@webboxes/plugin-hub 0.0.0-stage → 0.2.0

package/dist/name.d.ts

@@ -0,0 +1,31 @@
+export interface PluginName {
+    /** The full name as npm and the profile's package.json spell it. */
+    readonly full: string;
+    /** The scope without `@` (the GitHub owner or npm scope), or undefined for an unscoped name. */
+    readonly owner?: string;
+    /** The name after the scope. */
+    readonly local: string;
+    /**
+     * The levels of the author's tree. Undefined when a level is not a plain segment (an older name such as `socket.io-client` or one with `_`):
+     * such a name is valid and installable, it just has no tree.
+     */
+    readonly path?: readonly string[];
+}
+export declare class InvalidPluginNameError extends Error {
+    readonly input: string;
+    readonly reason: string;
+    constructor(input: string, reason: string);
+}
+/** Read a plugin name. Throws for anything npm or DSH's installer would refuse. */
+export declare function parsePluginName(input: string): PluginName;
+/**
+ * Build a name from an owner and the levels of a tree, refusing a level that would make the dots ambiguous.
+ * `pluginNameOf('inboxxobni', ['accounting-app-aurora', 'sidebar', 'date-filter'])` is `@inboxxobni/accounting-app-aurora.sidebar.date-filter`.
+ */
+export declare function pluginNameOf(owner: string | undefined, path: readonly string[]): PluginName;
+/**
+ * The directory a name is kept under in a store: `@owner/a.b` becomes `@owner/a.b`, an unscoped `a.b` stays `a.b`. Both parts are already
+ * valid file names on every system (lowercase, no reserved characters).
+ */
+export declare function storeDirectoryOf(name: PluginName): readonly string[];
+//# sourceMappingURL=name.d.ts.map

package/dist/name.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"name.d.ts","sourceRoot":"","sources":["../src/name.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,gGAAgG;IAChG,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,gCAAgC;IAChC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAtC,KAAK,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAI5D;AAED,mFAAmF;AACnF,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAYzD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,UAAU,CAM3F;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,UAAU,GAAG,SAAS,MAAM,EAAE,CAEpE"}

package/dist/name.js

@@ -0,0 +1,57 @@
+// A plugin's name (spec 044 lifecycle.md, D9): an npm package name with exactly one level of scope, whose dots are levels of the author's own tree.
+// `@inboxxobni/accounting-app-aurora.sidebar.date-filter` is owner `inboxxobni`, path `accounting-app-aurora` > `sidebar` > `date-filter`.
+// npm, pnpm, DSH's installer and GitHub all accept this form, so the dotted name is the one form everywhere: typed, shown, published.
+/** One level of the tree: lowercase letters, digits and hyphens, starting with a letter or digit. A dot is never part of a segment. */
+const SEGMENT = /^[a-z0-9][a-z0-9-]*$/u;
+/** What npm and DSH's installer accept (`PACKAGE_NAME` in `@deepseek-ai/dsh-plugin-manager`'s install-spec.ts). */
+const NPM_NAME = /^(?:@[a-z0-9][a-z0-9._~-]*\/)?[a-z0-9][a-z0-9._~-]*$/u;
+const NPM_NAME_MAX_LENGTH = 214;
+export class InvalidPluginNameError extends Error {
+    input;
+    reason;
+    constructor(input, reason) {
+        super(`${JSON.stringify(input)} is not a plugin name: ${reason}`);
+        this.input = input;
+        this.reason = reason;
+        this.name = 'InvalidPluginNameError';
+    }
+}
+/** Read a plugin name. Throws for anything npm or DSH's installer would refuse. */
+export function parsePluginName(input) {
+    const full = input.trim();
+    if (full === '')
+        throw new InvalidPluginNameError(input, 'it is empty');
+    if (full.length > NPM_NAME_MAX_LENGTH)
+        throw new InvalidPluginNameError(input, `it is longer than ${NPM_NAME_MAX_LENGTH} characters`);
+    if (full !== full.toLowerCase())
+        throw new InvalidPluginNameError(input, 'npm accepts only lowercase names; write date-filter, not dateFilter');
+    if (!NPM_NAME.test(full))
+        throw new InvalidPluginNameError(input, 'use @owner/name with letters, digits, hyphens and dots, one "/" at most');
+    const slash = full.indexOf('/');
+    const owner = full.startsWith('@') ? full.slice(1, slash) : undefined;
+    const local = owner === undefined ? full : full.slice(slash + 1);
+    const levels = local.split('.');
+    const path = levels.every(level => SEGMENT.test(level)) ? levels : undefined;
+    return { full, local, ...(owner === undefined ? {} : { owner }), ...(path === undefined ? {} : { path }) };
+}
+/**
+ * Build a name from an owner and the levels of a tree, refusing a level that would make the dots ambiguous.
+ * `pluginNameOf('inboxxobni', ['accounting-app-aurora', 'sidebar', 'date-filter'])` is `@inboxxobni/accounting-app-aurora.sidebar.date-filter`.
+ */
+export function pluginNameOf(owner, path) {
+    if (path.length === 0)
+        throw new InvalidPluginNameError('', 'it needs at least one level');
+    for (const level of path) {
+        if (!SEGMENT.test(level))
+            throw new InvalidPluginNameError(level, 'a level is lowercase letters, digits and hyphens, with no dot');
+    }
+    return parsePluginName(`${owner === undefined ? '' : `@${owner}/`}${path.join('.')}`);
+}
+/**
+ * The directory a name is kept under in a store: `@owner/a.b` becomes `@owner/a.b`, an unscoped `a.b` stays `a.b`. Both parts are already
+ * valid file names on every system (lowercase, no reserved characters).
+ */
+export function storeDirectoryOf(name) {
+    return name.owner === undefined ? [name.local] : [`@${name.owner}`, name.local];
+}
+//# sourceMappingURL=name.js.map

