@zaimokuza/dsh-plugin-hub 0.1.0

package/src/client/market.css

@@ -0,0 +1,113 @@
+/* Brand and page layout only. Interactive controls use DSH primitives unchanged. */
+.hub-market {
+  box-sizing: border-box;
+  --red: #596579;
+  --ink: var(--dsw-alias-label-primary, #25272b);
+  --muted: var(--dsw-alias-label-tertiary, #7b7e86);
+  --line: var(--dsw-alias-border-l4, #e9e9ed);
+  color: var(--ink);
+  font: var(--dsw-font-xs-13);
+  padding: 5px 3px 20px;
+  width: 100%;
+  position: relative;
+  isolation: isolate;
+  container-type: inline-size;
+}
+.hub-market *, .hub-detail-body * { box-sizing: border-box; }
+.hub-market a:focus-visible, .hub-help-link:focus-visible { outline: 2px solid var(--dsw-alias-brand-primary); outline-offset: 3px; }
+.hub-market svg { flex-shrink: 0; }
+.hub-topline { display: flex; align-items: center; justify-content: space-between; gap: 10px; margin-bottom: 20px; }
+.hub-brand { display: flex; align-items: center; gap: 8px; font-size: 10px; letter-spacing: 1px; font-weight: 700; color: var(--muted); }
+.hub-brandmark { display: grid; place-items: center; width: 25px; height: 25px; color: white; background: var(--red); border-radius: 50%; font: 700 20px Georgia; letter-spacing: 0; }
+.hub-divider { width: 1px; height: 13px; background: var(--line); margin: 0 3px; }
+.hub-runtime { display: flex; align-items: center; gap: 5px; font: 10px ui-monospace, monospace; color: var(--muted); white-space: nowrap; }
+.hub-runtime i, .hub-footer i { width: 5px; height: 5px; border-radius: 50%; background: var(--dsw-alias-state-success-primary); display: inline-block; }
+.hub-header { display: flex; justify-content: space-between; align-items: center; gap: 18px; margin-bottom: 18px; }
+.hub-eyebrow { font-size: 9px; letter-spacing: 1.9px; color: var(--red); font-weight: 700; }
+.hub-header h1 { font-size: 30px; letter-spacing: -1px; margin: 4px 0 5px; font-weight: 650; line-height: 1.4; }
+.hub-header h1 span { color: var(--red); }
+.hub-header p { margin: 0; color: var(--muted); font-size: 12px; }
+.hub-header-art { position: relative; display: grid; place-items: center; color: var(--red); background: linear-gradient(145deg, color-mix(in srgb, var(--red) 5%, white), color-mix(in srgb, var(--red) 14%, white)); width: 80px; height: 74px; border-radius: 20px; transform: rotate(-8deg); flex-shrink: 0; border: 1px solid color-mix(in srgb, var(--red) 15%, transparent); }
+.hub-art-plus { position: absolute; right: -5px; bottom: 6px; background: white; box-shadow: 0 3px 9px #47172515; border-radius: 9px; width: 28px; height: 28px; text-align: center; font-size: 21px; line-height: 26px; transform: rotate(8deg); }
+.hub-art-dot { position: absolute; width: 8px; height: 8px; background: color-mix(in srgb, var(--red) 40%, white); border-radius: 50%; top: 9px; left: -6px; }
+.hub-stats { display: flex; flex-wrap: wrap; align-items: center; gap: 25px; padding: 12px 0; border-top: 1px solid var(--line); border-bottom: 1px solid var(--line); margin-bottom: 14px; }
+.hub-stats > div { display: flex; align-items: baseline; gap: 7px; }
+.hub-stats strong { font-size: 23px; font-weight: 600; letter-spacing: -.6px; font-variant-numeric: tabular-nums; }
+.hub-stats span { font-size: 11px; color: var(--muted); }
+.hub-tabs { display: flex; flex-wrap: wrap; gap: 8px; padding-bottom: 12px; border-bottom: 1px solid var(--line); margin-bottom: 14px; }
+.hub-tab-count { font-size: 10px; color: var(--muted); margin-left: 5px; }
+.hub-toolbar { display: flex; align-items: center; flex-wrap: wrap; gap: 8px; }
+.hub-search-input { flex: 1; min-width: 180px; }
+.hub-results { display: flex; justify-content: space-between; align-items: center; gap: 10px; color: var(--muted); font-size: 11px; margin: 20px 0 12px; }
+.hub-results b { margin-left: 4px; font-weight: 500; }
+.hub-results small { font-size: 9px; }
+.hub-pagination { display: flex; justify-content: center; padding: 20px 0 0; }
+.hub-grid { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 13px; }
+.hub-card { border: 1px solid var(--line); border-radius: 11px; padding: 16px; background: var(--dsw-alias-bg-layer-2, #fff); display: flex; flex-direction: column; min-width: 0; }
+.hub-card-top { display: flex; align-items: center; justify-content: space-between; gap: 6px; margin-bottom: 10px; flex-wrap: wrap; }
+.hub-plugin-icon { display: grid; place-items: center; border-radius: 10px; width: 40px; height: 40px; background: #f4f0ea; color: #9c754f; }
+.hub-plugin-icon.icon-knowledge { background: #eaf3f2; color: #4c8b80; }
+.hub-plugin-icon.icon-developer-tools { background: #edf0fa; color: #6278ac; }
+.hub-plugin-icon.icon-agent { background: #f8e9ed; color: #b94b63; }
+.hub-plugin-icon.icon-integration { background: #f1eefa; color: #8c6db2; }
+.hub-card-heading { font-size: 14px; margin: 0 -8px; }
+.hub-description { font-size: 12px; color: var(--muted); line-height: 1.85; min-height: 44px; margin: 13px 0 12px; display: -webkit-box; -webkit-line-clamp: 2; -webkit-box-orient: vertical; overflow: hidden; }
