@webboxes/plugin-hub 0.0.0-stage → 0.1.0

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,qCAAqC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,sIAAsI;IACtI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,8IAA8I;IAC9I,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAA;IAC/D,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAC9B;AAED,MAAM,WAAW,aAAc,SAAQ,WAAW;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,oCAAoC;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAOD,qBAAa,kBAAmB,SAAQ,KAAK;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM;gBAA5C,UAAU,EAAE,MAAM,EAAW,OAAO,EAAE,MAAM;CAIlE;AAYD,qBAAa,WAAW;IACV,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM;IAEjC,OAAO,KAAK,SAAS,GAAmD;IAExE,OAAO,CAAC,IAAI;IAOZ,wEAAwE;IACxE,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM;IAKlD;;;OAGG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,UAAU,CAAC,EAAE,GAAG,OAAa,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;KAAE;IAgB3L,qIAAqI;IACrI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAa9D,mDAAmD;IACnD,IAAI,IAAI,aAAa,EAAE;CAgBxB"}

package/dist/store.js

@@ -0,0 +1,112 @@
+// The local plugin store (spec 044 lifecycle.md, "Save" and "Pull"): every version saved or pulled on this machine, as its tarball plus a record,
+// under one folder of the app instance's home. Any app instance on the machine can install from it offline, and a rollback is a pull of an
+// older version from it. A version is kept once: the same name and version with different content is refused, never overwritten.
+//
+//   <root>/index.json                      { formatVersion: 1, plugins: { "<name>": { "<version>": StoreRecord } } }
+//   <root>/<@owner>/<name>/<version>.tgz   (unscoped: <root>/<name>/<version>.tgz)
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { parsePluginName, storeDirectoryOf } from './name.js';
+import { integrityOf } from './tarball.js';
+import { compareVersions, newestVersion, parseVersion } from './version.js';
+export class StoreConflictError extends Error {
+    pluginName;
+    version;
+    constructor(pluginName, version) {
+        super(`${pluginName}@${version} is already in the store with different content; a version is kept once, so give the change a new version`);
+        this.pluginName = pluginName;
+        this.version = version;
+        this.name = 'StoreConflictError';
+    }
+}
+function writeAtomic(path, bytes) {
+    mkdirSync(dirname(path), { recursive: true });
+    const temporary = `${path}.${process.pid}.${Date.now()}.tmp`;
+    writeFileSync(temporary, bytes);
+    try {
+        renameSync(temporary, path);
+    }
+    catch (cause) {
+        rmSync(temporary, { force: true });
+        throw cause;
+    }
+}
+export class PluginStore {
+    root;
+    constructor(root) {
+        this.root = root;
+    }
+    get indexPath() { return join(this.root, 'index.json'); }
+    read() {
+        if (!existsSync(this.indexPath))
+            return { formatVersion: 1, plugins: {} };
+        const parsed = JSON.parse(readFileSync(this.indexPath, 'utf8'));
+        if (parsed.formatVersion !== 1 || typeof parsed.plugins !== 'object' || parsed.plugins === null)
+            throw new Error(`${this.indexPath} is not a plugin store index (formatVersion 1)`);
+        return { formatVersion: 1, plugins: parsed.plugins };
+    }
+    /** Where a version's tarball lives, whether or not it is stored yet. */
+    tarballPath(name, version) {
+        if (parseVersion(version) === undefined)
+            throw new Error(`${JSON.stringify(version)} is not a semantic version`);
+        return join(this.root, ...storeDirectoryOf(parsePluginName(name)), `${version}.tgz`);
+    }
+    /**
+     * Keep a tarball. Storing the same bytes again is a no-op (`added: false`); different bytes under a stored version are refused.
+     * The tarball is written before the index, so an interrupted put leaves at most an unlisted file, never a listed version without one.
+     */
+    put(name, version, tarball, record, now = new Date()) {
+        const integrity = integrityOf(tarball);
+        const index = this.read();
+        const existing = index.plugins[name]?.[version];
+        const path = this.tarballPath(name, version);
+        if (existing !== undefined) {
+            if (existing.integrity !== integrity)
+                throw new StoreConflictError(name, version);
+            if (existsSync(path))
+                return { added: false, stored: { name, version, path, ...existing } };
+        }
+        writeAtomic(path, tarball);
+        const full = { ...record, integrity, storedAt: (existing?.storedAt ?? now.toISOString()) };
+        const plugins = { ...index.plugins, [name]: { ...index.plugins[name], [version]: full } };
+        writeAtomic(this.indexPath, `${JSON.stringify({ formatVersion: 1, plugins }, null, 2)}\n`);
+        return { added: true, stored: { name, version, path, ...full } };
+    }
+    /** One version, or the newest when no version is given. A listed version whose file is gone or changed is reported, not returned. */
+    get(name, version) {
+        const versions = this.read().plugins[name];
+        if (versions === undefined)
+            return undefined;
+        const chosen = version ?? newestVersion(Object.keys(versions));
+        if (chosen === undefined)
