dsh-agent-plugins-market 0.4.3

package/lib/types/discovery/manifests.d.ts

@@ -0,0 +1,55 @@
+import type { SuiteManifest } from '../types.js';
+export type ManifestKind = 'agent-plugin-v1' | 'universal' | 'claude-code' | 'cursor' | 'kimi' | 'codex';
+/** One manifest candidate: its file path and the dialect it selects. */
+export interface ManifestCandidate {
+    kind: ManifestKind;
+    path: string;
+}
+/** The highest-precedence manifest file a directory carries, if any. */
+export declare function detectManifest(dir: string): Promise<ManifestCandidate | undefined>;
+/** Whether a directory carries any known suite manifest. */
+export declare function hasSuiteManifest(dir: string): Promise<boolean>;
+/** Fallback suite identity for manifest-less skill collections. */
+export declare function syntheticManifestName(root: string): string;
+/**
+ * Parse one manifest document into a normalized SuiteManifest. The v1 dialect
+ * is schema-validated (fail-closed); the others are structurally read with
+ * light tolerance, and `hint` (a marketplace plugin entry) fills in gaps.
+ */
+export declare function readManifest(root: string, errors: string[], hint: {
+    name?: string;
+    version?: string;
+    description?: string;
+} | undefined): Promise<SuiteManifest | undefined>;
+export interface MarketplaceEntry {
+    name?: string;
+    version?: string;
+    description?: string;
+    /** Claude Code: a relative path string or `{ source: 'url', url }`.
+     *  Codex: `{ source: 'local', path }` or `{ source: 'remote', url }`. */
+    source: string | {
+        source?: string;
+        url?: string;
+        path?: string;
+    };
+}
+export interface Marketplace {
+    name?: string;
+    entries: MarketplaceEntry[];
+}
+/** Read a marketplace manifest from a checkout root, or undefined when absent. */
+export declare function readMarketplace(checkoutDir: string): Promise<Marketplace | undefined>;
+/** Resolve one marketplace entry to a local checkout-relative directory, or
+ *  `undefined` for remote-URL entries that are not present in the clone. */
+export declare function marketplaceEntryDir(checkoutDir: string, entry: MarketplaceEntry): string | undefined;
+/**
+ * Resolve a repo-level name for source-id derivation, in precedence order:
+ * marketplace plugin entry name > marketplace name > root manifest name >
+ * the checkout basename. The suite repo's own JSON is authoritative; the
+ * basename is only the fallback.
+ */
+export declare function repoName(checkoutDir: string): Promise<string>;
+/** The winning manifest's declared `skills` path (string or array), or undefined. */
+export declare function declaredSkillsPath(root: string): