ABCDEF";
+function assertWellFormedUtf16(value) {
+    if (hasLoneSurrogate(value)) {
+        throw new TypeError("source canonicalization cannot encode a lone UTF-16 surrogate code unit");
+    }
+}
+function utf8ByteLength(value) {
+    assertWellFormedUtf16(value);
+    return encoder.encode(value).byteLength;
+}
+function encodePathSegment(value) {
+    let encoded = "";
+    for (const byte of encoder.encode(value)) {
+        // RFC 3986 unreserved bytes are safe inside a path segment. Encoding all
+        // other bytes avoids delimiter aliases and gives one representation for
+        // Unicode and punctuation in declared paths.
+        if ((byte >= 0x30 && byte <= 0x39) ||
+            (byte >= 0x41 && byte <= 0x5a) ||
+            (byte >= 0x61 && byte <= 0x7a) ||
+            byte === 0x2d ||
+            byte === 0x2e ||
+            byte === 0x5f ||
+            byte === 0x7e) {
+            encoded += String.fromCharCode(byte);
+        }
+        else {
+            encoded += `%${hex[byte >> 4]}${hex[byte & 0x0f]}`;
+        }
+    }
+    return encoded;
+}
+function encodePath(value) {
+    assertWellFormedUtf16(value);
+    return value.split("/").map(encodePathSegment).join("/");
+}
+function encodeUrlPath(pathname) {
+    return pathname
+        .split("/")
+        .map((segment) => encodePathSegment(decodeUrlSegment(segment)))
+        .join("/");
+}
+/**
+ * Normalize only URL syntax that is safe at this contract boundary. URL does
+ * not resolve redirects, refs, filesystem paths, symlinks, or semver; those
+ * are acquisition concerns. The authority is rebuilt because URL does not
+ * lowercase hosts consistently for every scheme (notably SSH).
+ */
+function normalizeUrl(value) {
+    assertWellFormedUtf16(value);
+    if (isScpGitUrl(value) || isCanonicalScpUrl(value)) {
+        return normalizeScpUrl(value);
+    }
+    if (!hasValidPercentEscapes(value)) {
+        throw new TypeError("URL contains a malformed percent escape");
+    }
+    const parsed = new URL(value);
+    const suffix = `${parsed.search}${parsed.hash}`;
+    const hierarchicalPrefix = `${parsed.protocol.toLowerCase()}//`;
+    const credentials = parsed.username
+        ? `${parsed.username}@`
+        : "";
+    // WHATWG URL strips known defaults such as HTTPS 443 but does not know
+    // SSH's conventional port. Normalize it explicitly so equivalent Git
+    // remotes do not fragment cache and trust identities.
+    const port = parsed.protocol === "ssh:" && parsed.port === "22"
+        ? ""
+        : parsed.port
+            ? `:${parsed.port}`
+            : "";
+    const authority = `${hierarchicalPrefix}${credentials}${parsed.hostname.toLowerCase()}${port}`;
+    return `${authority}${encodeUrlPath(parsed.pathname)}${suffix}`;
+}
+function isCanonicalGitUrl(value) {
+    if (isCanonicalScpUrl(value)) {
+        return normalizeScpUrl(value) === value;
+    }
+    if (!GitUrlSchema.safeParse(value).success) {
+        return false;
+    }
+    try {
+        return normalizeUrl(value) === value;
+    }
+    catch {
+        return false;
+    }
+}
+function isCanonicalNpmRegistry(value) {
+    if (!NpmRegistrySchema.safeParse(value).success) {
+        return false;
+    }
+    try {
+        return normalizeUrl(value) === value;
+    }
+    catch {
+        return false;
+    }
+}
+function isCanonicalEncodedPath(value) {
+    if (!NonEmptySourceStringSchema.safeParse(value).success || !hasValidPercentEscapes(value)) {
+        return false;
+    }
+    try {
+        return encodePath(decodeURIComponent(value)) === value;
+    }
+    catch {
+        return false;
+    }
+}
+function canonicalSource(kind, fields) {
+    const encodedFields = fields
+        .filter((field) => field[1] !== undefined)
+        .map(([name, value]) => `${name}:${utf8ByteLength(value)}:${value}`);
+    return CanonicalSourceSchema.parse(["source-v1", kind, ...encodedFields].join("|"));
+}
+export function serializeMarketplaceSource(source) {
+    const value = MarketplaceSourceSchema.parse(source);
+    switch (value.kind) {
+        case "github":
+            return canonicalSource("github", [
+                ["repository", value.repository],
+                ["ref", value.ref],
+            ]);
+        case "git":
+            return canonicalSource("git", [
