@zaimokuza/dsh-plugin-hub 0.1.2 → 0.2.1

package/src/providers.js

@@ -1,85 +0,0 @@
-import { createHash } from 'node:crypto';
-import { readFile, writeFile, rename, mkdir } from 'node:fs/promises';
-import { join } from 'node:path';
-import { PACKAGE_NAME, validateCatalog } from './catalog.js';
-import { loadCatalogSource } from './source.js';
-import { catalogVerification as validateVerification } from './identity.js';
-
-/** Host-only v1 API. Providers contribute data; registry and installation policy stay market-owned. */
-export class CatalogProviders {
-  constructor({ cacheDir, registry, fetcher, onChange = () => {}, timeoutMs = 15000, catalogVerification = 'if-present' }) {
-    Object.assign(this, { cacheDir, registry, fetcher, onChange, timeoutMs });
-    this.catalogVerification = validateVerification(catalogVerification);
-    this.entries = new Map();
-  }
-  registerSource(input, { primary = false } = {}) {
-    if (!input || typeof input.id !== 'string' || !/^[a-z0-9][a-z0-9._-]{0,79}$/.test(input.id)) throw new Error('Invalid catalog source id');
-    if (this.entries.has(input.id)) throw new Error(`Duplicate catalog source id: ${input.id}`);
-    if (this.entries.size >= 20) throw new Error('At most 20 catalog sources are supported');
-    if (!['npm', 'json'].includes(input.kind)) throw new Error('Catalog source kind must be npm or json');
-    if (input.kind === 'npm' && (typeof input.packageName !== 'string' || !PACKAGE_NAME.test(input.packageName) || input.packageName.length > 214)) throw new Error('Invalid catalog package name');
-    if (input.kind === 'json' && typeof input.getCatalog !== 'function') throw new Error('JSON source requires getCatalog({ signal })');
-    if (input.priority !== undefined && (!Number.isInteger(input.priority) || Math.abs(input.priority) > 1000)) throw new Error('Source priority must be an integer between -1000 and 1000');
-    if (input.displayName !== undefined && (typeof input.displayName !== 'string' || input.displayName.length > 80)) throw new Error('Invalid source displayName');
-    if (input.cacheVersion !== undefined && (typeof input.cacheVersion !== 'string' || input.cacheVersion.length > 80)) throw new Error('Invalid source cacheVersion');
-    const source = Object.freeze({ ...input, displayName: input.displayName || input.id, priority: input.priority ?? 0 });
-    const key = JSON.stringify([this.registry, source.id, source.kind, source.packageName, source.cacheVersion ?? '1', source.kind === 'npm' ? this.catalogVerification : null]);
-    const row = { source, primary, key, value: null, error: null, loaded: false, controller: null };
-    row.file = join(this.cacheDir, 'sources', createHash('sha256').update(key).digest('hex') + '.json');
-    this.entries.set(source.id, row); this.onChange();
-    return () => {
-      if (this.entries.get(source.id) !== row) return;
-      this.entries.delete(source.id); row.controller?.abort(); this.onChange();
-    };
-  }
-  async refresh() {
-    // Bounded batches keep a failed or slow provider from exhausting the registry.
-    const rows = [...this.entries.values()];
-    for (let i = 0; i < rows.length; i += 4) await Promise.all(rows.slice(i, i + 4).map(row => this.refreshOne(row)));
-  }
-  async refreshOne(row) {
-    if (this.entries.get(row.source.id) !== row) return;
-    if (!row.loaded) {
-      row.loaded = true;
-      try {
-        const saved = JSON.parse(await readFile(row.file, 'utf8'));
-        if (saved.key === row.key) row.value = { ...saved.value, catalog: validateCatalog(saved.value.catalog) };
-      } catch { /* No valid cached snapshot; fetch a fresh one. */ }
-    }
-    const controller = new AbortController(); row.controller = controller;
-    let timer;
-    try {
-      const load = async () => {
-        if (row.source.kind === 'npm') return loadCatalogSource(row.source, this.registry, this.fetcher, this.catalogVerification);
-        const data = await row.source.getCatalog({ signal: controller.signal });
-        if (Buffer.byteLength(JSON.stringify(data)) > 32 * 1024 * 1024) throw new Error('响应超过大小限制');
-        return { catalog: validateCatalog(data), source: row.source.id, version: row.source.cacheVersion ?? '1' };
-      };
-      const timeout = new Promise((_, reject) => {
-        timer = setTimeout(() => { reject(new Error('目录来源读取超时')); controller.abort(); }, this.timeoutMs);
-        controller.signal.addEventListener('abort', () => reject(new Error('目录来源读取已取消')), { once: true });
-      });
-      const next = await Promise.race([load(), timeout]);
-      if (this.entries.get(row.source.id) !== row) return;
-      const value = { ...next, updatedAt: new Date().toISOString() };
-      await mkdir(join(this.cacheDir, 'sources'), { recursive: true });
-      await writeFile(row.file + '.tmp', JSON.stringify({ key: row.key, value }));
-      await rename(row.file + '.tmp', row.file);
-      if (this.entries.get(row.source.id) === row) { row.value = value; row.error = null; }
-    } catch (error) { row.error = error.message; }
-    finally { clearTimeout(timer); row.controller = null; }
-  }
-  snapshot() {
-    const rows = [...this.entries.values()].sort((a, b) => Number(a.primary) - Number(b.primary) || b.source.priority - a.source.priority || (a.source.id < b.source.id ? -1 : a.source.id > b.source.id ? 1 : 0));
-    const plugins = new Map(); const conflicts = [];
-    for (const row of rows) for (const plugin of row.value?.catalog.plugins ?? []) {
-      if (plugins.has(plugin.packageName)) { plugins.get(plugin.packageName).catalogSourceIds.push(row.source.id); conflicts.push({ packageName: plugin.packageName, selectedSource: plugins.get(plugin.packageName).catalogSource.id, ignoredSource: row.source.id }); continue; }
-      plugins.set(plugin.packageName, { ...plugin, catalogSourceIds: [row.source.id], catalogSource: { id: row.source.id, displayName: row.source.displayName } });
-    }
-    return {
-      plugins: [...plugins.values()], conflicts,
-      sources: rows.map(({ source, primary, value, error }) => ({ primary, id: source.id, displayName: source.displayName, kind: source.kind, packageName: source.packageName, priority: source.priority, version: value?.version ?? null, verification: value?.verification ?? null, updatedAt: value?.updatedAt ?? null, count: value?.catalog.plugins.length ?? 0, error, stale: Boolean(error && value) })),
-    };
-  }
-  close() { for (const row of this.entries.values()) row.controller?.abort(); this.entries.clear(); }
-}

package/src/registry-config.js

@@ -1,27 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { normalizeRegistry } from './identity.js';
-
-const runFile = promisify(execFile);
-const DEFAULT_REGISTRY = 'https://registry.npmjs.org/';
-
-/** Match the profile directory used by DSH's pnpm installer, without downloading tools. */
-export async function readRegistry(explicit, cwd, { run = runFile, env = process.env, platform = process.platform } = {}) {
-  if (explicit !== undefined) return normalizeRegistry(explicit);
-  for (const manager of ['pnpm', 'npm']) {
-    let output;
-    try {
-      const { stdout } = await run(platform === 'win32' ? `${manager}.cmd` : manager, ['config', 'get', 'registry'], {
-        cwd, timeout: 5000, maxBuffer: 16384, windowsHide: true, shell: platform === 'win32',
-        env: { ...env, COREPACK_ENABLE_NETWORK: '0', COREPACK_ENABLE_PROJECT_SPEC: '0',
-          npm_config_manage_package_manager_versions: 'false', pnpm_config_manage_package_manager_versions: 'false' },
-      });
-      output = String(stdout).trim().split(/\r?\n/).at(-1);
-    } catch { continue; }
-    try { output = JSON.parse(output); } catch { /* npm commonly prints an unquoted URL. */ }
-    if (output == null || output === '' || output === 'undefined' || output === 'null') continue;
-    // A configured but invalid address is an error, not permission to query a public registry.