package/dist/name.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"name.js","sourceRoot":"","sources":["../src/name.ts"],"names":[],"mappings":"AAAA,oJAAoJ;AACpJ,2IAA2I;AAC3I,sIAAsI;AAEtI,uIAAuI;AACvI,MAAM,OAAO,GAAG,uBAAuB,CAAA;AACvC,mHAAmH;AACnH,MAAM,QAAQ,GAAG,uDAAuD,CAAA;AACxE,MAAM,mBAAmB,GAAG,GAAG,CAAA;AAgB/B,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAC1B;IAAwB;IAA7C,YAAqB,KAAa,EAAW,MAAc;QACzD,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,0BAA0B,MAAM,EAAE,CAAC,CAAA;QAD9C,UAAK,GAAL,KAAK,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;QAEzD,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAA;IACtC,CAAC;CACF;AAED,mFAAmF;AACnF,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IACzB,IAAI,IAAI,KAAK,EAAE;QAAE,MAAM,IAAI,sBAAsB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;IACvE,IAAI,IAAI,CAAC,MAAM,GAAG,mBAAmB;QAAE,MAAM,IAAI,sBAAsB,CAAC,KAAK,EAAE,qBAAqB,mBAAmB,aAAa,CAAC,CAAA;IACrI,IAAI,IAAI,KAAK,IAAI,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,sBAAsB,CAAC,KAAK,EAAE,qEAAqE,CAAC,CAAA;IAC/I,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,KAAK,EAAE,yEAAyE,CAAC,CAAA;IAC5I,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;IACrE,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;IAChE,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAC5E,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AAC5G,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,KAAyB,EAAE,IAAuB;IAC7E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,sBAAsB,CAAC,EAAE,EAAE,6BAA6B,CAAC,CAAA;IAC1F,KAAK,MAAM,KAAK,IAAI,IAAI,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,sBAAsB,CAAC,KAAK,EAAE,+DAA+D,CAAC,CAAA;IACpI,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAA;AACvF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAgB;IAC/C,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;AACjF,CAAC"}

package/dist/npm-cli.d.ts

@@ -0,0 +1,11 @@
+import type { NpmPublishPort } from './npm-publish.js';
+import type { RegistryPort } from './pull.js';
+export declare function npmCli(): NpmPublishPort;
+/**
+ * A registry read through the user's npm, for a private registry or scope an anonymous request cannot see: `npm view` for the version and
+ * integrity, `npm pack` for the bytes. `registry` overrides the user's configuration; without it npm's own (scoped) configuration decides.
+ */
+export declare function npmRegistryViaCli(registry?: string): RegistryPort;
+/** Resolve from the first registry port that knows the package (anonymous https, then the user's npm), and download through that one. */
+export declare function firstRegistryPort(...ports: readonly RegistryPort[]): RegistryPort;
+//# sourceMappingURL=npm-cli.d.ts.map

package/dist/npm-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-cli.d.ts","sourceRoot":"","sources":["../src/npm-cli.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AACtD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAA;AAoB7C,wBAAgB,MAAM,IAAI,cAAc,CAavC;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CA2BjE;AAED,yIAAyI;AACzI,wBAAgB,iBAAiB,CAAC,GAAG,KAAK,EAAE,SAAS,YAAY,EAAE,GAAG,YAAY,CAgBjF"}