+.hub-tags { display: flex; gap: 5px; flex-wrap: wrap; margin: 0 0 14px; }
+.hub-version-row { border-top: 1px solid var(--line); padding-top: 12px; display: flex; align-items: center; justify-content: space-between; flex-wrap: wrap; gap: 6px; font-size: 11px; color: var(--muted); margin-top: auto; }
+.hub-version-note { font-size: 10px; color: var(--muted); overflow-wrap: anywhere; margin: 7px 0 13px; min-height: 16px; }
+.hub-card-actions { display: flex; align-items: center; justify-content: space-between; flex-wrap: wrap; gap: 9px; }
+.hub-footer { display: flex; justify-content: space-between; flex-wrap: wrap; font-size: 9px; color: var(--muted); margin-top: 21px; gap: 8px; }
+.hub-footer i { margin-right: 5px; }
+.hub-footnote { font-size: 9px; color: var(--muted); margin: 7px 0 0; line-height: 1.7; }
+.hub-empty { padding: 50px 10px; text-align: center; color: var(--muted); }
+.hub-empty svg { margin: auto; }
+.hub-empty h2, .hub-empty h3 { color: var(--ink); font-weight: 500; }
+.hub-notice { display: flex; gap: 8px; align-items: center; font-size: 11px; padding: 12px; border-radius: 7px; margin: 10px 0; }
+.hub-notice.amber { background: color-mix(in srgb, var(--dsw-alias-state-warn-primary) 10%, var(--dsw-alias-bg-layer-2)); color: var(--dsw-alias-label-primary); }
+.hub-notice.red { background: color-mix(in srgb, var(--dsw-alias-state-error-primary) 10%, var(--dsw-alias-bg-layer-2)); color: var(--dsw-alias-label-primary); }
+.hub-notice > div, .hub-notice > span { flex: 1; }
+.hub-notice b, .hub-notice div > span { display: block; }
+.hub-notice b { font-weight: 500; }
+.hub-notice div > span { font-size: 10px; }
+.hub-queue { position: sticky; bottom: 0; z-index: 4; margin-top: 16px; background: var(--dsw-alias-bg-layer-2, #fff); border: 1px solid var(--line); border-radius: 10px; box-shadow: var(--dsw-elevation-prominent); overflow: hidden; }
+.hub-queue-summary { display: flex; align-items: center; width: 100%; gap: 10px; padding: 12px 15px; color: var(--ink); }
+.hub-queue-summary > span:nth-child(2) { flex: 1; }
+.hub-queue-icon { display: grid; place-items: center; border-radius: 8px; width: 33px; height: 33px; background: color-mix(in srgb, var(--red) 9%, white); color: var(--red); }
+.hub-queue-summary b { font-size: 11px; font-weight: 500; display: block; }
+.hub-queue-summary small { font-size: 9px; color: var(--muted); display: block; }
+.hub-jobs { border-top: 1px solid var(--line); max-height: 170px; overflow: auto; padding: 0 15px; }
+.hub-jobs > div { display: flex; align-items: center; gap: 10px; padding: 9px 0; border-bottom: 1px solid var(--line); flex-wrap: wrap; }
+.hub-jobs > div > span:first-child { flex: 1; }
+.hub-jobs b { font-weight: 500; font-size: 10px; }
+.hub-jobs small { font-size: 9px; margin-left: 7px; color: var(--muted); }
+.hub-jobs p { font-size: 10px; width: 100%; color: var(--red); margin: 0; }
+.hub-detail-dialog { width: min(500px, 100%); max-height: 85vh; }
+.hub-detail-scroll { overflow: auto; }
+.hub-detail-body { color: var(--dsw-alias-label-primary); font: var(--dsw-font-xs-13); }
+.hub-package-name { font-size: 11px; color: var(--dsw-alias-label-tertiary); overflow-wrap: anywhere; }
+.hub-detail-info { display: flex; flex-wrap: wrap; gap: 25px; font-size: 11px; color: var(--dsw-alias-label-tertiary); padding: 16px 0; }
+.hub-detail-info b { display: block; color: var(--dsw-alias-label-secondary); font-weight: 500; margin-top: 3px; }
+.hub-detail-body h3 { font-size: 13px; margin: 10px 0; }
+.hub-releases { display: grid; gap: 12px; }
+.hub-release { border-bottom: 1px solid var(--dsw-alias-border-l4); padding-bottom: 12px; }
+.hub-release > div { display: flex; justify-content: space-between; align-items: center; }
+.hub-release small, .hub-release p { font-size: 11px; color: var(--dsw-alias-label-tertiary); margin: 6px 0 0; display: block; }
+.hub-help-link:hover { color: var(--dsw-alias-brand-primary); text-decoration: underline; }
+.hub-help-link { color: var(--dsw-alias-label-secondary); font-size: 11px; display: inline-flex; align-items: center; gap: 4px; text-decoration: none; }
+.spinning { animation: hub-spin .9s linear infinite; }
+@keyframes hub-spin { to { transform: rotate(360deg); } }
+@container (max-width: 470px) {
+  .hub-grid { grid-template-columns: 1fr; }
+  .hub-topline { flex-wrap: wrap; }
+  .hub-header-art { display: none; }
+  .hub-results small { display: none; }
+  .hub-stats { gap: 15px; }
+}
+@media (prefers-reduced-motion: reduce) { .spinning { animation: none; } }
+
+.hub-card-package { font-size: 10px; color: var(--dsw-alias-label-tertiary); overflow-wrap: anywhere; margin-top: 5px; }
+.hub-document-links { display: flex; flex-wrap: wrap; gap: 12px; margin-top: 12px; }
+.hub-detail-actions { width: 100%; }
+.hub-detail-actions > div:first-child { display: flex; flex-wrap: wrap; gap: 8px; }
+
+.hub-source-label { display: block; margin-top: 8px; color: var(--dsw-alias-label-tertiary); font-size: 11px; }