-    return normalizeRegistry(output);
-  }
-  return DEFAULT_REGISTRY;
-}

package/src/registry.js

@@ -1,15 +0,0 @@
-import { fetch } from 'undici';
-import getRegistryAuthToken from 'registry-auth-token';
-
-/** Use existing npm credentials for the configured Nexus origin; never send them to redirects. */
-export function createRegistryFetch(registry, { fetcher = fetch, authLookup = getRegistryAuthToken } = {}) {
-  const origin = new URL(registry).origin;
-  return async (value, options = {}) => {
-    const url = new URL(value);
-    if (url.origin !== origin || url.protocol !== 'https:' || url.username || url.password) throw new Error('仓库请求地址不属于配置的 Nexus');
-    const auth = authLookup(url.href, { recursive: true });
-    const headers = new Headers(options.headers);
-    if (auth) headers.set('authorization', `${auth.type} ${auth.token}`);
-    return fetcher(url, { ...options, headers, redirect: 'error' });
-  };
-}

package/src/release-age.js

@@ -1,34 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-
-const runFile = promisify(execFile);
-const DEFAULT_MINUTES = 48 * 60;
-
-export function parseReleaseAge(output) {
-  // pnpm can print a workspace warning before the queried scalar.
-  const line = String(output).trim().split(/\r?\n/).at(-1);
-  let value;
-  try { value = JSON.parse(line); } catch { value = line; }
-  if (typeof value === 'string' && /^\d+$/.test(value.trim())) value = Number(value.trim());
-  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0
-    && Number.isSafeInteger(value * 60000) && Date.now() + value * 60000 <= 8640000000000000 ? value : null;
-}
-
-/** Ask the locally installed pnpm for the config effective in the DSH profile. */
-export async function readReleaseAge(cwd, { run = runFile, env = process.env, platform = process.platform } = {}) {
-  let minutes = null;
-  try {
-    const { stdout } = await run(platform === 'win32' ? 'pnpm.cmd' : 'pnpm', ['config', 'get', 'minimumReleaseAge', '--json'], {
-      cwd, timeout: 5000, maxBuffer: 16384, windowsHide: true, shell: platform === 'win32',
-      // Config inspection must not download a different package manager.
-      env: { ...env, COREPACK_ENABLE_NETWORK: '0', COREPACK_ENABLE_PROJECT_SPEC: '0',
-        npm_config_manage_package_manager_versions: 'false', pnpm_config_manage_package_manager_versions: 'false' },
-    });
-    minutes = parseReleaseAge(stdout);
-  } catch { /* Missing executable, unsupported command or timeout: use the fallback. */ }
-  return { minimumAgeMinutes: minutes ?? DEFAULT_MINUTES, minimumAgeHours: (minutes ?? DEFAULT_MINUTES) / 60, releaseAgeSource: minutes === null ? 'default' : 'pnpm' };
-}
-
-export function releaseAgeArgument(config) {
-  return `--config.minimumReleaseAge=${config.minimumAgeMinutes ?? Math.round(config.minimumAgeHours * 60)}`;
-}

package/src/service.js

@@ -1,193 +0,0 @@
-import { verifyNpmIdentity } from './npm-identity.js';
-import { MARKET_PACKAGE } from './identity.js';
-import { mkdir, readFile, writeFile, rename } from 'node:fs/promises';
-import { join } from 'node:path';
-import { randomUUID } from 'node:crypto';
-import { releaseList } from './catalog.js';
-import { fetchJson } from './source.js';
-import { CatalogProviders } from './providers.js';
-const { version: marketVersion } = JSON.parse(await readFile(new URL('../package.json', import.meta.url), 'utf8'));
-
-async function readSaved(file) {
-  try { return JSON.parse(await readFile(file, 'utf8')); }
-  catch (error) { if (error.code === 'ENOENT' || error instanceof SyntaxError) return null; throw error; }
-}
-
-export class Marketplace {
-  constructor({ config, host, fetcher, installer, demo }) {
-    Object.assign(this, { config, host, fetcher, installer, demo });