package/dist/npm-cli.js

@@ -0,0 +1,102 @@
+// npm through the user's own `npm` and its configuration (`.npmrc`: logins, scoped registries). Nothing here reads or stores a token; a missing
+// npm or login is reported with what to do.
+import { spawnSync } from 'node:child_process';
+import { mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { ToolError } from './github-cli.js';
+const shell = process.platform === 'win32';
+function npm(args, cwd) {
+    // On Windows npm is a .cmd file, which Node runs only through a shell; the arguments here are ours, never user text.
+    const result = spawnSync('npm', [...args], { cwd, encoding: 'utf8', shell, env: { ...process.env, npm_config_yes: 'true', npm_config_update_notifier: 'false' }, maxBuffer: 64 * 1024 * 1024 });
+    if (result.error !== undefined)
+        throw new ToolError('npm is not available here: install Node.js (https://nodejs.org), which includes npm, and sign in with: npm login');
+    return { status: result.status ?? 1, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+}
+function signInHint(registry) {
+    return `sign in with: npm login${registry === undefined ? '' : ` --registry ${registry}`}`;
+}
+function failure(what, stderr, registry) {
+    const last = stderr.trim().split('\n').filter(line => !/^npm (notice|warn)/iu.test(line)).at(-1) ?? '';
+    return new ToolError(`npm ${what} failed: ${last}${/E401|E403|ENEEDAUTH|need auth|unauthorized|login/iu.test(stderr) ? ` (${signInHint(registry)})` : ''}`);
+}
+export function npmCli() {
+    return {
+        hasVersion(name, version, registry) {
+            const result = npm(['view', `${name}@${version}`, 'version', '--registry', registry]);
+            if (result.status === 0)
+                return result.stdout.trim() !== '';
+            if (/E404|404 Not Found|is not in this registry/iu.test(result.stderr))
+                return false;
+            throw failure('view', result.stderr, registry);
+        },
+        publish(tarballPath, registry, access) {
+            const result = npm(['publish', tarballPath, '--registry', registry, '--access', access, '--ignore-scripts']);
+            if (result.status !== 0)
+                throw failure('publish', result.stderr, registry);
+        },
+    };
+}
+/**
+ * A registry read through the user's npm, for a private registry or scope an anonymous request cannot see: `npm view` for the version and
+ * integrity, `npm pack` for the bytes. `registry` overrides the user's configuration; without it npm's own (scoped) configuration decides.
+ */
+export function npmRegistryViaCli(registry) {
+    const flags = registry === undefined ? [] : ['--registry', registry];
+    return {
+        async resolve(name, version) {
+            const result = npm(['view', version === undefined ? name : `${name}@${version}`, 'version', 'dist.tarball', 'dist.integrity', '--json', ...flags]);
+            if (result.status !== 0) {
+                if (/E404|is not in this registry/iu.test(result.stderr))
+                    return undefined;
+                throw failure('view', result.stderr, registry);
+            }
+            const parsed = JSON.parse(result.stdout || 'null');
+            const view = Array.isArray(parsed) ? parsed.at(-1) : parsed;
+            if (view === null || view === undefined || typeof view['version'] !== 'string' || typeof view['dist.tarball'] !== 'string')
+                return undefined;
+            return { version: view['version'], tarball: `npm:${name}@${view['version']}`, ...(typeof view['dist.integrity'] === 'string' ? { integrity: view['dist.integrity'] } : {}) };
+        },
+        async download(spec) {
+            const work = mkdtempSync(join(tmpdir(), 'plugin-hub-npm-pack-'));
+            try {
+                const result = npm(['pack', spec.replace(/^npm:/u, ''), '--pack-destination', work, '--ignore-scripts', ...flags], work);
+                if (result.status !== 0)
+                    throw failure('pack', result.stderr, registry);
+                const file = readdirSync(work).find(entry => entry.endsWith('.tgz'));
+                if (file === undefined)
+                    throw new ToolError(`npm pack ${spec} wrote no tarball`);
+                return new Uint8Array(readFileSync(join(work, file)));
+            }
+            finally {
+                rmSync(work, { recursive: true, force: true });
+            }
+        },
+    };
+}
+/** Resolve from the first registry port that knows the package (anonymous https, then the user's npm), and download through that one. */
+export function firstRegistryPort(...ports) {
+    const answered = new Map();
+    return {
+        async resolve(name, version) {
+            let lastError;
+            for (const port of ports) {
+                try {
+                    const found = await port.resolve(name, version);
+                    if (found !== undefined) {
+                        answered.set(found.tarball, port);
+                        return found;
+                    }
+                }
+                catch (cause) {
+                    lastError = cause;
+                }
+            }
+            if (lastError !== undefined)
+                throw lastError;
+            return undefined;
+        },
+        download: async (url) => (answered.get(url) ?? ports[0]).download(url),
+    };
+}
+//# sourceMappingURL=npm-cli.js.map

package/dist/npm-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-cli.js","sourceRoot":"","sources":["../src/npm-cli.ts"],"names":[],"mappings":"AAAA,gJAAgJ;AAChJ,4CAA4C;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAI3C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAA;AAE1C,SAAS,GAAG,CAAC,IAAuB,EAAE,GAAY;IAChD,qHAAqH;IACrH,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,MAAM,EAAE,0BAA0B,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC,CAAA;IAC/L,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,kHAAkH,CAAC,CAAA;IACvK,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE,EAAE,CAAA;AACjG,CAAC;AAED,SAAS,UAAU,CAAC,QAA4B;IAC9C,OAAO,0BAA0B,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,QAAQ,EAAE,EAAE,CAAA;AAC5F,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,MAAc,EAAE,QAAiB;IAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACtG,OAAO,IAAI,SAAS,CAAC,OAAO,IAAI,YAAY,IAAI,GAAG,oDAAoD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AAC7J,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO;QACL,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ;YAChC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAA;YACrF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAA;YAC3D,IAAI,8CAA8C,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;gBAAE,OAAO,KAAK,CAAA;YACpF,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAChD,CAAC;QACD,OAAO,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM;YACnC,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAAA;YAC5G,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;QAC5E,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IACjD,MAAM,KAAK,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAA;IACpE,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO;YACzB,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,gBAAgB,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC,CAAC,CAAA;YAClJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxB,IAAI,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;oBAAE,OAAO,SAAS,CAAA;gBAC1E,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;YAChD,CAAC;YACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAA+D,CAAA;YAChH,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAA;YAC3D,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ;gBAAE,OAAO,SAAS,CAAA;YAC5I,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAA;QAC9K,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI;YACjB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,sBAAsB,CAAC,CAAC,CAAA;YAChE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,oBAAoB,EAAE,IAAI,EAAE,kBAAkB,EAAE,GAAG,KAAK,CAAC,EAAE,IAAI,CAAC,CAAA;gBACxH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;gBACvE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;gBACpE,IAAI,IAAI,KAAK,SAAS;oBAAE,MAAM,IAAI,SAAS,CAAC,YAAY,IAAI,mBAAmB,CAAC,CAAA;gBAChF,OAAO,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,CAAA;YACvD,CAAC;oBAAS,CAAC;gBACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;YAChD,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED,yIAAyI;AACzI,MAAM,UAAU,iBAAiB,CAAC,GAAG,KAA8B;IACjE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAwB,CAAA;IAChD,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO;YACzB,IAAI,SAAkB,CAAA;YACtB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;oBAC/C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;wBAAC,OAAO,KAAK,CAAA;oBAAC,CAAC;gBAC9E,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBAAC,SAAS,GAAG,KAAK,CAAA;gBAAC,CAAC;YACvC,CAAC;YACD,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM,SAAS,CAAA;YAC5C,OAAO,SAAS,CAAA;QAClB,CAAC;QACD,QAAQ,EAAE,KAAK,EAAC,GAAG,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;KACtE,CAAA;AACH,CAAC"}