package/src/client/scope.js

@@ -0,0 +1,9 @@
+/** Source tabs show catalog membership while sharing the single merged package record. */
+export function inScope(plugin, scope) {
+  if (scope === 'all') return true;
+  if (scope === 'installed') return Boolean(plugin.installedVersion);
+  return scope.startsWith('source:') && (plugin.catalogSourceIds ?? [plugin.catalogSource?.id]).includes(scope.slice(7));
+}
+export function resolveScope(scope, sources) {
+  return scope === 'all' || scope === 'installed' || sources.some(source => scope === 'source:' + source.id) ? scope : 'all';
+}

package/src/declarations.js

@@ -0,0 +1,19 @@
+import semver from 'semver';
+
+/** Interpret author declarations; conflicting formats never become a positive result. */
+export function dshDeclaration(manifest, host, peerEvidence) {
+  const entries = [['engines.dsh', manifest.engines?.dsh], ['dsh.engines.dsh', manifest.dsh?.engines?.dsh], ['dsh.compatibility.dsh', manifest.dsh?.compatibility?.dsh]].filter(([, range]) => range !== undefined);
+  const exact = manifest.dsh?.compatibility?.dshReleases?.[host.dsh];
+  // Plugin Hub's explicit opt-in is independent of SemVer, so future RCs are
+  // allowed too. Never widen an author's version constraint or peer dependency.
+  const capabilityBased = manifest.dshPluginHub?.hostCompatibility === 'capability-based';
+  const basis = entries.map(([key]) => key).concat(exact !== undefined ? ['dsh.compatibility.dshReleases'] : []).join(' + ') || (capabilityBased ? 'dshPluginHub.hostCompatibility' : peerEvidence ? 'peerDependencies' : 'undeclared');
+  const range = entries.map(([, range]) => range).filter(range => typeof range === 'string').join(' & ') || null;
+  if (!semver.valid(host.dsh) || entries.some(([, range]) => typeof range !== 'string' || !semver.validRange(range)) || exact !== undefined && !['compatible', 'incompatible'].includes(exact)) return { basis, range, status: 'unknown', reasons: ['未提供有效的 DSH 兼容声明'] };
+  const results = entries.map(([, range]) => semver.satisfies(host.dsh, range));
+  if (exact !== undefined) results.push(exact === 'compatible');
+  if (results.includes(true) && results.includes(false)) return { basis, range, status: 'unknown', reasons: ['兼容声明存在冲突，需要维护者确认'] };
+  if (results.includes(false)) return { basis, range, status: 'incompatible', reasons: [range ? `要求 DSH ${range}，当前为 ${host.dsh}` : `作者声明不兼容 DSH ${host.dsh}`] };
+  if (!results.length && !peerEvidence && !capabilityBased) return { basis, range, status: 'unknown', reasons: ['未提供有效的 DSH 兼容声明'] };
+  return { basis, range, status: 'compatible', reasons: [] };
+}