+            return undefined;
+        const record = versions[chosen];
+        if (record === undefined)
+            return undefined;
+        const path = this.tarballPath(name, chosen);
+        if (!existsSync(path))
+            throw new Error(`the store lists ${name}@${chosen} but its file ${path} is missing`);
+        if (integrityOf(readFileSync(path)) !== record.integrity)
+            throw new Error(`the stored file of ${name}@${chosen} no longer matches its checksum; pull it again`);
+        return { name, version: chosen, path, ...record };
+    }
+    /** Every stored version, by name, newest first. */
+    list() {
+        const out = [];
+        const index = this.read();
+        for (const name of Object.keys(index.plugins).sort()) {
+            const versions = index.plugins[name] ?? {};
+            const ordered = Object.keys(versions).flatMap(text => {
+                const parsed = parseVersion(text);
+                return parsed === undefined ? [] : [parsed];
+            }).sort((a, b) => compareVersions(b, a));
+            for (const version of ordered) {
+                const record = versions[version.text];
+                if (record !== undefined)
+                    out.push({ name, version: version.text, path: this.tarballPath(name, version.text), ...record });
+            }
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,kJAAkJ;AAClJ,2IAA2I;AAC3I,iIAAiI;AACjI,EAAE;AACF,qHAAqH;AACrH,mFAAmF;AACnF,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAChG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAC7D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AA0B3E,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IACtB;IAA6B;IAAlD,YAAqB,UAAkB,EAAW,OAAe;QAC/D,KAAK,CAAC,GAAG,UAAU,IAAI,OAAO,2GAA2G,CAAC,CAAA;QADvH,eAAU,GAAV,UAAU,CAAQ;QAAW,YAAO,GAAP,OAAO,CAAQ;QAE/D,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAA;IAClC,CAAC;CACF;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAA0B;IAC3D,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC7C,MAAM,SAAS,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAA;IAC5D,aAAa,CAAC,SAAS,EAAE,KAAK,CAAC,CAAA;IAC/B,IAAI,CAAC;QAAC,UAAU,CAAC,SAAS,EAAE,IAAI,CAAC,CAAA;IAAC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACjD,MAAM,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;QAClC,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,MAAM,OAAO,WAAW;IACD;IAArB,YAAqB,IAAY;QAAZ,SAAI,GAAJ,IAAI,CAAQ;IAAG,CAAC;IAErC,IAAY,SAAS,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAA,CAAC,CAAC;IAEhE,IAAI;QACV,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAA;QACzE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAwB,CAAA;QACtF,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,gDAAgD,CAAC,CAAA;QACnL,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAA;IACtD,CAAC;IAED,wEAAwE;IACxE,WAAW,CAAC,IAAY,EAAE,OAAe;QACvC,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAA;QAChH,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,gBAAgB,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,OAAO,MAAM,CAAC,CAAA;IACtF,CAAC;IAED;;;OAGG;IACH,GAAG,CAAC,IAAY,EAAE,OAAe,EAAE,OAAmB,EAAE,MAAmD,EAAE,GAAG,GAAG,IAAI,IAAI,EAAE;QAC3H,MAAM,SAAS,GAAG,WAAW,CAAC,OAAO,CAAC,CAAA;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,CAAA;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC5C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,SAAS,KAAK,SAAS;gBAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YACjF,IAAI,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,EAAE,CAAA;QAC7F,CAAC;QACD,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;QAC1B,MAAM,IAAI,GAAgB,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC,EAAE,CAAA;QACvG,MAAM,OAAO,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,CAAA;QACzF,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QAC1F,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,CAAA;IAClE,CAAC;IAED,qIAAqI;IACrI,GAAG,CAAC,IAAY,EAAE,OAAgB;QAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;QAC1C,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC5C,MAAM,MAAM,GAAG,OAAO,IAAI,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAA;QAC9D,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC1C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;QAC/B,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,SAAS,CAAA;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,CAAA;QAC3C,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,IAAI,MAAM,iBAAiB,IAAI,aAAa,CAAC,CAAA;QAC3G,IAAI,WAAW,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,KAAK,MAAM,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,IAAI,MAAM,gDAAgD,CAAC,CAAA;QAC/J,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAA;IACnD,CAAC;IAED,mDAAmD;IACnD,IAAI;QACF,MAAM,GAAG,GAAoB,EAAE,CAAA;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;YAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE;gBACnD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;gBACjC,OAAO,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;YAC7C,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YACxC,KAAK,MAAM,OAAO,IAAI,OAAO,EAAE,CAAC;gBAC9B,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAA;gBACrC,IAAI,MAAM,KAAK,SAAS;oBAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAA;YAC5H,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAA;IACZ,CAAC;CACF"}