+                ["url", normalizeUrl(value.url)],
+                ["ref", value.ref],
+            ]);
+        case "local-git":
+            return canonicalSource("local-git", [
+                ["path", encodePath(value.path)],
+                ["ref", value.ref],
+            ]);
+        default:
+            return assertNever(value);
+    }
+}
+export function serializePluginSource(source) {
+    const value = PluginSourceSchema.parse(source);
+    switch (value.kind) {
+        case "marketplace-path":
+            return canonicalSource("marketplace-path", [
+                ["path", encodePath(value.path)],
+            ]);
+        case "git":
+            return canonicalSource("git", [
+                ["url", normalizeUrl(value.url)],
+                ["ref", value.ref],
+                ["sha", value.sha],
+            ]);
+        case "git-subdir":
+            return canonicalSource("git-subdir", [
+                ["url", normalizeUrl(value.url)],
+                // Foreign marketplace readers accept both `plugin` and `./plugin`.
+                // Canonical source bytes must not let that spelling split identity.
+                ["path", encodePath(value.path.startsWith("./") ? value.path.slice(2) : value.path)],
+                ["ref", value.ref],
+                ["sha", value.sha],
+            ]);
+        case "npm":
+            return canonicalSource("npm", [
+                ["package", value.package],
+                ["selector", value.selector],
+                ["registry", value.registry === undefined ? undefined : normalizeUrl(value.registry)],
+            ]);
+        default:
+            return assertNever(value);
+    }
+}
+function assertNever(value) {
+    throw new Error(`Unhandled source variant: ${String(value)}`);
+}
+export function hashCanonicalSource(source, sha256) {
+    const canonical = CanonicalSourceSchema.parse(source);
+    if (typeof sha256 !== "function") {
+        throw new TypeError("hashCanonicalSource requires a SHA-256 function");
+    }
+    const digest = sha256(encoder.encode(canonical));
+    if (!(digest instanceof Uint8Array) || digest.byteLength !== 32) {
+        throw new Error("SHA-256 function must return exactly 32 bytes");
+    }
+    let digestHex = "";
+    for (const byte of digest) {
+        digestHex += `${hex[byte >> 4]}${hex[byte & 0x0f]}`.toLowerCase();
+    }
+    return SourceHashSchema.parse(`sha256:${digestHex}`);
+}
+function serializeResolvedMarketplaceSource(source, revision) {
+    switch (source.kind) {
+        case "github":
+            return canonicalSource("github", [
+                ["repository", source.repository],
+                ["revision", revision],
+            ]);
+        case "git":
+            return canonicalSource("git", [
+                ["url", normalizeUrl(source.url)],
+                ["revision", revision],
+            ]);
+        case "local-git":
+            return canonicalSource("local-git", [
+                ["path", encodePath(source.path)],
+                ["revision", revision],
+            ]);
+        default:
+            return assertNever(source);
+    }
+}
+const ResolvedMarketplaceSourceIdentitySchema = z
+    .object({
+    declared: MarketplaceSourceSchema,
+    revision: GitRevisionSchema,
+})
+    .strict();
+export const ResolvedMarketplaceSourceSchema = ResolvedMarketplaceSourceIdentitySchema
+    .extend({
+    canonical: CanonicalSourceSchema,
+    hash: SourceHashSchema,
+})
+    .strict()
+    .readonly()
+    .superRefine((value, context) => {
+    const expected = serializeResolvedMarketplaceSource(value.declared, value.revision);
+    if (value.canonical !== expected) {
+        context.addIssue({
+            code: "custom",
+            path: ["canonical"],
+            message: "canonical source does not match the declared kind and immutable revision",
+        });
+    }
+});
+const ResolvedPluginSourceIdentityVariantRegistry = {
+    marketplacePath: {
+        label: "Marketplace path",
+        schema: z
+            .object({
+            kind: z.literal("marketplace-path"),
+            marketplaceRevision: GitRevisionSchema,
+            path: NonEmptySourceStringSchema,
+        })
+            .strict(),
+    },
+    git: {
+        label: "Git repository",
