@stigmer/plugin-package 3.17.0 → 3.18.0

package/client/builtin.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The sources every client lists without being told: Stigmer's official
+ * catalogue and the three vendors' public ones.
+ *
+ * The product's promise is "bring your Cursor, Claude Code or Codex
+ * plugin", so the catalogues those vendors publish are on offer from the
+ * first screen, in the console's Marketplace and in `stigmer marketplace
+ * list`, without a user having to know a repository slug. They are code,
+ * not stored state: a client's remembered sources hold only what the user
+ * added, so the two clients cannot drift from each other and a vendor
+ * moving its repository is one release, not a migration. The names are
+ * reserved the way the official one is; a user can neither add nor remove
+ * them.
+ *
+ * Each vendor keeps its marketplace file at the repository root in its own
+ * location, all four of which `readMarketplace` reads (`.cursor-plugin/`,
+ * `.claude-plugin/`, `.agents/plugins/`). Measured on 2026-09-18 through
+ * the GitHub Trees API: 1,168, 1,594 and 7,746 entries respectively, none
+ * truncated, all under the console's 20,000-entry listing cap; Codex's
+ * catalogue names its entries as `{source: "local", path}` objects, which
+ * the reader accepts, and three of its 65 as remote sources, which it
+ * drops with its own sentence.
+ */
+import type { GitHubMarketplaceSource } from "./refs.js";
+/** A source a client ships with: named, described for a section heading, and either the official catalogue or a public GitHub tree. */
+export interface BuiltInMarketplace {
+    readonly name: string;
+    /** One sentence for the Marketplace's section heading and `marketplace list`. */
+    readonly description: string;
+    readonly source: {
+        readonly type: "official";
+    } | GitHubMarketplaceSource;
+}
+/** In listing order: the official catalogue first, then the vendors in the order the product names them. */
+export declare const BUILT_IN_MARKETPLACES: readonly BuiltInMarketplace[];
+/** Whether `name` is one a user may neither add nor remove. */
+export declare function isBuiltInMarketplaceName(name: string): boolean;
+/** The one sentence every client refuses with when a user tries to add over or remove a built-in source. */
+export declare function builtInSourceRefusal(name: string, act: "add" | "remove"): string;
+//# sourceMappingURL=builtin.d.ts.map

package/client/builtin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin.d.ts","sourceRoot":"","sources":["../../src/client/builtin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAGzD,uIAAuI;AACvI,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;KAAE,GAAG,uBAAuB,CAAC;CAC1E;AAED,4GAA4G;AAC5G,eAAO,MAAM,qBAAqB,EAAE,SAAS,kBAAkB,EAqB9D,CAAC;AAIF,+DAA+D;AAC/D,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,4GAA4G;AAC5G,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAWhF"}

package/client/builtin.js

@@ -0,0 +1,66 @@
+/**
+ * The sources every client lists without being told: Stigmer's official
+ * catalogue and the three vendors' public ones.
+ *
+ * The product's promise is "bring your Cursor, Claude Code or Codex
+ * plugin", so the catalogues those vendors publish are on offer from the
+ * first screen, in the console's Marketplace and in `stigmer marketplace
+ * list`, without a user having to know a repository slug. They are code,
+ * not stored state: a client's remembered sources hold only what the user
+ * added, so the two clients cannot drift from each other and a vendor
+ * moving its repository is one release, not a migration. The names are
+ * reserved the way the official one is; a user can neither add nor remove
+ * them.
+ *
+ * Each vendor keeps its marketplace file at the repository root in its own
+ * location, all four of which `readMarketplace` reads (`.cursor-plugin/`,
+ * `.claude-plugin/`, `.agents/plugins/`). Measured on 2026-09-18 through
+ * the GitHub Trees API: 1,168, 1,594 and 7,746 entries respectively, none
+ * truncated, all under the console's 20,000-entry listing cap; Codex's
+ * catalogue names its entries as `{source: "local", path}` objects, which
+ * the reader accepts, and three of its 65 as remote sources, which it
+ * drops with its own sentence.
+ */
+import { OFFICIAL_MARKETPLACE_NAME } from "./refs.js";
+/** In listing order: the official catalogue first, then the vendors in the order the product names them. */
+export const BUILT_IN_MARKETPLACES = [
+    {
+        name: OFFICIAL_MARKETPLACE_NAME,
+        description: "Stigmer's official catalogue, published with each release.",
+        source: { type: "official" },
+    },
+    {
+        name: "cursor-plugins",
+        description: "Cursor's public plugin catalogue.",
+        source: { type: "github", repo: "cursor/plugins" },
+    },
+    {
+        name: "claude-code-plugins",
+        description: "Claude Code's public plugin catalogue.",
+        source: { type: "github", repo: "anthropics/claude-code" },
+    },
+    {
+        name: "codex-plugins",
+        description: "Codex's public plugin catalogue.",
+        source: { type: "github", repo: "openai/plugins" },
+    },
+];
+const BUILT_IN_NAMES = new Set(BUILT_IN_MARKETPLACES.map((entry) => entry.name));
+/** Whether `name` is one a user may neither add nor remove. */
+export function isBuiltInMarketplaceName(name) {
+    return BUILT_IN_NAMES.has(name);
+}
+/** The one sentence every client refuses with when a user tries to add over or remove a built-in source. */
+export function builtInSourceRefusal(name, act) {
+    switch (act) {
+        case "add":
+            return `'${name}' is a built-in source and cannot be added or replaced; choose another name`;
+        case "remove":
+            return `'${name}' is a built-in source and cannot be removed`;
+        default: {
+            const exhaustive = act;
+            return exhaustive;
+        }
+    }
+}
+//# sourceMappingURL=builtin.js.map