-    this.metadataPending = new Set(); this.metadataWork = Promise.resolve();
-    this.metadataCache = new Map(); this.metadataProgress = { running:false, done:0, total:0 };
-    this.plugins = []; this.jobs = []; this.catalog = null; this.catalogError = null;
-    this.refreshing = null; this.worker = null; this.closed = false; this.persistence = Promise.resolve();
-    this.providers = new CatalogProviders({ ...config, fetcher, onChange: () => {
-      if (!this.initialized || this.closed) return;
-      this.plugins = this.plugins.filter(p => this.providers.entries.has(p.catalogSource.id));
-      this.needsRefresh = true; void this.refresh().catch(error => { this.catalogError = error.message; });
-    } });
-    const configured = config.sources ?? [{ id: 'company', displayName: 'Company catalog', priority: 100, ...config.source }];
-    configured.forEach((source, index) => this.providers.registerSource(source, { primary: index === 0 }));
-    this.simulatedInstalled = demo ? { '@zaimokuza/dsh-acp-adapter': '0.1.2-rc.1.1', 'dsh-markdown-tools': '1.2.0' } : {};
-  }
-  async init({ refresh = true } = {}) {
-    await mkdir(this.config.cacheDir, { recursive: true });
-    const operations = await readSaved(join(this.config.cacheDir, this.demo ? 'demo-jobs.json' : 'jobs.json'));
-    if (Array.isArray(operations)) this.jobs = operations.slice(-30).map(job => ['queued', 'installing'].includes(job.status) ? { ...job, status: 'failed', error: '上次进程中断，请重新安装' } : job);
-    for (const job of this.jobs) if (this.demo && job.status === 'completed') {
-      if (job.action === 'uninstall') delete this.simulatedInstalled[job.packageName];
-      else this.simulatedInstalled[job.packageName] = job.version;
-    }
-    this.initialized = true;
-    if (refresh) await this.refresh();
-  }
-  persistJobs() {
-    // Serialize concurrent queue mutations and atomically replace the persisted snapshot.
-    const file = join(this.config.cacheDir, this.demo ? 'demo-jobs.json' : 'jobs.json');
-    const contents = JSON.stringify(this.jobs, null, 2);
-    this.persistence = this.persistence.catch(() => { /* The caller received the earlier write failure; allow a later snapshot to recover. */ }).then(async () => {
-      await writeFile(file + '.tmp', contents);
-      await rename(file + '.tmp', file);
-    });
-    return this.persistence;
-  }
-  async refresh() {
-    if (this.refreshing) return this.refreshing;
-    this.refreshing = (async () => { do { this.needsRefresh = false; await this.refreshData(); } while (this.needsRefresh && !this.closed); })().finally(() => { this.refreshing = null; });
-    return this.refreshing;
-  }
-  async refreshData() {
-    await this.providers.refresh();
-    const activeRows = new Map(this.providers.entries);
-    const merged = this.providers.snapshot();
-    this.catalog = { catalog: { plugins: merged.plugins }, version: merged.sources.map(s => s.version).filter(Boolean).join(' / ') || null, updatedAt: merged.sources.map(s => s.updatedAt).filter(Boolean).sort().at(-1) ?? null, source: merged.sources.map(s => s.packageName ?? s.id).join(', ') };
-    this.catalogError = merged.sources.filter(s => s.error).map(s => s.error).join('; ') || null;
-    const plugins = merged.plugins.map(plugin => ({ ...plugin, versions: [], recommendedVersion: null, queryError: null, metadataLoading: true }));
-    this.plugins = plugins;
-    this.metadataProgress = { running:true, done:0, total:plugins.length };
-    this.lazyMetadata = plugins.length > 200;
-    if(this.lazyMetadata){ await this.loadReleases(plugins.slice(0,40).map(p=>p.packageName)); return; }
-    // Keep registry load bounded even when the catalog grows.