package/dist/npm-publish.d.ts

@@ -0,0 +1,36 @@
+import type { SecretFinding } from '@webboxes/app-persistence';
+import { type Visibility } from './share.js';
+import type { PluginStore } from './store.js';
+/** The registry, through the user's own `npm` (an adapter in npm-cli.ts; a test fake otherwise). */
+export interface NpmPublishPort {
+    /** Whether `name@version` is already on the registry. */
+    hasVersion(name: string, version: string, registry: string): boolean;
+    /** Publish a tarball file; `access` is `public` or `restricted` (a private scoped package). */
+    publish(tarballPath: string, registry: string, access: 'public' | 'restricted'): void;
+}
+export interface NpmPublishOptions {
+    /** Default: the public npm registry. */
+    readonly registry?: string;
+    /** Default: the plugin's `acryl.visibility`, else private. */
+    readonly visibility?: Visibility;
+}
+export type NpmPublishResult = {
+    readonly status: 'published';
+    readonly name: string;
+    readonly version: string;
+    readonly registry: string;
+    readonly access: 'public' | 'restricted';
+    readonly integrity: string;
+    readonly files: readonly string[];
+    readonly updatedManifest: readonly string[];
+} | {
+    readonly status: 'refused';
+    readonly reason: string;
+    readonly secrets?: readonly SecretFinding[];
+};
+export declare const NPM_REGISTRY = "https://registry.npmjs.org/";
+export declare function publishToNpm(folder: string, options: NpmPublishOptions, ports: {
+    readonly npm: NpmPublishPort;
+    readonly store: PluginStore;
+}): Promise<NpmPublishResult>;
+//# sourceMappingURL=npm-publish.d.ts.map

package/dist/npm-publish.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-publish.d.ts","sourceRoot":"","sources":["../src/npm-publish.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAA;AAI9D,OAAO,EAA4B,KAAK,UAAU,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAE7C,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC7B,yDAAyD;IACzD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAA;IACpE,+FAA+F;IAC/F,OAAO,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAG,YAAY,GAAG,IAAI,CAAA;CACtF;AAED,MAAM,WAAW,iBAAiB;IAChC,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,8DAA8D;IAC9D,QAAQ,CAAC,UAAU,CAAC,EAAE,UAAU,CAAA;CACjC;AAED,MAAM,MAAM,gBAAgB,GACxB;IAAE,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,YAAY,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAClQ;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,aAAa,EAAE,CAAA;CAAE,CAAA;AAExG,eAAO,MAAM,YAAY,gCAAgC,CAAA;AAEzD,wBAAsB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE;IAAE,QAAQ,CAAC,GAAG,EAAE,cAAc,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;CAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA4C9K"}

package/dist/npm-publish.js

@@ -0,0 +1,63 @@
+// Publishing a plugin to an npm registry (spec 044 lifecycle.md, "Publish: the methods", npm; build step 6): the public npm registry or a private
+// one (GitHub Packages, Verdaccio, a company registry). The same guards as sharing to git, then the same deterministic tarball, published with
+// the user's own npm login. A pull of `npm:<name>` checks the registry's own integrity against what was published.
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { syncServiceContract } from './contract.js';
+import { parsePluginName } from './name.js';
+import { bundleProblem, packFolder } from './pack.js';
+import { PLUGIN_LABELS, secretsIn } from './share.js';
+export const NPM_REGISTRY = 'https://registry.npmjs.org/';
+export async function publishToNpm(folder, options, ports) {
+    const refuse = (reason, secrets) => ({ status: 'refused', reason, ...(secrets === undefined ? {} : { secrets }) });
+    const registry = options.registry ?? NPM_REGISTRY;
+    const before = JSON.parse(readFileSync(join(folder, 'package.json'), 'utf8'));
+    const name = parsePluginName(String(before['name']));
+    const acryl = before['acryl'];
+    const visibility = options.visibility ?? (acryl?.visibility === 'public' ? 'public' : 'private');
+    if (visibility === 'public' && typeof before['license'] !== 'string')
+        return refuse('a public plugin needs a "license" in its package.json (for example "MIT")');
+    // An unscoped npm package is always public; a private plugin needs a scope (`@owner/name`) to be published with restricted access.
+    if (visibility === 'private' && name.owner === undefined)
+        return refuse(`${name.full} is private, and npm can keep only a scoped package (@owner/name) private; rename it with a scope or publish it publicly`);
+    if (before['private'] === true)
+        return refuse('package.json says "private": true, which npm refuses to publish; remove it (ACRYL keeps visibility in acryl.visibility)');
+    const contract = await syncServiceContract(folder);
+    if (!contract.ok)
+        return refuse(`its service contract cannot be read: ${contract.errors.join('; ')}`);
+    const manifest = JSON.parse(readFileSync(join(folder, 'package.json'), 'utf8'));
+    const updatedManifest = contract.written ? ['service contract and slots'] : [];
+    const keywords = Array.isArray(manifest['keywords']) ? manifest['keywords'].filter((word) => typeof word === 'string') : [];
+    const missing = PLUGIN_LABELS.filter(label => !keywords.includes(label));
+    if (missing.length > 0) {
+        manifest['keywords'] = [...keywords, ...missing];
+        writeFileSync(join(folder, 'package.json'), `${JSON.stringify(manifest, null, 2)}\n`);
+        updatedManifest.push(`keywords +${missing.join(', +')}`);
+    }
+    const packed = packFolder(folder);
+    const notBundle = bundleProblem(packed);
+    if (notBundle !== undefined)
+        return refuse(notBundle);
+    const secrets = secretsIn(packed);
+    if (secrets.length > 0)
+        return refuse(`the secret check found ${String(secrets.length)} possible secret(s) in the files that would be published; nothing was sent`, secrets);
+    if (ports.npm.hasVersion(packed.name.full, packed.version, registry))
+        return refuse(`${packed.name.full}@${packed.version} is already on ${registry}; a version is published once, so give this change a new version (acryl plugin version patch)`);
+    const kept = ports.store.list().find(entry => entry.name === packed.name.full && entry.version === packed.version);
+    if (kept !== undefined && kept.integrity !== packed.integrity)
+        return refuse(`${packed.name.full} ${packed.version} was already saved here with different files; give this change a new version (acryl plugin version patch)`);
+    const access = visibility === 'public' ? 'public' : 'restricted';
+    const work = mkdtempSync(join(tmpdir(), 'plugin-hub-npm-'));
+    try {
+        const file = join(work, packed.fileName);
+        writeFileSync(file, packed.tarball);
+        ports.npm.publish(file, registry, access);
+    }
+    finally {
+        rmSync(work, { recursive: true, force: true });
+    }
+    ports.store.put(packed.name.full, packed.version, packed.tarball, { from: folder });
+    return { status: 'published', name: packed.name.full, version: packed.version, registry, access, integrity: packed.integrity, files: packed.files, updatedManifest };
+}
+//# sourceMappingURL=npm-publish.js.map