package/src/dsh.js

@@ -0,0 +1,66 @@
+import { spawn } from 'node:child_process';
+import { readFileSync, realpathSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { homedir } from 'node:os';
+import { collectHostPeers } from './host-peers.js';
+import { releaseAgeArgument } from './release-age.js';
+
+/** All knowledge about the DSH process and its profile lives in this adapter. */
+export function dshEnvironment(profile = 'web') {
+  if (!/^[a-zA-Z0-9_-]+$/.test(profile)) throw new Error('profile 名称无效');
+  const cli = realpathSync(process.argv[1]);
+  const manifest = JSON.parse(readFileSync(join(dirname(cli), '..', 'package.json'), 'utf8'));
+  if (manifest.name !== '@deepseek-ai/dsh') throw new Error('请通过 DSH CLI 启动此插件');
+  const configuredHome = process.env.DSH_HOME?.trim() || join(homedir(), '.dsh');
+  const home = configuredHome === '~' ? homedir() : /^~[/\\]/.test(configuredHome) ? join(homedir(), configuredHome.slice(2)) : configuredHome;
+  const profileDir = resolve(home, 'profiles', profile);
+  const peers = collectHostPeers(join(dirname(cli), '..', 'package.json'));
+  return { cli, profileDir, profile, host: { dsh: manifest.version, node: process.versions.node, platform: process.platform, arch: process.arch, peers } };
+}
+
+export function createDshInstaller(environment, config) {
+  let child;
+  const installed = async () => {
+    let manifest;
+    try { manifest = JSON.parse(readFileSync(join(environment.profileDir, 'package.json'), 'utf8')); }
+    catch (error) { if (error.code === 'ENOENT') return {}; throw error; }
+    const result = {};
+    for (const name of Object.keys(manifest.dependencies ?? {})) {
+      try { result[name] = JSON.parse(readFileSync(join(environment.profileDir, 'node_modules', name, 'package.json'), 'utf8')).version; }
+      catch { /* Missing files are not an installed version, even if a manifest entry remains. */ }
+    }
+    return result;
+  };
+  async function run(args, log) {
+    await new Promise((resolve, reject) => {
+        child = spawn(process.execPath, args, { cwd: process.cwd(), env: process.env, stdio: ['ignore', 'pipe', 'pipe'], shell: false, windowsHide: true });
+        const timer = setTimeout(() => { child.kill('SIGTERM'); reject(new Error('插件操作超时，请检查 profile 后重试')); }, 180000);
+        const onData = bytes => log(bytes.toString('utf8').replace(/Bearer\s+\S+/gi, 'Bearer [redacted]').slice(-1500));
+        child.stdout.on('data', onData); child.stderr.on('data', onData);
+        child.once('error', error => { clearTimeout(timer); reject(error); });
+        child.once('exit', code => { clearTimeout(timer); child = null; code === 0 ? resolve() : reject(new Error(`插件命令失败（退出码 ${code}）`)); });
+      });
+  }
+  return {
+    installed,
+    async install(packageName, version, log) {
+      const args = [...process.execArgv, environment.cli, 'plugin', '--profile', environment.profile, 'add', `${packageName}@${version}`, '--save-exact', `--registry=${config.registry}`, releaseAgeArgument(config)];
+      log(`安装 ${packageName}@${version}`);
+      await run(args, log);
+      if ((await installed())[packageName] !== version) throw new Error('安装命令结束，但实际版本不匹配');
+      const manifest = JSON.parse(readFileSync(join(environment.profileDir, 'package.json'), 'utf8'));
+      if (!manifest.dsh?.profile?.bundles?.includes(packageName)) throw new Error('包已下载，但尚未注册为 DSH bundle');
+      log('安装并注册完成，请手动重启 DSH 后验证加载');
+    },
+    async uninstall(packageName, log) {
+      if (!(await installed())[packageName]) throw new Error('该插件尚未安装');
+      const args = [...process.execArgv, environment.cli, 'plugin', '--profile', environment.profile, 'remove', packageName];
+      log(`卸载 ${packageName}`);
+      await run(args, log);
+      const manifest = JSON.parse(readFileSync(join(environment.profileDir, 'package.json'), 'utf8'));
+      if (manifest.dependencies?.[packageName] || manifest.dsh?.profile?.bundles?.includes(packageName)) throw new Error('卸载命令结束，但插件仍在 profile 中');
+      log('卸载并取消注册完成，请手动重启 DSH 结束已加载实例');
+    },
+    close() { child?.kill('SIGTERM'); },
+  };
+}

package/src/host-peers.js

@@ -0,0 +1,33 @@
+import { readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
+
+const frontendModules = ['@deepseek-ai/dsh-client-store', '@deepseek-ai/dsh-client-ui-primitives', '@deepseek-ai/dsh-client-ui-slots'];
+// Official tag a66e470: packages/client/web/src/seed.ts and the three package manifests.
+// Published frontends bundle these modules and do not install their devDependencies.
+const verifiedFrontendReleases = { '0.1.2-rc.1': Object.fromEntries(frontendModules.map(name => [name, '0.1.2-rc.1'])) };
+
+export function collectHostPeers(entryManifest) {
+  const peers = {}, queue = [entryManifest], visited = new Set();
+  let frontend;
+  while (queue.length) {
+    const file = queue.shift(); let manifest;
+    try { manifest = JSON.parse(readFileSync(file, 'utf8')); } catch { continue; }
+    if (visited.has(manifest.name)) continue;
+    visited.add(manifest.name);
+    if (manifest.name.startsWith('@deepseek-ai/')) peers[manifest.name] = manifest.version;
+    if (manifest.name === '@deepseek-ai/dsh-web-frontend') frontend = { file, version: manifest.version };
+    const resolver = createRequire(file);
+    for (const name of Object.keys({ ...manifest.dependencies, ...manifest.peerDependencies }).filter(name => name.startsWith('@deepseek-ai/'))) {
+      try { queue.push(resolver.resolve(name + '/package.json')); } catch { /* Unavailable packages stay unknown. */ }
+    }
+  }
+  if (frontend) {
+    const resolver = createRequire(frontend.file);
+    for (const name of frontendModules) {
+      if (peers[name]) continue;
+      try { peers[name] = JSON.parse(readFileSync(resolver.resolve(name + '/package.json'), 'utf8')).version; }
+      catch { if (verifiedFrontendReleases[frontend.version]?.[name]) peers[name] = verifiedFrontendReleases[frontend.version][name]; }
+    }
+  }
+  return peers;
+}