package/dist/tarball.d.ts

@@ -0,0 +1,16 @@
+export interface TarballFile {
+    /** Path inside the package, with `/` separators and no `package/` prefix. */
+    readonly path: string;
+    readonly content: Uint8Array;
+    readonly executable?: boolean;
+}
+/** Pack files into a gzipped tarball, `package/` prefixed and sorted by path. */
+export declare function writeTarball(files: readonly TarballFile[]): Buffer;
+/**
+ * Read a gzipped tarball's regular files, with the first path level (`package/` in an npm tarball) removed. Directory, link and global entries
+ * are skipped; a path that would leave the package (`..`, absolute) is refused, so a crafted tarball cannot point outside it.
+ */
+export declare function readTarball(gzipped: Uint8Array, maxBytes?: number): TarballFile[];
+/** The Subresource Integrity form npm and pnpm record: `sha512-<base64>`. */
+export declare function integrityOf(bytes: Uint8Array): string;
+//# sourceMappingURL=tarball.d.ts.map

package/dist/tarball.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.d.ts","sourceRoot":"","sources":["../src/tarball.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,WAAW;IAC1B,6EAA6E;IAC7E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,UAAU,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAC9B;AAkDD,iFAAiF;AACjF,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAgBlE;AAuBD;;;GAGG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,SAAmB,GAAG,WAAW,EAAE,CA0B3F;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAErD"}