package/client/builtin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"builtin.js","sourceRoot":"","sources":["../../src/client/builtin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,WAAW,CAAC;AAUtD,4GAA4G;AAC5G,MAAM,CAAC,MAAM,qBAAqB,GAAkC;IAClE;QACE,IAAI,EAAE,yBAAyB;QAC/B,WAAW,EAAE,4DAA4D;QACzE,MAAM,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE;KAC7B;IACD;QACE,IAAI,EAAE,gBAAgB;QACtB,WAAW,EAAE,mCAAmC;QAChD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE;KACnD;IACD;QACE,IAAI,EAAE,qBAAqB;QAC3B,WAAW,EAAE,wCAAwC;QACrD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,EAAE;KAC3D;IACD;QACE,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,kCAAkC;QAC/C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE;KACnD;CACF,CAAC;AAEF,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;AAEtG,+DAA+D;AAC/D,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,GAAqB;IACtE,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,KAAK;YACR,OAAO,IAAI,IAAI,6EAA6E,CAAC;QAC/F,KAAK,QAAQ;YACX,OAAO,IAAI,IAAI,8CAA8C,CAAC;QAChE,OAAO,CAAC,CAAC,CAAC;YACR,MAAM,UAAU,GAAU,GAAG,CAAC;YAC9B,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC"}