package/src/identity.js

@@ -0,0 +1,15 @@
+export const MARKET_PACKAGE = '@zaimokuza/dsh-plugin-hub';
+export const CATALOG_PACKAGE = '@zaimokuza/dsh-plugin-hub-catalog-demo';
+export const DEFAULT_BRAND = Object.freeze({ title: 'Plugin Hub', subTitle: 'DSH EXTENSIONS', primaryColor: '#596579', navTitle: 'Plugin Hub' });
+export function marketIdentity(id = 'hub') {
+  if (typeof id !== 'string' || !/^[a-z][a-z0-9-]{0,47}$/.test(id)) throw new Error('marketId must be a lowercase identifier (max 48 characters)');
+  return { id, service: 'dshPluginHub_' + id.replaceAll('-', '_'), api: `/dsh-plugin-hub/${id}/api/`, help: `/dsh-plugin-hub/${id}/demo/help` };
+}
+export function normalizeBrand(value = {}) {
+  const brand = { ...DEFAULT_BRAND, ...value };
+  for (const key of ['title', 'subTitle', 'navTitle']) if (typeof brand[key] !== 'string' || !brand[key].trim() || brand[key].length > 80) throw new Error(`Invalid brand ${key}`);
+  const colors = { red: '#c92536', blue: '#2563eb', green: '#16805d', purple: '#7c3aed', orange: '#c65d0b' };
+  brand.primaryColor = colors[brand.primaryColor] ?? brand.primaryColor;
+  if (!/^#[a-f\d]{6}$/i.test(brand.primaryColor)) throw new Error('primaryColor must be #RRGGBB or red/blue/green/purple/orange');
+  return Object.fromEntries(['title','subTitle','navTitle','primaryColor'].map(key => [key, brand[key]]));
+}