-    for (let i = 0; !this.closed && i < this.catalog.catalog.plugins.length; i += 6) {
-      const batch = await Promise.all(this.catalog.catalog.plugins.slice(i, i + 6).map(async plugin => {
-        return this.resolvePlugin(plugin);
-      }));
-      plugins.splice(i, batch.length, ...batch);
-      this.plugins = plugins.filter(p => this.providers.entries.get(p.catalogSource.id) === activeRows.get(p.catalogSource.id));
-      this.metadataProgress.done = Math.min(i+batch.length,plugins.length);
-    }
-    this.metadataProgress.running = false;
-    this.plugins = plugins.filter(p => this.providers.entries.get(p.catalogSource.id) === activeRows.get(p.catalogSource.id));
-  }
-  async resolvePlugin(plugin) {
-        try {
-          const cached = this.metadataCache.get(plugin.packageName);
-          const value = !this.demo && cached && Date.now()-cached.time < 300000 ? cached.value : (await fetchJson(this.fetcher, this.config.registry + encodeURIComponent(plugin.packageName))).value;
-          if(!this.demo) { this.metadataCache.set(plugin.packageName,{time:Date.now(),value}); if(this.metadataCache.size>100)this.metadataCache.delete(this.metadataCache.keys().next().value); }
-          verifyNpmIdentity(value, plugin);
-          const versions = releaseList(value, this.host, Date.now(), this.config.minimumAgeHours, plugin);
-          if (!versions.length) throw new Error('仓库没有返回有效的发行版本');
-          return { ...plugin, versions, recommendedVersion: versions.find(v => v.canInstall)?.version ?? null, queryError: null };
-        } catch (error) { return { ...plugin, versions: [], recommendedVersion: null, queryError: error.status === 404 ? '当前 npm 仓库未找到此包（404）' : error.message }; }
-  }
-  async loadReleases(names) {
-    if(!Array.isArray(names)||names.length>40||names.some(name=>typeof name!=='string'))throw new Error('Invalid release request');
-    const wanted=new Set(names);
-    const targets=this.plugins.filter(p=>wanted.has(p.packageName)&&p.metadataLoading&&!this.metadataPending.has(p));
-    for(const plugin of targets)this.metadataPending.add(plugin);
-    if(!targets.length)return this.metadataWork;
-    this.metadataWork=this.metadataWork.catch(()=>{}).then(async()=>{
-      this.metadataProgress.running=true;
-      try {
-        for(let i=0;!this.closed&&i<targets.length;i+=6){
-          const batch=targets.slice(i,i+6);const values=await Promise.all(batch.map(p=>this.resolvePlugin(p)));
-          batch.forEach((target,index)=>{if(this.plugins.includes(target))Object.assign(target,values[index],{metadataLoading:false});});
-          this.metadataProgress.done=this.plugins.filter(p=>!p.metadataLoading).length;
-        }
-      }finally{for(const p of targets)this.metadataPending.delete(p);this.metadataProgress.running=false;}
-    });
-    return this.metadataWork;
-  }
-  async snapshot() {
-    const installed = this.demo ? this.simulatedInstalled : await this.installer.installed();
-    const sourceState = this.providers.snapshot();
-    return {
-      metadataProgress: this.metadataProgress, lazyMetadata: this.lazyMetadata,
-      minimumAgeMinutes: this.config.minimumAgeMinutes ?? Math.round(this.config.minimumAgeHours * 60), releaseAgeSource: this.config.releaseAgeSource ?? 'default',
-      brand: this.config.brand, marketId: this.config.identity?.id, sources: sourceState.sources, sourceConflicts: sourceState.conflicts,