package/client/prepare.d.ts

@@ -0,0 +1,99 @@
+/**
+ * The preparation every client runs once it holds a tree: select the files
+ * a push carries, read the package and refuse what the reader refuses,
+ * archive, digest.
+ *
+ * Three clients arrive here with three kinds of tree: the CLI with a
+ * directory on disk, the console with a marketplace host's file listing,
+ * and the console again with a folder or a zip the user picked. What they
+ * do after selection is identical, and it is where the plugin's identity
+ * is made (the archive's bytes are `status.digest`), so it is written once.
+ * A parity test proves that one function reached three ways yields one
+ * digest for one tree; before this module each client carried its own copy
+ * of the chain and the test proved a coincidence.
+ *
+ * `preparePluginFromTree` is the lazy form for a tree whose bytes cost
+ * something to obtain (a fetch per file, a `File.arrayBuffer()`): it reads
+ * the two root ignore files, selects, refuses an over-cap selection before
+ * another byte moves, then reads only the files the archive will carry. A
+ * plugin folder holding a `node_modules/` costs its ignore file and its
+ * manifest, wherever the tree lives. The CLI keeps its own walk (a
+ * filesystem lets it skip a directory before listing it, which a flat tree
+ * cannot) and joins at `preparePluginArchive`.
+ *
+ * Refusals are returned, not thrown: each client renders the reader's
+ * findings in its own voice (the CLI's `pluginRefusal`, the console's
+ * `PluginReadRefusal`) and adds its own provenance around the result.
+ */
+import type { PluginFiles } from "../files.js";
+import type { PluginFinding } from "../outcome.js";
+import type { PluginPackage } from "../types.js";
+import { type CandidateFile, type SelectPluginFilesOptions, type SelectionStats } from "./select.js";
+/** What a client holds after preparation: the package as read, the bytes a push sends, and their identity. */
+export interface PreparedPlugin {
+    readonly plugin: PluginPackage;
+    readonly warnings: readonly PluginFinding[];
+    /** The selected files, for the client that lists them (`push --dry-run`). */
+    readonly files: PluginFiles;
+    readonly stats: SelectionStats;
+    /** The exact bytes a push sends. */
+    readonly archive: Uint8Array;
+    /**
+     * SHA-256 of `archive`, lowercase hex: the identity the server records as
+     * `status.digest` (its digest is over the bytes it receives, and these are
+     * those bytes), so a client knows "already installed" without pushing.
+     */
+    readonly digest: string;
+}
+/** What an already-selected tree can come to: a prepared plugin, or the reader's refusal. */
+export type PrepareArchiveOutcome = {
+    readonly ok: true;
+    readonly prepared: PreparedPlugin;
+}
+/** The reader refused the package; `errors` are its sentences, as `stigmer validate -f` prints them. */
+ | {
+    readonly ok: false;
+    readonly kind: "refused";
+    readonly errors: readonly PluginFinding[];
+    readonly warnings: readonly PluginFinding[];
+};
+/** What a lazily-read tree can come to: the above, or a refusal on size before its bytes were read. */
+export type PreparePluginOutcome = PrepareArchiveOutcome
+/** The selected files exceed the caller's `maxBytes`; nothing beyond the ignore files was read. */
+ | {
+    readonly ok: false;
+    readonly kind: "too-large";
+    readonly selectedBytes: number;
+    readonly maxBytes: number;
+};
+/** A tree the client can list now and read later: a candidate with the promise of its bytes. */
+export interface LazyCandidate extends CandidateFile {
+    read(): Promise<Uint8Array>;
+}
+export interface PrepareFromTreeOptions extends SelectPluginFilesOptions {
+    /**
+     * The most bytes the SELECTED files may total, refused before they are
+     * read. A client states its own budget (the console's is the archive cap
+     * a browser will hold in memory); omitted, nothing is refused here and
+     * the server's zip gate is the only limit.
+     */
+    readonly maxBytes?: number;
+}
+/**
+ * Read, refuse, archive and digest an already-selected tree. `selection`
+ * is what `selectPluginFiles` returns or what the CLI's walk builds in the
+ * same shape; its `files.read` must answer synchronously for every listed
+ * entry by now.
+ */
+export declare function preparePluginArchive(selection: {
+    readonly files: PluginFiles;
+    readonly stats: SelectionStats;
+}): Promise<PrepareArchiveOutcome>;
+/**
+ * Prepare a tree whose bytes are obtained on demand. A byte is read only
+ * for a file that will be in the archive (plus the two root ignore files
+ * that decide which those are), and an over-cap selection is refused
+ * before any of them.
+ */
+export declare function preparePluginFromTree(candidates: readonly LazyCandidate[], options: PrepareFromTreeOptions): Promise<PreparePluginOutcome>;
+//# sourceMappingURL=prepare.d.ts.map

package/client/prepare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare.d.ts","sourceRoot":"","sources":["../../src/client/prepare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EAGpB,MAAM,aAAa,CAAC;AAErB,8GAA8G;AAC9G,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;IAC5C,6EAA6E;IAC7E,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,oCAAoC;IACpC,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,6FAA6F;AAC7F,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAA;CAAE;AAC1D,wGAAwG;GACtG;IACE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IACnB,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,SAAS,aAAa,EAAE,CAAC;CAC7C,CAAC;AAEN,uGAAuG;AACvG,MAAM,MAAM,oBAAoB,GAC5B,qBAAqB;AACvB,mGAAmG;GACjG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC;AAElH,gGAAgG;AAChG,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,sBAAuB,SAAQ,wBAAwB;IACtE;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAsB,oBAAoB,CAAC,SAAS,EAAE;IACpD,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;CAChC,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAiBjC;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,UAAU,EAAE,SAAS,aAAa,EAAE,EACpC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,oBAAoB,CAAC,CAgC/B"}