+        schema: z
+            .object({
+            kind: z.literal("git"),
+            url: GitUrlSchema,
+            revision: GitRevisionSchema,
+        })
+            .strict(),
+    },
+    gitSubdir: {
+        label: "Git repository subdirectory",
+        schema: z
+            .object({
+            kind: z.literal("git-subdir"),
+            url: GitUrlSchema,
+            revision: GitRevisionSchema,
+            path: NonEmptySourceStringSchema,
+        })
+            .strict(),
+    },
+    npm: {
+        label: "npm package",
+        schema: z
+            .object({
+            kind: z.literal("npm"),
+            package: NonEmptySourceStringSchema,
+            version: NonEmptySourceStringSchema,
+            integrity: NpmIntegritySchema,
+            registry: NpmRegistrySchema,
+        })
+            .strict(),
+    },
+};
+const resolvedSourceMetadata = {
+    canonical: CanonicalSourceSchema,
+    hash: SourceHashSchema,
+};
+export const ResolvedPluginSourceVariantRegistry = {
+    marketplacePath: {
+        label: ResolvedPluginSourceIdentityVariantRegistry.marketplacePath.label,
+        schema: ResolvedPluginSourceIdentityVariantRegistry.marketplacePath.schema
+            .extend(resolvedSourceMetadata)
+            .strict()
+            .readonly(),
+    },
+    git: {
+        label: ResolvedPluginSourceIdentityVariantRegistry.git.label,
+        schema: ResolvedPluginSourceIdentityVariantRegistry.git.schema
+            .extend(resolvedSourceMetadata)
+            .strict()
+            .readonly(),
+    },
+    gitSubdir: {
+        label: ResolvedPluginSourceIdentityVariantRegistry.gitSubdir.label,
+        schema: ResolvedPluginSourceIdentityVariantRegistry.gitSubdir.schema
+            .extend(resolvedSourceMetadata)
+            .strict()
+            .readonly(),
+    },
+    npm: {
+        label: ResolvedPluginSourceIdentityVariantRegistry.npm.label,
+        schema: ResolvedPluginSourceIdentityVariantRegistry.npm.schema
+            .extend(resolvedSourceMetadata)
+            .strict()
+            .readonly(),
+    },
+};
+const ResolvedPluginSourceIdentitySchema = z.discriminatedUnion("kind", schemasFor(ResolvedPluginSourceIdentityVariantRegistry));
+function serializeResolvedPluginSource(source) {
+    switch (source.kind) {
+        case "marketplace-path":
+            return canonicalSource("marketplace-path", [
+                ["path", encodePath(source.path)],
+                ["marketplaceRevision", source.marketplaceRevision],
+            ]);
+        case "git":
+            return canonicalSource("git", [
+                ["url", normalizeUrl(source.url)],
+                ["revision", source.revision],
+            ]);
+        case "git-subdir":
+            return canonicalSource("git-subdir", [
+                ["url", normalizeUrl(source.url)],
+                ["path", encodePath(source.path)],
+                ["revision", source.revision],
+            ]);
+        case "npm":
+            return canonicalSource("npm", [
+                ["package", source.package],
+                ["version", source.version],
+                ["integrity", source.integrity],
+                ["registry", normalizeUrl(source.registry)],
+            ]);
+        default:
+            return assertNever(source);
+    }
+}
+export const ResolvedPluginSourceSchema = z
+    .discriminatedUnion("kind", schemasFor(ResolvedPluginSourceVariantRegistry))
+    .superRefine((value, context) => {
+    const expected = serializeResolvedPluginSource(value);
+    if (value.canonical !== expected) {
+        context.addIssue({
+            code: "custom",
+            path: ["canonical"],
+            message: "canonical source does not match the kind and immutable source fields",
+        });
+    }
+});
+const ResolvedMarketplaceSourceInputSchema = z
+    .object({
+    declared: MarketplaceSourceSchema,
+    revision: GitRevisionSchema,
+    canonical: CanonicalSourceSchema.optional(),
+    hash: SourceHashSchema.optional(),
+})
+    .strict();
+/**
+ * Build the immutable marketplace contract from a declaration and resolved
+ * revision. The domain computes canonical bytes; an adapter supplies only the
+ * SHA-256 port. Optional supplied canonical/hash claims are checked rather
+ * than trusted.