package/dist/tarball.js

@@ -0,0 +1,138 @@
+// The tarball every plugin travels as (spec 044 lifecycle.md, "One unit: the tarball"): a gzipped ustar archive whose files sit under
+// `package/`, the layout `npm pack` writes and pnpm, npm and DSH's installer read. Written here rather than by `npm pack`, because the shipped
+// app has no npm; and written deterministically (sorted entries, fixed times and owners, a fixed gzip header), so the same files always give
+// the same sha512 on every system and a re-pack of unchanged source is recognised as the same version.
+import { createHash } from 'node:crypto';
+import { gunzipSync, gzipSync } from 'node:zlib';
+/** npm's fixed time for every packed file (1985-10-26T08:15:00Z), so packs do not differ by when they were made. */
+const FIXED_MTIME = 499_162_500;
+const BLOCK = 512;
+/** Byte 9 of a gzip header names the operating system; zlib writes a different one per platform, which would change the checksum. */
+const GZIP_OS_BYTE = 9;
+const GZIP_OS_UNIX = 3;
+function writeString(header, offset, length, value) {
+    const bytes = Buffer.from(value, 'utf8');
+    if (bytes.length > length)
+        throw new Error(`tar header field too long: ${value}`);
+    header.set(bytes, offset);
+}
+function writeOctal(header, offset, length, value) {
+    writeString(header, offset, length, `${value.toString(8).padStart(length - 1, '0')}\0`);
+}
+/** Split a long path into ustar's 155-byte prefix and 100-byte name at a `/`. */
+function splitPath(path) {
+    if (Buffer.byteLength(path) <= 100)
+        return { prefix: '', name: path };
+    for (let index = path.indexOf('/'); index !== -1; index = path.indexOf('/', index + 1)) {
+        const prefix = path.slice(0, index);
+        const name = path.slice(index + 1);
+        if (Buffer.byteLength(prefix) <= 155 && Buffer.byteLength(name) <= 100)
+            return { prefix, name };
+    }
+    throw new Error(`path too long to pack: ${path}`);
+}
+function header(path, size, mode) {
+    const block = new Uint8Array(BLOCK);
+    const { prefix, name } = splitPath(path);
+    writeString(block, 0, 100, name);
+    writeOctal(block, 100, 8, mode);
+    writeOctal(block, 108, 8, 0);
+    writeOctal(block, 116, 8, 0);
+    writeOctal(block, 124, 12, size);
+    writeOctal(block, 136, 12, FIXED_MTIME);
+    block.fill(0x20, 148, 156);
+    block[156] = 0x30;
+    writeString(block, 257, 6, 'ustar\0');
+    writeString(block, 263, 2, '00');
+    writeString(block, 345, 155, prefix);
+    let sum = 0;
+    for (const byte of block)
+        sum += byte;
+    writeString(block, 148, 8, `${sum.toString(8).padStart(6, '0')}\0 `);
+    return block;
+}
+/** Pack files into a gzipped tarball, `package/` prefixed and sorted by path. */
+export function writeTarball(files) {
+    const sorted = [...files].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    const chunks = [];
+    const seen = new Set();
+    for (const file of sorted) {
+        if (seen.has(file.path))
+            throw new Error(`duplicate path in package: ${file.path}`);
+        seen.add(file.path);
+        chunks.push(header(`package/${file.path}`, file.content.length, file.executable === true ? 0o755 : 0o644));
+        chunks.push(file.content);
+        const pad = (BLOCK - (file.content.length % BLOCK)) % BLOCK;
+        if (pad > 0)
+            chunks.push(new Uint8Array(pad));
+    }
+    chunks.push(new Uint8Array(BLOCK * 2));
+    const gzipped = gzipSync(Buffer.concat(chunks), { level: 9 });
+    gzipped[GZIP_OS_BYTE] = GZIP_OS_UNIX;
+    return gzipped;
+}
+function readString(block, offset, length) {
+    const slice = block.subarray(offset, offset + length);
+    const end = slice.indexOf(0);
+    return Buffer.from(end === -1 ? slice : slice.subarray(0, end)).toString('utf8');
+}
+function readOctal(block, offset, length) {
+    const text = readString(block, offset, length).trim();
+    return text === '' ? 0 : Number.parseInt(text, 8);
+}
+/** Paths a pax extended header sets (`path=...`), the form `npm pack` uses for long names. */
+function paxPath(content) {
+    const text = Buffer.from(content).toString('utf8');
+    for (const record of text.split('\n')) {
+        const match = /^\d+ path=(.*)$/u.exec(record);
+        if (match?.[1] !== undefined)
+            return match[1];
+    }
+    return undefined;
+}
+/**
+ * Read a gzipped tarball's regular files, with the first path level (`package/` in an npm tarball) removed. Directory, link and global entries
+ * are skipped; a path that would leave the package (`..`, absolute) is refused, so a crafted tarball cannot point outside it.
+ */
+export function readTarball(gzipped, maxBytes = 64 * 1024 * 1024) {
+    const archive = gunzipSync(gzipped, { maxOutputLength: maxBytes });
+    const files = [];
+    let offset = 0;
+    let nextPath;
+    while (offset + BLOCK <= archive.length) {
+        const block = archive.subarray(offset, offset + BLOCK);
+        if (block.every(byte => byte === 0))
+            break;
+        const size = readOctal(block, 124, 12);
+        const type = String.fromCharCode(block[156] ?? 0);
+        const prefix = readString(block, 345, 155);
+        const name = readString(block, 0, 100);
+        const content = archive.subarray(offset + BLOCK, offset + BLOCK + size);
+        offset += BLOCK + Math.ceil(size / BLOCK) * BLOCK;
+        if (type === 'x') {
+            nextPath = paxPath(content);
+            continue;
+        }
+        if (type === 'L') {
+            nextPath = Buffer.from(content).toString('utf8').replace(/\0+$/u, '');
+            continue;
+        }
+        const fullPath = nextPath ?? (prefix === '' ? name : `${prefix}/${name}`);
+        nextPath = undefined;
+        if (type !== '0' && type !== '\0')
+            continue;
+        const parts = fullPath.split('/').filter(part => part !== '' && part !== '.');
+        if (fullPath.startsWith('/') || parts.includes('..'))
+            throw new Error(`tarball entry leaves the package: ${fullPath}`);
+        const path = parts.slice(1).join('/');
+        if (path === '')
+            continue;
+        files.push({ path, content: new Uint8Array(content), executable: (readOctal(block, 100, 8) & 0o111) !== 0 });
+    }
+    return files;
+}
+/** The Subresource Integrity form npm and pnpm record: `sha512-<base64>`. */
+export function integrityOf(bytes) {
+    return `sha512-${createHash('sha512').update(bytes).digest('base64')}`;
+}
+//# sourceMappingURL=tarball.js.map