package/client/prepare.js

@@ -0,0 +1,89 @@
+/**
+ * The preparation every client runs once it holds a tree: select the files
+ * a push carries, read the package and refuse what the reader refuses,
+ * archive, digest.
+ *
+ * Three clients arrive here with three kinds of tree: the CLI with a
+ * directory on disk, the console with a marketplace host's file listing,
+ * and the console again with a folder or a zip the user picked. What they
+ * do after selection is identical, and it is where the plugin's identity
+ * is made (the archive's bytes are `status.digest`), so it is written once.
+ * A parity test proves that one function reached three ways yields one
+ * digest for one tree; before this module each client carried its own copy
+ * of the chain and the test proved a coincidence.
+ *
+ * `preparePluginFromTree` is the lazy form for a tree whose bytes cost
+ * something to obtain (a fetch per file, a `File.arrayBuffer()`): it reads
+ * the two root ignore files, selects, refuses an over-cap selection before
+ * another byte moves, then reads only the files the archive will carry. A
+ * plugin folder holding a `node_modules/` costs its ignore file and its
+ * manifest, wherever the tree lives. The CLI keeps its own walk (a
+ * filesystem lets it skip a directory before listing it, which a flat tree
+ * cannot) and joins at `preparePluginArchive`.
+ *
+ * Refusals are returned, not thrown: each client renders the reader's
+ * findings in its own voice (the CLI's `pluginRefusal`, the console's
+ * `PluginReadRefusal`) and adds its own provenance around the result.
+ */
+import { readPluginPackage } from "../read-plugin-package.js";
+import { archivePlugin, digestArchive } from "./archive.js";
+import { IGNORE_FILE_NAMES, selectPluginFiles, } from "./select.js";
+/**
+ * Read, refuse, archive and digest an already-selected tree. `selection`
+ * is what `selectPluginFiles` returns or what the CLI's walk builds in the
+ * same shape; its `files.read` must answer synchronously for every listed
+ * entry by now.
+ */
+export async function preparePluginArchive(selection) {
+    const outcome = readPluginPackage(selection.files);
+    if (!outcome.ok) {
+        return { ok: false, kind: "refused", errors: outcome.errors, warnings: outcome.warnings };
+    }
+    const archive = archivePlugin(selection.files);
+    return {
+        ok: true,
+        prepared: {
+            plugin: outcome.plugin,
+            warnings: outcome.warnings,
+            files: selection.files,
+            stats: selection.stats,
+            archive,
+            digest: await digestArchive(archive),
+        },
+    };
+}
+/**
+ * Prepare a tree whose bytes are obtained on demand. A byte is read only
+ * for a file that will be in the archive (plus the two root ignore files
+ * that decide which those are), and an over-cap selection is refused
+ * before any of them.
+ */
+export async function preparePluginFromTree(candidates, options) {
+    const byPath = new Map(candidates.map((candidate) => [candidate.path, candidate]));
+    const contents = new Map();
+    const fetchInto = async (path) => {
+        const candidate = byPath.get(path);
+        if (candidate === undefined)
+            throw new Error(`plugin file '${path}' is not listed`);
+        contents.set(path, await candidate.read());
+    };
+    const read = (path) => {
+        const bytes = contents.get(path);
+        if (bytes === undefined)
+            throw new Error(`plugin file '${path}' was not read before selection asked for it`);
+        return bytes;
+    };
+    // Phase 1: only the two files that shape the selection.
+    await Promise.all([IGNORE_FILE_NAMES.gitignore, IGNORE_FILE_NAMES.stigmerignore]
+        .filter((name) => byPath.has(name))
+        .map((name) => fetchInto(name)));
+    const { maxBytes, ...selectOptions } = options;
+    const selection = selectPluginFiles(candidates, read, selectOptions);
+    if (maxBytes !== undefined && selection.stats.totalSize > maxBytes) {
+        return { ok: false, kind: "too-large", selectedBytes: selection.stats.totalSize, maxBytes };
+    }
+    // Phase 2: exactly the files the archive carries.
+    await Promise.all(selection.files.entries.filter((entry) => !contents.has(entry.path)).map((entry) => fetchInto(entry.path)));
+    return preparePluginArchive(selection);
+}
+//# sourceMappingURL=prepare.js.map

package/client/prepare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare.js","sourceRoot":"","sources":["../../src/client/prepare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAIH,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAIL,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAmDrB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAG1C;IACC,MAAM,OAAO,GAAG,iBAAiB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE;YACR,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,KAAK,EAAE,SAAS,CAAC,KAAK;YACtB,OAAO;YACP,MAAM,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC;SACrC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,UAAoC,EACpC,OAA+B;IAE/B,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC/C,MAAM,SAAS,GAAG,KAAK,EAAE,IAAY,EAAiB,EAAE;QACtD,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,SAAS,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,iBAAiB,CAAC,CAAC;QACpF,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,IAAY,EAAc,EAAE;QACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,IAAI,8CAA8C,CAAC,CAAC;QAC7G,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,wDAAwD;IACxD,MAAM,OAAO,CAAC,GAAG,CACf,CAAC,iBAAiB,CAAC,SAAS,EAAE,iBAAiB,CAAC,aAAa,CAAC;SAC3D,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAClC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAClC,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC;IAC/C,MAAM,SAAS,GAAG,iBAAiB,CAAC,UAAU,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IAErE,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,KAAK,CAAC,SAAS,GAAG,QAAQ,EAAE,CAAC;QACnE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC;IAC9F,CAAC;IAED,kDAAkD;IAClD,MAAM,OAAO,CAAC,GAAG,CACf,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAC3G,CAAC;IACF,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC;AACzC,CAAC"}