+ */
+export function createResolvedMarketplaceSource(input, sha256) {
+    const value = ResolvedMarketplaceSourceInputSchema.parse(input);
+    const canonical = serializeResolvedMarketplaceSource(value.declared, value.revision);
+    const hash = hashCanonicalSource(canonical, sha256);
+    if (value.canonical !== undefined && value.canonical !== canonical) {
+        throw new Error("resolved marketplace canonical source does not match its identity");
+    }
+    if (value.hash !== undefined && value.hash !== hash) {
+        throw new Error("resolved marketplace source hash does not match its canonical source");
+    }
+    return ResolvedMarketplaceSourceSchema.parse({
+        ...value,
+        canonical,
+        hash,
+    });
+}
+/** Verify both the canonical identity and the injected source hash. */
+export function verifyResolvedMarketplaceSource(input, sha256) {
+    const value = ResolvedMarketplaceSourceSchema.parse(input);
+    const expectedHash = hashCanonicalSource(value.canonical, sha256);
+    if (value.hash !== expectedHash) {
+        throw new Error("resolved marketplace source hash does not match its canonical source");
+    }
+    return value;
+}
+const ResolvedPluginSourceInputSchema = z.discriminatedUnion("kind", [
+    ResolvedPluginSourceIdentityVariantRegistry.marketplacePath.schema
+        .extend({
+        canonical: CanonicalSourceSchema.optional(),
+        hash: SourceHashSchema.optional(),
+    })
+        .strict(),
+    ResolvedPluginSourceIdentityVariantRegistry.git.schema
+        .extend({
+        canonical: CanonicalSourceSchema.optional(),
+        hash: SourceHashSchema.optional(),
+    })
+        .strict(),
+    ResolvedPluginSourceIdentityVariantRegistry.gitSubdir.schema
+        .extend({
+        canonical: CanonicalSourceSchema.optional(),
+        hash: SourceHashSchema.optional(),
+    })
+        .strict(),
+    ResolvedPluginSourceIdentityVariantRegistry.npm.schema
+        .extend({
+        canonical: CanonicalSourceSchema.optional(),
+        hash: SourceHashSchema.optional(),
+    })
+        .strict(),
+]);
+/** Build a resolved plugin source while binding all immutable fields together. */
+export function createResolvedPluginSource(input, sha256) {
+    const value = ResolvedPluginSourceInputSchema.parse(input);
+    const canonical = serializeResolvedPluginSource(value);
+    const hash = hashCanonicalSource(canonical, sha256);
+    if (value.canonical !== undefined && value.canonical !== canonical) {
+        throw new Error("resolved plugin canonical source does not match its identity");
+    }
+    if (value.hash !== undefined && value.hash !== hash) {
+        throw new Error("resolved plugin source hash does not match its canonical source");
+    }
+    return ResolvedPluginSourceSchema.parse({
+        ...value,
+        canonical,
+        hash,
+    });
+}
+/** Verify kind, immutable fields, canonical bytes, and the injected hash. */
+export function verifyResolvedPluginSource(input, sha256) {
+    const value = ResolvedPluginSourceSchema.parse(input);
+    const expectedHash = hashCanonicalSource(value.canonical, sha256);
+    if (value.hash !== expectedHash) {
+        throw new Error("resolved plugin source hash does not match its canonical source");
+    }
+    return value;
+}
+//# sourceMappingURL=source.js.map