package/src/index.js

@@ -0,0 +1,85 @@
+import { MARKET_PACKAGE, CATALOG_PACKAGE, marketIdentity, normalizeBrand } from './identity.js';
+import { readFile } from 'node:fs/promises';
+import { createRequire } from 'node:module';
+import { join } from 'node:path';
+import { createRegistryFetch } from './registry.js';
+import { Marketplace } from './service.js';
+import { dshEnvironment, createDshInstaller } from './dsh.js';
+import { PACKAGE_NAME, validateCatalog } from './catalog.js';
+import { createProviderApi } from './provider-api.js';
+import { readReleaseAge } from './release-age.js';
+
+export const name = MARKET_PACKAGE;
+export const inject = ['webServer', 'connection'];
+
+
+const json = (res, status, value) => { res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' }); res.end(JSON.stringify(value)); };
+
+async function body(req) {
+  const buffers = []; let size = 0;
+  for await (const bytes of req) { size += bytes.length; if (size > 16384) throw new Error('请求过大'); buffers.push(bytes); }
+  return JSON.parse(Buffer.concat(buffers).toString('utf8'));
+}
+
+export async function apply(ctx, options = {}) {
+  for (const [name, fn] of [['connection.requestRejection', ctx.connection?.requestRejection], ['webServer.register', ctx.webServer?.register], ['provide', ctx.provide], ['effect', ctx.effect]]) {
+    if (typeof fn !== 'function') throw new Error(`Plugin Hub cannot start: required DSH API ${name} is unavailable. / 市场无法启动：当前 DSH 缺少必要接口 ${name}。`);
+  }
+  const identity = marketIdentity(options.marketId);
+  const API = identity.api;
+  const brand = normalizeBrand(options.brand);
+  const environment = dshEnvironment(options.profile ?? 'web');
+  const source = { kind: 'npm', packageName: options.catalogPackage ?? CATALOG_PACKAGE };
+  if (options.source) throw new Error('目录来源已改为 Nexus npm 包，请使用 catalogPackage 配置');
+  if (!PACKAGE_NAME.test(source.packageName)) throw new Error('目录 npm 包名无效');
+  const registry = new URL(options.registry ?? 'https://registry.npmjs.org/');
+  if (registry.protocol !== 'https:' || registry.username || registry.password) throw new Error('npm registry 必须是无凭据的 HTTPS 地址');
+  const releaseAge = await readReleaseAge(environment.profileDir);
+  const sources = options.catalogSources ?? [{ id: 'company', displayName: source.packageName === CATALOG_PACKAGE ? 'Demo catalog' : brand.title, ...source, priority: 100 }];
+  if (!Array.isArray(sources) || sources.length > 20 || sources.some(s => s?.kind !== 'npm')) throw new Error('catalogSources must contain at most 20 npm sources; JSON providers register through the plugin API');
+  const config = { source, sources, brand, identity, packageName: options.packageName ?? MARKET_PACKAGE, registry: registry.href.replace(/\/?$/, '/'), cacheDir: join(environment.profileDir, '.dsh-plugin-hub', identity.id), ...releaseAge };
+  const installer = createDshInstaller(environment, config);
+  const market = new Marketplace({ config, host: environment.host, fetcher: createRegistryFetch(config.registry), installer });
+  // The public package ships an independent catalog snapshot for first-open discovery.
+  // Enterprise wrappers do not read it: their catalog name differs from CATALOG_PACKAGE.
+  if (source.packageName === CATALOG_PACKAGE && !options.catalogSources) {
+    try {
+      const file = createRequire(import.meta.url).resolve(CATALOG_PACKAGE + '/plugins.json');
+      market.providers.entries.get('company').value = { catalog: validateCatalog(JSON.parse(await readFile(file, 'utf8'))), source: CATALOG_PACKAGE, version: 'bundled', updatedAt: null };
+    } catch { /* A registry refresh remains available if a snapshot is absent. */ }
+  }
+  if (options.initialCatalog) market.providers.registerSource({ id: 'bundled', displayName: brand.title, kind: 'json', getCatalog: async () => options.initialCatalog }, { primary: true });
+  // Registry availability must not delay or fail DSH boot.
+  await market.init({ refresh: false });
+  ctx.provide(identity.service, createProviderApi(market.providers));
+  void market.refresh().catch(error => { market.catalogError = error.message; });
+  ctx.effect(() => () => { installer.close(); return market.close(); }, 'Plugin Hub: lifecycle');
+  ctx.effect(() => ctx.webServer.register({ kind: 'prefix', path: API.slice(0, -1), async handler(req, res) {
+    const rejection = ctx.connection.requestRejection(req);
+    if (rejection) { json(res, rejection, { error: '请先登录当前 DSH 实例' }); return; }
+    if (req.method === 'POST') {
+      let origin;
+      try { origin = new URL(req.headers.origin).host; } catch { origin = null; }
+      if (!origin || origin !== req.headers.host) { json(res, 403, { error: '请求来源不匹配' }); return; }
+    }
+    try {
+      const path = new URL(req.url, 'http://localhost').pathname.slice(API.length);
+      if (path === 'state' && req.method === 'GET') { json(res, 200, await market.snapshot()); return; }
+      if (req.method !== 'POST') { json(res, 405, { error: '不支持的请求方法' }); return; }
+      if (path === 'refresh-start' && req.method === 'POST') { void market.refresh().catch(error => { market.catalogError = error.message; }); json(res, 202, await market.snapshot()); return; }
+      if (path === 'refresh') { await market.refresh(); json(res, 200, await market.snapshot()); return; }
+      const data = await body(req);
+      if (path === 'releases') { void market.loadReleases(data.packageNames).catch(error => { market.catalogError = error.message; }); json(res, 202, await market.snapshot()); return; }
+      if (path === 'install') { json(res, 202, await market.enqueue(data.packageName, data.version)); return; }
+      if (path === 'uninstall') { json(res, 202, await market.enqueue(data.packageName, undefined, 'uninstall')); return; }
+      json(res, 404, { error: '接口不存在' });
+    } catch (error) { json(res, 400, { error: error.message }); }
+  } }), 'Plugin Hub: HTTP routes');
+
+}
+
+/** Generated brands use this factory without activating the default demo bundle. */
+export function createMarketplace(defaults) {
+  marketIdentity(defaults.marketId);
+  return { name: defaults.packageName, inject, apply: (ctx, options = {}) => apply(ctx, { ...defaults, ...options, brand: { ...defaults.brand, ...options.brand }, marketId: defaults.marketId, packageName: defaults.packageName }) };
+}

package/src/npm-identity.js

@@ -0,0 +1,15 @@
+export function githubRepository(value) {
+  let url=typeof value==='string'?value:value?.url;
+  if(typeof url!=='string')return null;
+  url=url.replace(/^git\+/, '').replace(/^git@github\.com:/, 'https://github.com/');
+  try{const parsed=new URL(url);if(parsed.hostname.toLowerCase()!=='github.com')return null;const parts=parsed.pathname.replace(/\.git\/?$/,'').split('/').filter(Boolean);return parts.length===2?parts.join('/').toLowerCase():null;}catch{return null;}
+}
+/** A repository package name is not enough to identify the same published npm project. */
+export function verifyNpmIdentity(metadata, plugin) {
+  if (!plugin.verification && !githubRepository(plugin.repositoryUrl)) return;
+  const expected=githubRepository(plugin.repositoryUrl);
+  const latest=metadata.versions?.[metadata['dist-tags']?.latest];
+  const actual=githubRepository(latest?.repository??metadata.repository);
+  if(!actual)throw new Error('npm 包未声明可核对的 GitHub 来源');
+  if(actual!==expected)throw new Error('npm 包对应的 GitHub 仓库与目录不一致');
+}