package/client/release.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Whether a version string names a release the lockstep publish covers.
+ *
+ * The official catalogue (`@stigmer/plugins`) and the runtime packages are
+ * published at every release version and at every pre-release the release
+ * lane cuts (`X.Y.Z-rc.1` under the `next` tag), never for a source build
+ * (`dev`, `0.0.0-dev`) or a dev-channel stamp (`X.Y.Z-dev.<stamp>`). Two
+ * clients used to answer this with two different tests: the console
+ * accepted only `X.Y.Z` and called an `rc` server a development build; the
+ * CLI accepted anything without `-dev` and would have tried to acquire
+ * packages for the bare `dev` an unbundled server reports. One predicate,
+ * five cases pinned, no third opinion.
+ */
+/** True for `3.17.0` and `3.17.0-rc.1`; false for `dev`, `0.0.0-dev` and `3.17.0-dev.20260918120000`. */
+export declare function isReleaseVersion(version: string): boolean;
+//# sourceMappingURL=release.d.ts.map

package/client/release.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.d.ts","sourceRoot":"","sources":["../../src/client/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,yGAAyG;AACzG,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEzD"}

package/client/release.js

@@ -0,0 +1,24 @@
+/**
+ * Whether a version string names a release the lockstep publish covers.
+ *
+ * The official catalogue (`@stigmer/plugins`) and the runtime packages are
+ * published at every release version and at every pre-release the release
+ * lane cuts (`X.Y.Z-rc.1` under the `next` tag), never for a source build
+ * (`dev`, `0.0.0-dev`) or a dev-channel stamp (`X.Y.Z-dev.<stamp>`). Two
+ * clients used to answer this with two different tests: the console
+ * accepted only `X.Y.Z` and called an `rc` server a development build; the
+ * CLI accepted anything without `-dev` and would have tried to acquire
+ * packages for the bare `dev` an unbundled server reports. One predicate,
+ * five cases pinned, no third opinion.
+ */
+/**
+ * A semver core, optionally followed by a pre-release whose first
+ * identifier is not `dev`. Build metadata (`+…`) is not accepted: nothing
+ * publishes with it.
+ */
+const RELEASE_PATTERN = /^\d+\.\d+\.\d+(?:-(?!dev(?:[.-]|$))[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/;
+/** True for `3.17.0` and `3.17.0-rc.1`; false for `dev`, `0.0.0-dev` and `3.17.0-dev.20260918120000`. */
+export function isReleaseVersion(version) {
+    return RELEASE_PATTERN.test(version);
+}
+//# sourceMappingURL=release.js.map

package/client/release.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release.js","sourceRoot":"","sources":["../../src/client/release.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;GAIG;AACH,MAAM,eAAe,GAAG,yEAAyE,CAAC;AAElG,yGAAyG;AACzG,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvC,CAAC"}

package/client/reroot.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The one directory a zipped folder wraps itself in, so the archive reads
+ * as the folder.
+ *
+ * `zip -r plugin.zip my-plugin/`, a Finder "Compress", and a browser's
+ * download of a repository all produce an archive whose every path begins
+ * with the folder's own name; the manifest a reader looks for at the root
+ * is then one level down. This decides, from the paths alone, whether that
+ * is the case: it is when every path shares exactly one leading directory
+ * and nothing sits beside it. A tree with a root file, or two top-level
+ * directories, is taken as it is; a reader that then finds no manifest says
+ * so in its own words.
+ *
+ * Pure over paths; the caller strips the prefix. Kept out of `select.ts`,
+ * which reasons about a tree that already has its root.
+ */
+/** The shared leading directory of `paths`, or `null` when the tree is already rooted. */
+export declare function rerootSingleDirectory(paths: readonly string[]): string | null;
+/** `paths` with `prefix/` removed from each; the caller has established every path carries it. */
+export declare function stripDirectoryPrefix(paths: readonly string[], prefix: string): string[];
+//# sourceMappingURL=reroot.d.ts.map

package/client/reroot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reroot.d.ts","sourceRoot":"","sources":["../../src/client/reroot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,0FAA0F;AAC1F,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAU7E;AAED,kGAAkG;AAClG,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAGvF"}