package/dist/npm-publish.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-publish.js","sourceRoot":"","sources":["../src/npm-publish.ts"],"names":[],"mappings":"AAAA,kJAAkJ;AAClJ,+IAA+I;AAC/I,mHAAmH;AACnH,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAC1E,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAA;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAEhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAmB,MAAM,YAAY,CAAA;AAsBtE,MAAM,CAAC,MAAM,YAAY,GAAG,6BAA6B,CAAA;AAEzD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAc,EAAE,OAA0B,EAAE,KAAoE;IACjJ,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,OAAkC,EAAoB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAA;IACvK,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,YAAY,CAAA;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAA;IACxG,MAAM,IAAI,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IACpD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAyC,CAAA;IACrE,MAAM,UAAU,GAAe,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,EAAE,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC5G,IAAI,UAAU,KAAK,QAAQ,IAAI,OAAO,MAAM,CAAC,SAAS,CAAC,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,2EAA2E,CAAC,CAAA;IAChK,mIAAmI;IACnI,IAAI,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,0HAA0H,CAAC,CAAA;IAC/M,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC,yHAAyH,CAAC,CAAA;IAExK,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAClD,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,wCAAwC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACrG,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAA;IAC1G,MAAM,eAAe,GAAa,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACxF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC3I,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACxE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAA;QAChD,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAA;QACrF,eAAe,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;IAC1D,CAAC;IAED,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;IACvC,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,SAAS,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,SAAS,CAAC,MAAM,CAAC,CAAA;IACjC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,0BAA0B,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,4EAA4E,EAAE,OAAO,CAAC,CAAA;IAC5K,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,kBAAkB,QAAQ,+FAA+F,CAAC,CAAA;IACnP,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,CAAA;IAClH,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,2GAA2G,CAAC,CAAA;IAE9N,MAAM,MAAM,GAAG,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAA;IAChE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAA;IAC3D,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAA;QACxC,aAAa,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAA;QACnC,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAA;IAC3C,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAA;IACnF,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,eAAe,EAAE,CAAA;AACtK,CAAC"}

package/dist/pack.d.ts

@@ -0,0 +1,32 @@
+import { type PluginName } from './name.js';
+import { type TarballFile } from './tarball.js';
+export interface PackedPlugin {
+    readonly name: PluginName;
+    readonly version: string;
+    /** The package.json as packed. */
+    readonly manifest: Readonly<Record<string, unknown>>;
+    /** Paths inside the package, sorted. */
+    readonly files: readonly string[];
+    readonly tarball: Buffer;
+    readonly integrity: string;
+    /** `<local name with dots and @ removed>-<version>.tgz`, as `npm pack` names it (`@a/b.c` 1.0.0 is `a-b.c-1.0.0.tgz`). */
+    readonly fileName: string;
+}
+/** The files `npm pack` would put in the package, as `/`-separated paths. */
+export declare function packageFiles(dir: string, manifest: Readonly<Record<string, unknown>>): string[];
+export declare class PackError extends Error {
+    readonly dir: string;
+    readonly reason: string;
+    constructor(dir: string, reason: string);
+}
+/** Pack a source folder. Refuses a folder without a valid name and version, which no target could hold. */
+export declare function packFolder(dir: string): PackedPlugin;
+/**
+ * Why DeepSeek Harness's installer would refuse this package as "not a bundle", or undefined when it would not: package.json names its
+ * Loader patch in `dsh.bundle.patch`, and that file is among the packed ones. Checked before anything is sent, so no target ever holds a
+ * plugin that no app can install.
+ */
+export declare function bundleProblem(packed: Pick<PackedPlugin, 'manifest' | 'files'>): string | undefined;
+/** The package.json inside a tarball, which every pull reads to know what it got before installing it. */
+export declare function manifestOfTarball(files: readonly TarballFile[]): Record<string, unknown>;
+//# sourceMappingURL=pack.d.ts.map