package/src/provider-api.d.ts

@@ -0,0 +1,36 @@
+/** Plugin Hub API v1. Host-side data contributions, not browser UI slots. */
+export interface CatalogPlugin {
+  packageName: string;
+  displayName: string;
+  description: string;
+  owner: string;
+  origin: 'internal' | 'community';
+  tags: string[];
+  documentationUrl?: string;
+  troubleshootingUrl?: string;
+  repositoryUrl?: string;
+  locales?: Record<string, { displayName?: string; description?: string }>;
+}
+export interface Catalog {
+  schemaVersion: 1;
+  plugins: CatalogPlugin[];
+}
+export interface SourceOptions {
+  /** Unique within one marketplace; lowercase letters, digits, dot, dash, underscore. */
+  id: string;
+  displayName?: string;
+  /** -1000 to 1000; higher wins between contributors. Contributors beat main data. */
+  priority?: number;
+  /** Change when cache identity/meaning changes. Never put credentials here. */
+  cacheVersion?: string;
+}
+export type CatalogSource = SourceOptions & (
+  | { kind: 'json'; getCatalog: (options: { signal: AbortSignal }) => Catalog | Promise<Catalog> }
+  | { kind: 'npm'; packageName: string }
+);
+export interface ProviderApi {
+  readonly apiVersion: 1;
+  /** Returns an idempotent disposer; bind it to the contributing plugin's lifecycle. */
+  registerSource(source: CatalogSource): () => void;
+}
+export function createProviderApi(providers: Pick<ProviderApi, 'registerSource'>): ProviderApi;

package/src/provider-api.js

@@ -0,0 +1,7 @@
+/** Public host-side contract; contributors never receive installer or registry access. */
+export function createProviderApi(providers) {
+  return Object.freeze({
+    apiVersion: 1,
+    registerSource: source => providers.registerSource(source),
+  });
+}

package/src/providers.js

@@ -0,0 +1,83 @@
+import { createHash } from 'node:crypto';
+import { readFile, writeFile, rename, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { PACKAGE_NAME, validateCatalog } from './catalog.js';
+import { loadCatalogSource } from './source.js';
+
+/** Host-only v1 API. Providers contribute data; registry and installation policy stay market-owned. */
+export class CatalogProviders {
+  constructor({ cacheDir, registry, fetcher, onChange = () => {}, timeoutMs = 15000 }) {
+    Object.assign(this, { cacheDir, registry, fetcher, onChange, timeoutMs });
+    this.entries = new Map();
+  }
+  registerSource(input, { primary = false } = {}) {
+    if (!input || typeof input.id !== 'string' || !/^[a-z0-9][a-z0-9._-]{0,79}$/.test(input.id)) throw new Error('Invalid catalog source id');
+    if (this.entries.has(input.id)) throw new Error(`Duplicate catalog source id: ${input.id}`);
+    if (this.entries.size >= 20) throw new Error('At most 20 catalog sources are supported');
+    if (!['npm', 'json'].includes(input.kind)) throw new Error('Catalog source kind must be npm or json');
+    if (input.kind === 'npm' && (typeof input.packageName !== 'string' || !PACKAGE_NAME.test(input.packageName) || input.packageName.length > 214)) throw new Error('Invalid catalog package name');
+    if (input.kind === 'json' && typeof input.getCatalog !== 'function') throw new Error('JSON source requires getCatalog({ signal })');
+    if (input.priority !== undefined && (!Number.isInteger(input.priority) || Math.abs(input.priority) > 1000)) throw new Error('Source priority must be an integer between -1000 and 1000');
+    if (input.displayName !== undefined && (typeof input.displayName !== 'string' || input.displayName.length > 80)) throw new Error('Invalid source displayName');
+    if (input.cacheVersion !== undefined && (typeof input.cacheVersion !== 'string' || input.cacheVersion.length > 80)) throw new Error('Invalid source cacheVersion');
+    const source = Object.freeze({ ...input, displayName: input.displayName || input.id, priority: input.priority ?? 0 });
+    const key = JSON.stringify([this.registry, source.id, source.kind, source.packageName, source.cacheVersion ?? '1']);
+    const row = { source, primary, key, value: null, error: null, loaded: false, controller: null };
+    row.file = join(this.cacheDir, 'sources', createHash('sha256').update(key).digest('hex') + '.json');
+    this.entries.set(source.id, row); this.onChange();
+    return () => {
+      if (this.entries.get(source.id) !== row) return;
+      this.entries.delete(source.id); row.controller?.abort(); this.onChange();
+    };
+  }
+  async refresh() {
+    // Bounded batches keep a failed or slow provider from exhausting the registry.
+    const rows = [...this.entries.values()];
+    for (let i = 0; i < rows.length; i += 4) await Promise.all(rows.slice(i, i + 4).map(row => this.refreshOne(row)));
+  }
+  async refreshOne(row) {
+    if (this.entries.get(row.source.id) !== row) return;
+    if (!row.loaded) {
+      row.loaded = true;
+      try {
+        const saved = JSON.parse(await readFile(row.file, 'utf8'));
+        if (saved.key === row.key) row.value = { ...saved.value, catalog: validateCatalog(saved.value.catalog) };
+      } catch { /* No valid cached snapshot; fetch a fresh one. */ }
+    }
+    const controller = new AbortController(); row.controller = controller;
+    let timer;
+    try {
+      const load = async () => {
+        if (row.source.kind === 'npm') return loadCatalogSource(row.source, this.registry, this.fetcher);
+        const data = await row.source.getCatalog({ signal: controller.signal });
+        if (Buffer.byteLength(JSON.stringify(data)) > 32 * 1024 * 1024) throw new Error('响应超过大小限制');
+        return { catalog: validateCatalog(data), source: row.source.id, version: row.source.cacheVersion ?? '1' };
+      };
+      const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => { reject(new Error('目录来源读取超时')); controller.abort(); }, this.timeoutMs);
+        controller.signal.addEventListener('abort', () => reject(new Error('目录来源读取已取消')), { once: true });
+      });
+      const next = await Promise.race([load(), timeout]);
+      if (this.entries.get(row.source.id) !== row) return;
+      const value = { ...next, updatedAt: new Date().toISOString() };
+      await mkdir(join(this.cacheDir, 'sources'), { recursive: true });
+      await writeFile(row.file + '.tmp', JSON.stringify({ key: row.key, value }));
+      await rename(row.file + '.tmp', row.file);
+      if (this.entries.get(row.source.id) === row) { row.value = value; row.error = null; }
+    } catch (error) { row.error = error.message; }
+    finally { clearTimeout(timer); row.controller = null; }
+  }
+  snapshot() {
+    const rows = [...this.entries.values()].sort((a, b) => Number(a.primary) - Number(b.primary) || b.source.priority - a.source.priority || (a.source.id < b.source.id ? -1 : a.source.id > b.source.id ? 1 : 0));
+    const plugins = new Map(); const conflicts = [];
+    for (const row of rows) for (const plugin of row.value?.catalog.plugins ?? []) {
+      if (plugins.has(plugin.packageName)) { plugins.get(plugin.packageName).catalogSourceIds.push(row.source.id); conflicts.push({ packageName: plugin.packageName, selectedSource: plugins.get(plugin.packageName).catalogSource.id, ignoredSource: row.source.id }); continue; }
+      plugins.set(plugin.packageName, { ...plugin, catalogSourceIds: [row.source.id], catalogSource: { id: row.source.id, displayName: row.source.displayName } });
+    }
+    return {
+      plugins: [...plugins.values()], conflicts,
+      sources: rows.map(({ source, primary, value, error }) => ({ primary, id: source.id, displayName: source.displayName, kind: source.kind, packageName: source.packageName, priority: source.priority, version: value?.version ?? null, updatedAt: value?.updatedAt ?? null, count: value?.catalog.plugins.length ?? 0, error, stale: Boolean(error && value) })),
+    };
+  }
+  close() { for (const row of this.entries.values()) row.controller?.abort(); this.entries.clear(); }
+}