package/client/reroot.js

@@ -0,0 +1,37 @@
+/**
+ * The one directory a zipped folder wraps itself in, so the archive reads
+ * as the folder.
+ *
+ * `zip -r plugin.zip my-plugin/`, a Finder "Compress", and a browser's
+ * download of a repository all produce an archive whose every path begins
+ * with the folder's own name; the manifest a reader looks for at the root
+ * is then one level down. This decides, from the paths alone, whether that
+ * is the case: it is when every path shares exactly one leading directory
+ * and nothing sits beside it. A tree with a root file, or two top-level
+ * directories, is taken as it is; a reader that then finds no manifest says
+ * so in its own words.
+ *
+ * Pure over paths; the caller strips the prefix. Kept out of `select.ts`,
+ * which reasons about a tree that already has its root.
+ */
+/** The shared leading directory of `paths`, or `null` when the tree is already rooted. */
+export function rerootSingleDirectory(paths) {
+    let prefix = null;
+    for (const path of paths) {
+        const slash = path.indexOf("/");
+        if (slash <= 0)
+            return null;
+        const head = path.slice(0, slash);
+        if (prefix === null)
+            prefix = head;
+        else if (prefix !== head)
+            return null;
+    }
+    return prefix;
+}
+/** `paths` with `prefix/` removed from each; the caller has established every path carries it. */
+export function stripDirectoryPrefix(paths, prefix) {
+    const cut = prefix.length + 1;
+    return paths.map((path) => path.slice(cut));
+}
+//# sourceMappingURL=reroot.js.map

package/client/reroot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reroot.js","sourceRoot":"","sources":["../../src/client/reroot.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,0FAA0F;AAC1F,MAAM,UAAU,qBAAqB,CAAC,KAAwB;IAC5D,IAAI,MAAM,GAAkB,IAAI,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,IAAI;YAAE,MAAM,GAAG,IAAI,CAAC;aAC9B,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,oBAAoB,CAAC,KAAwB,EAAE,MAAc;IAC3E,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/client.d.ts

@@ -15,13 +15,20 @@
  *   order the CLI's original walk produced them;
  * - the archive and its digest (`archive.ts`): the deterministic zip and
  *   the SHA-256 the server records;
+ * - the preparation (`prepare.ts`): select, read, refuse, archive, digest,
+ *   once, for a tree on disk, on a host, or in a browser's memory;
  * - the grammars (`refs.ts`): an install ref and a GitHub marketplace
  *   source, with their refusal sentences;
+ * - the built-in sources (`builtin.ts`): the official catalogue and the
+ *   three vendors', listed by every client without configuration;
+ * - the release predicate (`release.ts`): which server versions the
+ *   catalogue is published for;
+ * - the re-rooting rule (`reroot.ts`): a zipped folder reads as the folder;
  * - the vocabulary (`vocabulary.ts`): the labels both surfaces print.
  *
  * Nothing here touches the filesystem, the network or any `node:*` module.
- * A client's edge (a directory walk, a fetch) produces the candidates and
- * the bytes; this entry decides what becomes of them.
+ * A client's edge (a directory walk, a fetch, a file pick) produces the
+ * candidates and the bytes; this entry decides what becomes of them.
  */
 export { DEFAULT_PATTERNS } from "./client/ignore/defaults.js";
 export { matchName } from "./client/ignore/match.js";
@@ -29,6 +36,10 @@ export { type IgnoreSources, type MatchReason, Matcher, Reason, REASON_TEXT, SOU
 export { MatchResult, type Pattern, parsePattern } from "./client/ignore/pattern.js";
 export { type CandidateFile, type PluginSelection, type SelectPluginFilesOptions, type SelectionStats, IGNORE_FILE_NAMES, compareWalkOrder, selectPluginFiles, } from "./client/select.js";
 export { DETERMINISTIC_ZIP_MTIME, archivePlugin, digestArchive } from "./client/archive.js";
+export { type LazyCandidate, type PrepareArchiveOutcome, type PrepareFromTreeOptions, type PreparePluginOutcome, type PreparedPlugin, preparePluginArchive, preparePluginFromTree, } from "./client/prepare.js";
+export { type BuiltInMarketplace, BUILT_IN_MARKETPLACES, builtInSourceRefusal, isBuiltInMarketplaceName, } from "./client/builtin.js";
+export { isReleaseVersion } from "./client/release.js";
+export { rerootSingleDirectory, stripDirectoryPrefix } from "./client/reroot.js";
 export { type GitHubMarketplaceSource, type GitHubSourceOutcome, type InstallRef, type InstallRefOutcome, GITHUB_SOURCE_SHAPE, INSTALL_REF_SHAPE, OFFICIAL_MARKETPLACE_NAME, describeGitHubSource, formatInstallRef, isOwnerRepo, looksLikePath, parseGitHubSource, parseInstallRef, } from "./client/refs.js";
 export { DIALECT_LABELS } from "./client/vocabulary.js";
 //# sourceMappingURL=client.d.ts.map