package/dist/tarball.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tarball.js","sourceRoot":"","sources":["../src/tarball.ts"],"names":[],"mappings":"AAAA,sIAAsI;AACtI,+IAA+I;AAC/I,6IAA6I;AAC7I,uGAAuG;AACvG,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACxC,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AAShD,oHAAoH;AACpH,MAAM,WAAW,GAAG,WAAW,CAAA;AAC/B,MAAM,KAAK,GAAG,GAAG,CAAA;AACjB,qIAAqI;AACrI,MAAM,YAAY,GAAG,CAAC,CAAA;AACtB,MAAM,YAAY,GAAG,CAAC,CAAA;AAEtB,SAAS,WAAW,CAAC,MAAkB,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa;IACpF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;IACxC,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAA;IACjF,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAA;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,MAAkB,EAAE,MAAc,EAAE,MAAc,EAAE,KAAa;IACnF,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;AACzF,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,IAAY;IAC7B,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG;QAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACrE,KAAK,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACvF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAA;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QAClC,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG;YAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;IACjG,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,0BAA0B,IAAI,EAAE,CAAC,CAAA;AACnD,CAAC;AAED,SAAS,MAAM,CAAC,IAAY,EAAE,IAAY,EAAE,IAAY;IACtD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,CAAA;IACnC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,SAAS,CAAC,IAAI,CAAC,CAAA;IACxC,WAAW,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;IAChC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAC/B,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5B,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5B,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,CAAA;IAChC,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,WAAW,CAAC,CAAA;IACvC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;IAC1B,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAA;IACjB,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;IACrC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,CAAC,CAAA;IAChC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;IACpC,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,IAAI,IAAI,CAAA;IACrC,WAAW,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAA;IACpE,OAAO,KAAK,CAAA;AACd,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,YAAY,CAAC,KAA6B;IACxD,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IAC1F,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACnF,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACnB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;QAC1G,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACzB,MAAM,GAAG,GAAG,CAAC,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,CAAC,GAAG,KAAK,CAAA;QAC3D,IAAI,GAAG,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;IACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;IAC7D,OAAO,CAAC,YAAY,CAAC,GAAG,YAAY,CAAA;IACpC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAiB,EAAE,MAAc,EAAE,MAAc;IACnE,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAA;IACrD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC5B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;AAClF,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB,EAAE,MAAc,EAAE,MAAc;IAClE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;IACrD,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;AACnD,CAAC;AAED,8FAA8F;AAC9F,SAAS,OAAO,CAAC,OAAmB;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAClD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC7C,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,OAAmB,EAAE,QAAQ,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI;IAC1E,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,QAAQ,EAAE,CAAC,CAAA;IAClE,MAAM,KAAK,GAAkB,EAAE,CAAA;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAA;IACd,IAAI,QAA4B,CAAA;IAChC,OAAO,MAAM,GAAG,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,KAAK,CAAC,CAAA;QACtD,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,MAAK;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAA;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAA;QAC1C,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAA;QACtC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,KAAK,EAAE,MAAM,GAAG,KAAK,GAAG,IAAI,CAAC,CAAA;QACvE,MAAM,IAAI,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,KAAK,CAAA;QACjD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;YAAC,SAAQ;QAAC,CAAC;QAC3D,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YAAC,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAAC,SAAQ;QAAC,CAAC;QACrG,MAAM,QAAQ,GAAG,QAAQ,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAA;QACzE,QAAQ,GAAG,SAAS,CAAA;QACpB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,IAAI;YAAE,SAAQ;QAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,IAAI,KAAK,GAAG,CAAC,CAAA;QAC7E,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,QAAQ,EAAE,CAAC,CAAA;QACtH,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,IAAI,KAAK,EAAE;YAAE,SAAQ;QACzB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,UAAU,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC9G,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,OAAO,UAAU,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAA;AACxE,CAAC"}