package/dist/pack.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.d.ts","sourceRoot":"","sources":["../src/pack.ts"],"names":[],"mappings":"AAMA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,WAAW,CAAA;AAC5D,OAAO,EAA6B,KAAK,WAAW,EAAE,MAAM,cAAc,CAAA;AAG1E,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,kCAAkC;IAClC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACpD,wCAAwC;IACxC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,0HAA0H;IAC1H,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAuCD,6EAA6E;AAC7E,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,EAAE,CAY/F;AAiBD,qBAAa,SAAU,SAAQ,KAAK;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAApC,GAAG,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAI1D;AAED,2GAA2G;AAC3G,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,YAAY,CAkBpD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,OAAO,CAAC,GAAG,MAAM,GAAG,SAAS,CAQlG;AAED,0GAA0G;AAC1G,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMxF"}

package/dist/pack.js

@@ -0,0 +1,137 @@
+// Packing a plugin's source folder into its tarball. Which files go in follows npm's rules closely enough that a plugin packs the same way
+// here as with `npm pack`: the package.json `files` list when there is one, otherwise everything not ignored; package.json, README and
+// LICENSE always; never node_modules, .git or the other files npm never packs. The file list is returned too: it is exactly what a share
+// checks for secrets and sends, so nothing leaves the machine that was not checked.
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
+import { join, relative, sep } from 'node:path';
+import { parsePluginName } from './name.js';
+import { integrityOf, writeTarball } from './tarball.js';
+import { parseVersion } from './version.js';
+/** Never packed, wherever they are (npm's own list plus ACRYL's staging folder). */
+const NEVER = new Set(['node_modules', '.git', '.svn', '.hg', 'CVS', '.DS_Store', '.npmrc', 'npm-debug.log', '.lock-wscript', '.wafpickle-N', 'config.gypi', 'package-lock.json', '.acryl-staged', '.acryl-plugin-hub']);
+const NEVER_PATTERN = [/^\._/u, /\.swp$/u, /\.orig$/u, /^\.#/u, /\.tgz$/u];
+/** Always packed from the folder's top level, case-insensitively, as npm does. */
+const ALWAYS = [/^package\.json$/iu, /^readme(?:\..*)?$/iu, /^licen[cs]e(?:\..*)?$/iu, /^changelog(?:\..*)?$/iu];
+function never(name) {
+    return NEVER.has(name) || NEVER_PATTERN.some(pattern => pattern.test(name));
+}
+/** A gitignore-style pattern as a test on a `/`-separated path: `*` within a level, `**` across levels, a trailing `/` for folders. */
+function patternTest(pattern) {
+    const directoryOnly = pattern.endsWith('/');
+    const body = pattern.replace(/^\//u, '').replace(/\/$/u, '');
+    const anchored = pattern.startsWith('/') || body.includes('/');
+    const source = body.split('**').map(part => part.split('*').map(text => text.replace(/[.+?^${}()|[\]\\]/gu, '\\$&')).join('[^/]*')).join('.*');
+    const regex = new RegExp(anchored ? `^${source}(?:/.*)?$` : `(?:^|/)${source}(?:/.*)?$`, 'u');
+    return (path, isDirectory) => (!directoryOnly || isDirectory || path.includes('/')) && regex.test(path);
+}
+function ignoreRules(dir) {
+    const file = existsSync(join(dir, '.npmignore')) ? '.npmignore' : existsSync(join(dir, '.gitignore')) ? '.gitignore' : undefined;
+    if (file === undefined)
+        return [];
+    return readFileSync(join(dir, file), 'utf8').split(/\r?\n/u).map(line => line.trim()).filter(line => line !== '' && !line.startsWith('#') && !line.startsWith('!')).map(patternTest);
+}
+function walk(root, current, out, skip) {
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+        if (never(entry.name) || entry.isSymbolicLink())
+            continue;
+        const full = join(current, entry.name);
+        const path = relative(root, full).split(sep).join('/');
+        if (skip(path, entry.isDirectory()))
+            continue;
+        if (entry.isDirectory())
+            walk(root, full, out, skip);
+        else if (entry.isFile())
+            out.push(path);
+    }
+}
+/** The files `npm pack` would put in the package, as `/`-separated paths. */
+export function packageFiles(dir, manifest) {
+    const all = [];
+    const declared = manifest['files'];
+    if (Array.isArray(declared)) {
+        walk(dir, dir, all, () => false);
+        const tests = declared.filter((entry) => typeof entry === 'string').map(entry => patternTest(`/${entry.replace(/^\.\//u, '')}`));
+        const main = typeof manifest['main'] === 'string' ? manifest['main'].replace(/^\.\//u, '') : undefined;
+        return all.filter(path => tests.some(test => test(path, false)) || path === main || (!path.includes('/') && ALWAYS.some(pattern => pattern.test(path)))).sort();
+    }
+    const rules = ignoreRules(dir);
+    walk(dir, dir, all, (path, isDirectory) => rules.some(rule => rule(path, isDirectory)));
+    return all.filter(path => path !== '.npmignore' && path !== '.gitignore').sort();
+}
+/** The files package.json's `bin` names, as package paths. */
+function binTargets(manifest) {
+    const bin = manifest['bin'];
+    const targets = typeof bin === 'string' ? [bin] : typeof bin === 'object' && bin !== null ? Object.values(bin) : [];
+    return new Set(targets.filter((target) => typeof target === 'string').map(target => target.replace(/^\.\//u, '')));
+}
+/**
+ * Whether a file starts with `#!`. Executable files are decided from the content and `bin`, never from the file mode: Windows has no
+ * executable bit, so the mode would make the same files pack to different bytes on different systems.
+ */
+function startsWithShebang(content) {
+    return content[0] === 0x23 && content[1] === 0x21;
+}
+export class PackError extends Error {
+    dir;
+    reason;
+    constructor(dir, reason) {
+        super(`cannot pack ${dir}: ${reason}`);
+        this.dir = dir;
+        this.reason = reason;
+        this.name = 'PackError';
+    }
+}
+/** Pack a source folder. Refuses a folder without a valid name and version, which no target could hold. */
+export function packFolder(dir) {
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+    }
+    catch {
+        throw new PackError(dir, 'package.json is missing or not valid JSON');
+    }
+    if (typeof manifest['name'] !== 'string')
+        throw new PackError(dir, 'package.json has no "name"');
+    const name = parsePluginName(manifest['name']);
+    const version = manifest['version'];
+    if (typeof version !== 'string' || parseVersion(version) === undefined)
+        throw new PackError(dir, 'package.json has no semantic "version" such as 0.1.0');
+    const files = packageFiles(dir, manifest);
+    const bins = binTargets(manifest);
+    const entries = files.map(path => {
+        const content = readFileSync(join(dir, ...path.split('/')));
+        return { path, content, executable: bins.has(path) || startsWithShebang(content) };
+    });
+    const tarball = writeTarball(entries);
+    const fileName = `${name.full.replace(/^@/u, '').replace('/', '-')}-${version}.tgz`;
+    return { name, version, manifest, files, tarball, integrity: integrityOf(tarball), fileName };
+}
+/**
+ * Why DeepSeek Harness's installer would refuse this package as "not a bundle", or undefined when it would not: package.json names its
+ * Loader patch in `dsh.bundle.patch`, and that file is among the packed ones. Checked before anything is sent, so no target ever holds a
+ * plugin that no app can install.
+ */
+export function bundleProblem(packed) {
+    const dsh = packed.manifest['dsh'];
+    const patch = dsh?.bundle?.patch;
+    const example = '"dsh": { "bundle": { "patch": "./cordis.patch.yml" } }';
+    if (typeof patch !== 'string')
+        return `package.json does not name its Loader patch, so no app can install it; add ${example} and a cordis.patch.yml that inserts its row`;
+    const path = patch.replace(/^\.\//u, '');
+    if (!packed.files.includes(path))
+        return `its Loader patch ${path} is not among the files that would be sent; create it, or add it to package.json "files"`;
+    return undefined;
+}
+/** The package.json inside a tarball, which every pull reads to know what it got before installing it. */
+export function manifestOfTarball(files) {
+    const file = files.find(entry => entry.path === 'package.json');
+    if (file === undefined)
+        throw new Error('the tarball has no package.json');
+    try {
+        return JSON.parse(Buffer.from(file.content).toString('utf8'));
+    }
+    catch {
+        throw new Error('the tarball\'s package.json is not valid JSON');
+    }
+}
+//# sourceMappingURL=pack.js.map