package/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,OAAO,EACP,MAAM,EACN,WAAW,EACX,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,GACb,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,OAAO,EACP,MAAM,EACN,WAAW,EACX,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,GACb,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,KAAK,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,wBAAwB,EAC7B,KAAK,cAAc,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,qBAAqB,EAC1B,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,EACzB,KAAK,cAAc,EACnB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,mBAAmB,EACxB,KAAK,UAAU,EACf,KAAK,iBAAiB,EACtB,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC"}

package/client.js

@@ -15,13 +15,20 @@
  *   order the CLI's original walk produced them;
  * - the archive and its digest (`archive.ts`): the deterministic zip and
  *   the SHA-256 the server records;
+ * - the preparation (`prepare.ts`): select, read, refuse, archive, digest,
+ *   once, for a tree on disk, on a host, or in a browser's memory;
  * - the grammars (`refs.ts`): an install ref and a GitHub marketplace
  *   source, with their refusal sentences;
+ * - the built-in sources (`builtin.ts`): the official catalogue and the
+ *   three vendors', listed by every client without configuration;
+ * - the release predicate (`release.ts`): which server versions the
+ *   catalogue is published for;
+ * - the re-rooting rule (`reroot.ts`): a zipped folder reads as the folder;
  * - the vocabulary (`vocabulary.ts`): the labels both surfaces print.
  *
  * Nothing here touches the filesystem, the network or any `node:*` module.
- * A client's edge (a directory walk, a fetch) produces the candidates and
- * the bytes; this entry decides what becomes of them.
+ * A client's edge (a directory walk, a fetch, a file pick) produces the
+ * candidates and the bytes; this entry decides what becomes of them.
  */
 export { DEFAULT_PATTERNS } from "./client/ignore/defaults.js";
 export { matchName } from "./client/ignore/match.js";
@@ -29,6 +36,10 @@ export { Matcher, Reason, REASON_TEXT, SOURCE_CLI, SOURCE_DEFAULTS, SOURCE_GITIG
 export { MatchResult, parsePattern } from "./client/ignore/pattern.js";
 export { IGNORE_FILE_NAMES, compareWalkOrder, selectPluginFiles, } from "./client/select.js";
 export { DETERMINISTIC_ZIP_MTIME, archivePlugin, digestArchive } from "./client/archive.js";
+export { preparePluginArchive, preparePluginFromTree, } from "./client/prepare.js";
+export { BUILT_IN_MARKETPLACES, builtInSourceRefusal, isBuiltInMarketplaceName, } from "./client/builtin.js";
+export { isReleaseVersion } from "./client/release.js";
+export { rerootSingleDirectory, stripDirectoryPrefix } from "./client/reroot.js";
 export { GITHUB_SOURCE_SHAPE, INSTALL_REF_SHAPE, OFFICIAL_MARKETPLACE_NAME, describeGitHubSource, formatInstallRef, isOwnerRepo, looksLikePath, parseGitHubSource, parseInstallRef, } from "./client/refs.js";
 export { DIALECT_LABELS } from "./client/vocabulary.js";
 //# sourceMappingURL=client.js.map

package/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAGL,OAAO,EACP,MAAM,EACN,WAAW,EACX,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,GACb,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,EAAgB,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAKL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAKL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,OAAO,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACrD,OAAO,EAGL,OAAO,EACP,MAAM,EACN,WAAW,EACX,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,YAAY,GACb,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,WAAW,EAAgB,YAAY,EAAE,MAAM,4BAA4B,CAAC;AACrF,OAAO,EAKL,iBAAiB,EACjB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAML,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAEL,qBAAqB,EACrB,oBAAoB,EACpB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACjF,OAAO,EAKL,mBAAmB,EACnB,iBAAiB,EACjB,yBAAyB,EACzB,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,aAAa,EACb,iBAAiB,EACjB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC"}