package/dist/version.d.ts

@@ -0,0 +1,16 @@
+export interface Version {
+    readonly major: number;
+    readonly minor: number;
+    readonly patch: number;
+    readonly prerelease: readonly string[];
+    readonly text: string;
+}
+export declare function parseVersion(text: string): Version | undefined;
+/** Semver precedence: negative when `a` is older than `b`. Build metadata is ignored, as semver says. */
+export declare function compareVersions(a: Version, b: Version): number;
+/** The newest of some version strings; ones that are not semver are ignored. */
+export declare function newestVersion(texts: Iterable<string>): string | undefined;
+export type VersionBump = 'patch' | 'minor' | 'major';
+/** The next version for a fix (`patch`), a feature (`minor`) or a breaking change (`major`). A prerelease is released as itself on `patch`. */
+export declare function bumpVersion(text: string, bump: VersionBump): string;
+//# sourceMappingURL=version.d.ts.map

package/dist/version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.d.ts","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;IACtC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,CAU9D;AAUD,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,MAAM,CAc9D;AAED,gFAAgF;AAChF,wBAAgB,aAAa,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG,MAAM,GAAG,SAAS,CAOzE;AAED,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAA;AAErD,+IAA+I;AAC/I,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,GAAG,MAAM,CAOnE"}