-      marketVersion, host: this.host, demo: Boolean(this.demo), minimumAgeHours: this.config.minimumAgeHours,
-      catalog: { version: this.catalog?.version ?? null, updatedAt: this.catalog?.updatedAt ?? null, source: this.catalog?.source ?? this.config.source?.packageName ?? '', error: this.catalogError, stale: sourceState.sources.some(s => s.stale), count: this.plugins.length },
-      plugins: this.plugins.map(plugin => ({ ...plugin, installedVersion: installed[plugin.packageName] ?? null })),
-      jobs: this.jobs, pendingRestart: this.jobs.filter(job => job.status === 'completed').length,
-      scenario: this.demo?.state.scenario, requests: this.demo?.state.requests ?? [],
-    };
-  }
-  async enqueue(packageName, version, action = 'install') {
-    if (!['install', 'uninstall'].includes(action)) throw new Error('无效的插件操作');
-    if ([MARKET_PACKAGE, this.config.packageName].includes(packageName)) throw new Error('请通过 DSH CLI 管理市场插件自身');
-    if (this.closed) throw new Error('市场正在关闭');
-    if (!this.plugins.some(plugin => plugin.packageName === packageName)) throw new Error('插件不在当前目录中');
-    const pending = this.jobs.find(job => job.packageName === packageName && ['queued', 'installing'].includes(job.status));
-    if (pending) {
-      if ((pending.action ?? 'install') !== action) throw new Error('该插件已有其它操作，请等待完成');
-      return pending;
-    }
-    if (action === 'uninstall') {
-      const installed = this.demo ? this.simulatedInstalled : await this.installer.installed();
-      version = installed[packageName];
-      if (!version) throw new Error('该插件尚未安装');
-    } else {
-      const { value } = await fetchJson(this.fetcher, this.config.registry + encodeURIComponent(packageName));
-      const plugin = this.plugins.find(item => item.packageName === packageName);
-      verifyNpmIdentity(value, plugin);
-      const release = releaseList(value, this.host, Date.now(), this.config.minimumAgeHours, plugin).find(item => item.version === version);
-      if (!release?.canInstall) throw new Error(release?.reasons.join('；') || '该版本不可安装');
-    }
-    // Recheck after network I/O so simultaneous clicks cannot enqueue duplicate work.
-    const raced = this.jobs.find(job => job.packageName === packageName && ['queued', 'installing'].includes(job.status));
-    if (raced) {
-      if ((raced.action ?? 'install') !== action) throw new Error('该插件已有其它操作，请等待完成');
-      return raced;
-    }
-    if (this.jobs.filter(job => ['queued', 'installing'].includes(job.status)).length >= 20) throw new Error('安装队列已满');
-    const job = { id: randomUUID(), packageName, version, action, status: 'queued', demo: Boolean(this.demo), createdAt: new Date().toISOString(), log: [], error: null };
-    this.jobs.push(job);
-    if (this.jobs.length > 30) this.jobs = this.jobs.filter(j => ['queued', 'installing'].includes(j.status) || this.jobs.indexOf(j) >= this.jobs.length - 20);
-    await this.persistJobs();
-    if (!this.worker) this.worker = this.drain().finally(() => { this.worker = null; });
-    return job;
-  }
-  async drain() {
-    while (!this.closed) {
-      const job = this.jobs.find(item => item.status === 'queued');
-      if (!job) return;
-      job.status = 'installing'; await this.persistJobs();
-      try {
-        const log = text => { job.log.push(text); job.log = job.log.slice(-12); };
-        if (this.demo) {
-          log(job.action === 'uninstall' ? '演示：模拟卸载，不修改真实插件' : '演示：模拟下载与安装，不运行 npm/pnpm，也不修改真实插件');
-          await new Promise(resolve => setTimeout(resolve, 1400));