package/src/registry.js

@@ -0,0 +1,15 @@
+import { fetch } from 'undici';
+import getRegistryAuthToken from 'registry-auth-token';
+
+/** Use existing npm credentials for the configured Nexus origin; never send them to redirects. */
+export function createRegistryFetch(registry, { fetcher = fetch, authLookup = getRegistryAuthToken } = {}) {
+  const origin = new URL(registry).origin;
+  return async (value, options = {}) => {
+    const url = new URL(value);
+    if (url.origin !== origin || url.protocol !== 'https:' || url.username || url.password) throw new Error('仓库请求地址不属于配置的 Nexus');
+    const auth = authLookup(url.href, { recursive: true });
+    const headers = new Headers(options.headers);
+    if (auth) headers.set('authorization', `${auth.type} ${auth.token}`);
+    return fetcher(url, { ...options, headers, redirect: 'error' });
+  };
+}

package/src/release-age.js

@@ -0,0 +1,34 @@
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const runFile = promisify(execFile);
+const DEFAULT_MINUTES = 48 * 60;
+
+export function parseReleaseAge(output) {
+  // pnpm can print a workspace warning before the queried scalar.
+  const line = String(output).trim().split(/\r?\n/).at(-1);
+  let value;
+  try { value = JSON.parse(line); } catch { value = line; }
+  if (typeof value === 'string' && /^\d+$/.test(value.trim())) value = Number(value.trim());
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0
+    && Number.isSafeInteger(value * 60000) && Date.now() + value * 60000 <= 8640000000000000 ? value : null;
+}
+
+/** Ask the locally installed pnpm for the config effective in the DSH profile. */
+export async function readReleaseAge(cwd, { run = runFile, env = process.env, platform = process.platform } = {}) {
+  let minutes = null;
+  try {
+    const { stdout } = await run(platform === 'win32' ? 'pnpm.cmd' : 'pnpm', ['config', 'get', 'minimumReleaseAge', '--json'], {
+      cwd, timeout: 5000, maxBuffer: 16384, windowsHide: true, shell: platform === 'win32',
+      // Config inspection must not download a different package manager.
+      env: { ...env, COREPACK_ENABLE_NETWORK: '0', COREPACK_ENABLE_PROJECT_SPEC: '0',
+        npm_config_manage_package_manager_versions: 'false', pnpm_config_manage_package_manager_versions: 'false' },
+    });
+    minutes = parseReleaseAge(stdout);
+  } catch { /* Missing executable, unsupported command or timeout: use the fallback. */ }
+  return { minimumAgeMinutes: minutes ?? DEFAULT_MINUTES, minimumAgeHours: (minutes ?? DEFAULT_MINUTES) / 60, releaseAgeSource: minutes === null ? 'default' : 'pnpm' };
+}
+
+export function releaseAgeArgument(config) {
+  return `--config.minimumReleaseAge=${config.minimumAgeMinutes ?? Math.round(config.minimumAgeHours * 60)}`;
+}