package/index.d.ts

@@ -18,7 +18,7 @@ export { PLACEHOLDER_PATTERN, VARIABLE_NAME_PATTERN } from "./placeholders.js";
 export type { Finding, FindingContext, PluginErrorKind, PluginFinding, PluginFindingKind, PluginReadOutcome, PluginWarningKind, } from "./outcome.js";
 export { MARKETPLACE_LOCATIONS } from "./marketplace/messages.js";
 export type { Marketplace, MarketplaceDialect, MarketplaceEntry, MarketplaceErrorKind, MarketplaceFinding, MarketplaceFindingKind, MarketplaceOwner, MarketplaceReadOutcome, MarketplaceWarningKind, } from "./marketplace/outcome.js";
-export { hasMarketplaceFile, readMarketplace } from "./marketplace/read-marketplace.js";
+export { hasMarketplaceFile, readMarketplace, readMarketplaceFile } from "./marketplace/read-marketplace.js";
 export { readPluginPackage } from "./read-plugin-package.js";
 export type { IgnoredComponent, IgnoredComponentKind, ModelAlias, ModelHint, OverlayDocument, OverlayNamedDocument, OverlayServerDocument, PluginAuthor, PluginDialect, PluginMcpServer, PluginPackage, PluginSkill, PluginSubAgent, PluginVariable, StigmerOverlay, } from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,SAAS,EACT,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,EACb,WAAW,EACX,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,EACnB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,eAAe,EACpB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC/E,YAAY,EACV,OAAO,EACP,cAAc,EACd,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,gBAAgB,EAChB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACtB,gBAAgB,EAChB,sBAAsB,EACtB,sBAAsB,GACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EACV,gBAAgB,EAChB,oBAAoB,EACpB,UAAU,EACV,SAAS,EACT,eAAe,EACf,oBAAoB,EACpB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,aAAa,EACb,WAAW,EACX,cAAc,EACd,cAAc,EACd,cAAc,GACf,MAAM,YAAY,CAAC"}

package/index.js

@@ -16,6 +16,6 @@ export { AGENT_PLUGINS_MANIFEST_SCHEMA, AGENT_PLUGINS_MCP_SCHEMA, errorMessage,
 export { SUB_AGENT_INSTRUCTIONS_MIN, classifyModel } from "./normalise/sub-agents.js";
 export { PLACEHOLDER_PATTERN, VARIABLE_NAME_PATTERN } from "./placeholders.js";
 export { MARKETPLACE_LOCATIONS } from "./marketplace/messages.js";
-export { hasMarketplaceFile, readMarketplace } from "./marketplace/read-marketplace.js";
+export { hasMarketplaceFile, readMarketplace, readMarketplaceFile } from "./marketplace/read-marketplace.js";
 export { readPluginPackage } from "./read-plugin-package.js";
 //# sourceMappingURL=index.js.map

package/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAU/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAYlE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACxF,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,eAAe,EACf,sBAAsB,EACtB,mBAAmB,GAKpB,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,6BAA6B,EAC7B,wBAAwB,EACxB,YAAY,EACZ,WAAW,EACX,kBAAkB,EAClB,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,0BAA0B,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AACtF,OAAO,EAAE,mBAAmB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAU/E,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAYlE,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mCAAmC,CAAC;AAC7G,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC"}

package/marketplace/read-marketplace.d.ts

@@ -25,10 +25,23 @@
  * `readPluginPackage`; a consumer that wants to install it hands the same
  * directory to the walker it already uses. Keeping the two reads apart is
  * what lets a catalogue of eighty entries be listed without eighty reads.
+ *
+ * `readMarketplaceFile` is the same read without the tree: what the file
+ * declares, for a client that holds the file alone and asks only "does this
+ * source offer a plugin called X" before it pays for the tree (the CLI's
+ * bare-name search across GitHub sources fetches one small file per source
+ * instead of a zipball each). Whether the tree holds an entry is still
+ * `readMarketplace`'s to say, on the tree, before anything is installed.
  */
 import { type PluginFiles } from "../files.js";
 import type { MarketplaceReadOutcome } from "./outcome.js";
 /** True when the tree holds any of the four marketplace files; the CLI's routing test. */
 export declare function hasMarketplaceFile(paths: Iterable<string>): boolean;
 export declare function readMarketplace(files: PluginFiles): MarketplaceReadOutcome;
+/**
+ * The marketplace file as declared, the tree unverified: every entry with a
+ * readable source is offered, whether or not `files` holds its directory.
+ * For a client that has fetched the file alone; never for an install.
+ */
+export declare function readMarketplaceFile(files: PluginFiles): MarketplaceReadOutcome;
 //# sourceMappingURL=read-marketplace.d.ts.map

package/marketplace/read-marketplace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-marketplace.d.ts","sourceRoot":"","sources":["../../src/marketplace/read-marketplace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAAwE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAErH,OAAO,KAAK,EAAuE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAQhI,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,CAInE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,sBAAsB,CAiC1E"}
+{"version":3,"file":"read-marketplace.d.ts","sourceRoot":"","sources":["../../src/marketplace/read-marketplace.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAIH,OAAO,EAAwE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAErH,OAAO,KAAK,EAAuE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AAQhI,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,OAAO,CAInE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,sBAAsB,CAE1E;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,sBAAsB,CAE9E"}