-          if (job.action === 'uninstall') delete this.simulatedInstalled[job.packageName];
-          else this.simulatedInstalled[job.packageName] = job.version;
-          log(job.action === 'uninstall' ? '演示卸载完成；正式卸载需手动重启结束已加载实例' : '演示安装完成；正式安装将在手动重启后加载');
-        } else if (job.action === 'uninstall') await this.installer.uninstall(job.packageName, log);
-        else await this.installer.install(job.packageName, job.version, log);
-        job.status = 'completed';
-      } catch (error) { job.status = 'failed'; job.error = error.message; }
-      await this.persistJobs();
-    }
-  }
-  async setScenario(scenario) {
-    if (!this.demo || !['normal', 'broken', 'offline', 'updated'].includes(scenario)) throw new Error('无效的演示场景');
-    if (this.refreshing) await this.refreshing;
-    this.demo.state.scenario = scenario;
-    await this.refresh();
-  }
-  async resetDemo() {
-    if (!this.demo) throw new Error('只在演示模式可用');
-    if (this.worker) await this.worker;
-    this.jobs = [];
-    this.simulatedInstalled = { '@zaimokuza/dsh-acp-adapter': '0.1.2-rc.1.1', 'dsh-markdown-tools': '1.2.0' };
-    await this.persistJobs();
-  }
-  async close() { this.closed = true; this.providers.close(); if (this.refreshing) await this.refreshing; if (this.worker) await this.worker; await this.metadataWork; await this.demo?.close(); }
-}

package/src/source-plugin.js

@@ -1,9 +0,0 @@
-import { marketIdentity } from './identity.js';
-/** A provider has no UI bundle. Its host service dependency binds it to one market. */
-export function createSourcePlugin({ packageName, catalogPackage, marketId = 'hub', ...source }) {
-  const { service } = marketIdentity(marketId);
-  return { name: packageName, inject: [service], apply(ctx) {
-    if (ctx[service].apiVersion !== 1) throw new Error('Unsupported marketplace source API');
-    ctx.effect(() => ctx[service].registerSource({ ...source, ...(source.kind === 'npm' ? { packageName: catalogPackage } : {}) }), 'Plugin Hub source registration');
-  } };
-}

package/src/source.js

@@ -1,85 +0,0 @@
-import { createHash, timingSafeEqual } from 'node:crypto';
-import { Parser } from 'tar';
-import { validateCatalog } from './catalog.js';
-import { catalogVerification } from './identity.js';
-
-const LIMIT = 5 * 1024 * 1024;
-const CATALOG_LIMIT = 32 * 1024 * 1024;
-
-export async function boundedBytes(response, limit = LIMIT) {
-  if (!response.ok) { const error = new Error(`请求失败（HTTP ${response.status}）`); error.status=response.status; throw error; }
-  const parts = []; let size = 0;
-  for await (const part of response.body) {
-    size += part.length;
-    if (size > limit) throw new Error('响应超过大小限制');
-    parts.push(Buffer.from(part));
-  }
-  return Buffer.concat(parts);
-}
-
-export async function fetchJson(fetcher, url) {
-  const response = await fetcher(url, { headers: { accept: 'application/json' }, signal: AbortSignal.timeout(15000) });
-  const bytes = await boundedBytes(response);
-  try { return { value: JSON.parse(bytes.toString('utf8')), response }; }
-  catch { throw new Error('返回内容不是有效 JSON，已保留上一份可用数据'); }
-}
-
-export function checkIntegrity(bytes, integrity, shasum, policy = 'if-present') {
-  catalogVerification(policy);
-  if (policy === 'none') return 'disabled';
-  const missing = value => value == null || (typeof value === 'string' && !value.trim());
-  // Older npm-compatible registries may expose only the tarball's SHA-1 sum.