package/dist/pack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack.js","sourceRoot":"","sources":["../src/pack.ts"],"names":[],"mappings":"AAAA,2IAA2I;AAC3I,uIAAuI;AACvI,yIAAyI;AACzI,oFAAoF;AACpF,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAC/D,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAmB,MAAM,WAAW,CAAA;AAC5D,OAAO,EAAE,WAAW,EAAE,YAAY,EAAoB,MAAM,cAAc,CAAA;AAC1E,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAA;AAe3C,oFAAoF;AACpF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,aAAa,EAAE,mBAAmB,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAA;AACxN,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,CAAC,CAAA;AAC1E,kFAAkF;AAClF,MAAM,MAAM,GAAG,CAAC,mBAAmB,EAAE,qBAAqB,EAAE,yBAAyB,EAAE,wBAAwB,CAAC,CAAA;AAEhH,SAAS,KAAK,CAAC,IAAY;IACzB,OAAO,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC7E,CAAC;AAED,uIAAuI;AACvI,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9I,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,MAAM,WAAW,CAAC,CAAC,CAAC,UAAU,MAAM,WAAW,EAAE,GAAG,CAAC,CAAA;IAC7F,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzG,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAA;IAChI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACjC,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAA;AACtL,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,GAAa,EAAE,IAAqD;IAC/G,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAClE,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,cAAc,EAAE;YAAE,SAAQ;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACtD,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;YAAE,SAAQ;QAC7C,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,CAAA;aAC/C,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACzC,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,QAA2C;IACnF,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAA;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;QAChC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACjJ,MAAM,IAAI,GAAG,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;QACtG,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IACjK,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAA;IACvF,OAAO,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,YAAY,CAAC,CAAC,IAAI,EAAE,CAAA;AAClF,CAAC;AAED,8DAA8D;AAC9D,SAAS,UAAU,CAAC,QAA2C;IAC7D,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3B,MAAM,OAAO,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAA8B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IAC9I,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAoB,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAA;AACtI,CAAC;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,OAAmB;IAC5C,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI,CAAA;AACnD,CAAC;AAED,MAAM,OAAO,SAAU,SAAQ,KAAK;IACb;IAAsB;IAA3C,YAAqB,GAAW,EAAW,MAAc;QACvD,KAAK,CAAC,eAAe,GAAG,KAAK,MAAM,EAAE,CAAC,CAAA;QADnB,QAAG,GAAH,GAAG,CAAQ;QAAW,WAAM,GAAN,MAAM,CAAQ;QAEvD,IAAI,CAAC,IAAI,GAAG,WAAW,CAAA;IACzB,CAAC;CACF;AAED,2GAA2G;AAC3G,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,IAAI,QAAiC,CAAA;IACrC,IAAI,CAAC;QAAC,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAA4B,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QAC/G,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAA;IACvE,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAA;IAChG,MAAM,IAAI,GAAG,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAA;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAA;IACnC,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,YAAY,CAAC,OAAO,CAAC,KAAK,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,sDAAsD,CAAC,CAAA;IACxJ,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAA;IACzC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAA;IACjC,MAAM,OAAO,GAAkB,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC9C,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;QAC3D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAA;IACpF,CAAC,CAAC,CAAA;IACF,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,MAAM,CAAA;IACnF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAA;AAC/F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAgD;IAC5E,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAiD,CAAA;IAClF,MAAM,KAAK,GAAG,GAAG,EAAE,MAAM,EAAE,KAAK,CAAA;IAChC,MAAM,OAAO,GAAG,wDAAwD,CAAA;IACxE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,8EAA8E,OAAO,8CAA8C,CAAA;IACzK,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IACxC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,oBAAoB,IAAI,0FAA0F,CAAA;IAC3J,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,cAAc,CAAC,CAAA;IAC/D,IAAI,IAAI,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;IAC1E,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA4B,CAAA;IAAC,CAAC;IAAC,MAAM,CAAC;QACtG,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;IAClE,CAAC;AACH,CAAC"}