package/dist/version.js

@@ -0,0 +1,69 @@
+// Semantic versions, only as far as the hub needs them: validating a version, ordering versions to find the newest, and bumping one for a fix.
+const SEMVER = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/u;
+export function parseVersion(text) {
+    const match = SEMVER.exec(text.trim());
+    if (match === null)
+        return undefined;
+    return {
+        major: Number(match[1]),
+        minor: Number(match[2]),
+        patch: Number(match[3]),
+        prerelease: match[4] === undefined ? [] : match[4].split('.'),
+        text: text.trim(),
+    };
+}
+function compareIdentifiers(a, b) {
+    const numeric = /^\d+$/u;
+    if (numeric.test(a) && numeric.test(b))
+        return Number(a) - Number(b);
+    if (numeric.test(a))
+        return -1;
+    if (numeric.test(b))
+        return 1;
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+/** Semver precedence: negative when `a` is older than `b`. Build metadata is ignored, as semver says. */
+export function compareVersions(a, b) {
+    for (const key of ['major', 'minor', 'patch']) {
+        if (a[key] !== b[key])
+            return a[key] - b[key];
+    }
+    if (a.prerelease.length === 0 || b.prerelease.length === 0)
+        return b.prerelease.length - a.prerelease.length;
+    for (let index = 0; index < Math.max(a.prerelease.length, b.prerelease.length); index += 1) {
+        const left = a.prerelease[index];
+        const right = b.prerelease[index];
+        if (left === undefined)
+            return -1;
+        if (right === undefined)
+            return 1;
+        const order = compareIdentifiers(left, right);
+        if (order !== 0)
+            return order;
+    }
+    return 0;
+}
+/** The newest of some version strings; ones that are not semver are ignored. */
+export function newestVersion(texts) {
+    let newest;
+    for (const text of texts) {
+        const version = parseVersion(text);
+        if (version !== undefined && (newest === undefined || compareVersions(version, newest) > 0))
+            newest = version;
+    }
+    return newest?.text;
+}
+/** The next version for a fix (`patch`), a feature (`minor`) or a breaking change (`major`). A prerelease is released as itself on `patch`. */
+export function bumpVersion(text, bump) {
+    const version = parseVersion(text);
+    if (version === undefined)
+        throw new Error(`${JSON.stringify(text)} is not a semantic version`);
+    if (bump === 'major')
+        return `${version.major + 1}.0.0`;
+    if (bump === 'minor')
+        return `${version.major}.${version.minor + 1}.0`;
+    if (version.prerelease.length > 0)
+        return `${version.major}.${version.minor}.${version.patch}`;
+    return `${version.major}.${version.minor}.${version.patch + 1}`;
+}
+//# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA,+IAA+I;AAE/I,MAAM,MAAM,GAAG,8HAA8H,CAAA;AAU7I,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;IACtC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IACpC,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvB,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;QAC7D,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE;KAClB,CAAA;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAS,EAAE,CAAS;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAA;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,CAAA;IAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AACnC,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,CAAU;IACpD,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QACvD,IAAI,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC;YAAE,OAAO,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAA;IAC5G,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAA;QACjC,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAA;QACjC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,CAAA;QACjC,MAAM,KAAK,GAAG,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;QAC7C,IAAI,KAAK,KAAK,CAAC;YAAE,OAAO,KAAK,CAAA;IAC/B,CAAC;IACD,OAAO,CAAC,CAAA;AACV,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,KAAuB;IACnD,IAAI,MAA2B,CAAA;IAC/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAAE,MAAM,GAAG,OAAO,CAAA;IAC/G,CAAC;IACD,OAAO,MAAM,EAAE,IAAI,CAAA;AACrB,CAAC;AAID,+IAA+I;AAC/I,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAiB;IACzD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,OAAO,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;IAC/F,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC,MAAM,CAAA;IACvD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,IAAI,CAAA;IACtE,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,EAAE,CAAA;IAC9F,OAAO,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAA;AACjE,CAAC"}

package/package.json

@@ -1,6 +1,47 @@
 {
   "name": "@webboxes/plugin-hub",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Saving, sharing and pulling Cordis plugins: dotted plugin names, the source argument, deterministic packing with sha512, the local plugin store, and the pull pipeline. Host-independent: no Cordis, DSH or surface dependencies.",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/acryldev/acryl.git",
+    "directory": "runtime/plugin-hub"
+  },
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "engines": {
+    "node": "^22.19.0 || >=24.0.0"
+  },
+  "dependencies": {
+    "@webboxes/app-persistence": "0.1.0"
+  },
+  "devDependencies": {
+    "@types/node": "22.20.1",
+    "typescript": "6.0.3",
+    "vitest": "4.1.11"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit && tsc -p tsconfig.test.json",
+    "test": "vitest run",
+    "check": "pnpm run build && pnpm run typecheck && pnpm run test"
+  }
 }