-  if (missing(integrity)) {
-    if (missing(shasum) && policy === 'if-present') return 'unavailable';
-    if (typeof shasum !== 'string' || !/^[a-f\d]{40}$/i.test(shasum)) throw new Error('目录 npm 包缺少有效的 integrity 或 shasum，无法校验');
-    const actual = createHash('sha1').update(bytes).digest();
-    if (!timingSafeEqual(actual, Buffer.from(shasum, 'hex'))) throw new Error('目录 npm 包完整性校验失败');
-    return 'shasum';
-  }
-  if (typeof integrity !== 'string') throw new Error('目录 npm 包完整性校验失败');
-  const options = integrity.trim().split(/\s+/).map(token => token.match(/^(sha512|sha384|sha256|sha1)-([A-Za-z0-9+/=]+)$/)).filter(Boolean);
-  const strongest = ['sha512', 'sha384', 'sha256', 'sha1'].find(algorithm => options.some(option => option[1] === algorithm));
-  // A present integrity field must verify; never fall back after a mismatch.
-  if (!options.filter(option => option[1] === strongest).some(([, algorithm, digest]) => {
-    const expected = Buffer.from(digest, 'base64');
-    const actual = createHash(algorithm).update(bytes).digest();
-    return actual.length === expected.length && timingSafeEqual(actual, expected);
-  })) throw new Error('目录 npm 包完整性校验失败');
-  return 'integrity';
-}
-
-/** Read only the data entry from the archive; never extract paths or execute scripts. */
-export function readCatalogTarball(bytes) {
-  return new Promise((resolve, reject) => {
-    let result; let found = 0;
-    const parser = new Parser({ strict: true, onReadEntry(entry) {
-      if (entry.path !== 'package/plugins.json' || entry.type !== 'File') { entry.resume(); return; }
-      if (++found > 1 || entry.size > CATALOG_LIMIT) { reject(new Error('目录包 plugins.json 重复或过大')); entry.resume(); return; }
-      const chunks = []; let size = 0;
-      entry.on('data', chunk => { size += chunk.length; if (size > CATALOG_LIMIT) reject(new Error('目录过大')); else chunks.push(chunk); });
-      entry.on('end', () => { result = Buffer.concat(chunks).toString('utf8'); });
-    } });
-    parser.on('error', reject);
-    parser.on('end', () => {
-      if (found !== 1 || result === undefined) { reject(new Error('目录包缺少 plugins.json')); return; }
-      try { resolve(validateCatalog(JSON.parse(result))); } catch (error) { reject(error instanceof SyntaxError ? new Error('返回内容不是有效 JSON，已保留上一份可用数据') : error); }
-    });
-    parser.end(bytes);
-  });
-}
-
-export async function loadCatalogSource(source, registry, fetcher, policy = 'if-present') {
-  catalogVerification(policy);
-  if (source.kind !== 'npm') throw new Error('目录来源必须是 npm 数据包');
-  const { value: metadata } = await fetchJson(fetcher, registry + encodeURIComponent(source.packageName));
-  const version = metadata['dist-tags']?.latest;
-  const dist = metadata.versions?.[version]?.dist;
-  if (!dist?.tarball) throw new Error('目录 npm 包没有可下载的 latest 版本');
-  // A catalog must stay on its configured registry; no public fallback or credentials forwarding.
-  const url = new URL(dist.tarball);
-  if (url.origin !== new URL(registry).origin || url.username || url.password) throw new Error('目录 tarball 地址不属于配置的仓库');
-  const response = await fetcher(url, { signal: AbortSignal.timeout(15000), redirect: 'error' });
-  const bytes = await boundedBytes(response, CATALOG_LIMIT);
-  const method = checkIntegrity(bytes, dist.integrity, dist.shasum, policy);
-  return { catalog: await readCatalogTarball(bytes), version, source: source.packageName, verification: { policy, method } };
-}