package/dist/pull.d.ts

@@ -0,0 +1,55 @@
+import { type PluginSource } from './source.js';
+import { PluginStore, type StoredVersion } from './store.js';
+/** A release as a git host reports it: its tag and its attached files. */
+export interface ReleaseInfo {
+    readonly tag: string;
+    /** `digest` is what the host publishes for the asset (`sha256:<hex>`), when it does. */
+    readonly assets: readonly {
+        readonly name: string;
+        readonly url: string;
+        readonly digest?: string;
+    }[];
+}
+/** The git host a `github:` source reads releases from (an HTTP adapter for public repositories, the user's `gh` for private ones). */
+export interface ReleasePort {
+    /** The release with this tag, or the latest release when `tag` is undefined; undefined when there is none. */
+    release(owner: string, repo: string, tag?: string): Promise<ReleaseInfo | undefined>;
+    /** A release asset's bytes. */
+    download(url: string): Promise<Uint8Array>;
+}
+/** The npm registry: a version's tarball address and the integrity the registry records for it. */
+export interface RegistryPort {
+    resolve(name: string, version?: string): Promise<{
+        readonly version: string;
+        readonly tarball: string;
+        readonly integrity?: string;
+    } | undefined>;
+    download(url: string): Promise<Uint8Array>;
+}
+export interface PullPorts {
+    readonly store: PluginStore;
+    readonly releases?: ReleasePort;
+    readonly registry?: RegistryPort;
+    /** Bytes at an https URL, for a `tarball-url` source. */
+    readonly download?: (url: string) => Promise<Uint8Array>;
+}
+export interface PullOptions {
+    /** The sha512 a catalog lists for this tarball; a different one is refused. */
+    readonly expectIntegrity?: string;
+}
+export interface PulledPlugin {
+    readonly stored: StoredVersion;
+    /** False when the store already held these exact bytes. */
+    readonly added: boolean;
+    readonly manifest: Readonly<Record<string, unknown>>;
+    /** Where the bytes came from: the release asset or registry URL, or the file. */
+    readonly fetchedFrom: string;
+}
+export declare class PullError extends Error {
+    readonly source: string;
+    readonly reason: string;
+    constructor(source: string, reason: string);
+}
+/** Pull a plugin into the store. Every check runs before anything is stored; a failed pull leaves the store as it was. */
+export declare function pullPlugin(source: PluginSource, ports: PullPorts, options?: PullOptions): Promise<PulledPlugin>;
+//# sourceMappingURL=pull.d.ts.map

package/dist/pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pull.d.ts","sourceRoot":"","sources":["../src/pull.ts"],"names":[],"mappings":"AAOA,OAAO,EAAsB,KAAK,YAAY,EAAE,MAAM,aAAa,CAAA;AACnE,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAA;AAI5D,0EAA0E;AAC1E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,wFAAwF;IACxF,QAAQ,CAAC,MAAM,EAAE,SAAS;QAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CACtG;AAED,uIAAuI;AACvI,MAAM,WAAW,WAAW;IAC1B,8GAA8G;IAC9G,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAA;IACpF,+BAA+B;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAC3C;AAED,mGAAmG;AACnG,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC,CAAA;IACjJ,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;CAC3C;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAA;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,WAAW,CAAA;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAA;IAChC,yDAAyD;IACzD,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAA;CACzD;AAED,MAAM,WAAW,WAAW;IAC1B,+EAA+E;IAC/E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAA;CAClC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAA;IAC9B,2DAA2D;IAC3D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACpD,iFAAiF;IACjF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,qBAAa,SAAU,SAAQ,KAAK;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAvC,MAAM,EAAE,MAAM,EAAW,MAAM,EAAE,MAAM;CAI7D;AA6DD,0HAA0H;AAC1H,wBAAsB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,GAAE,WAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAmCzH"}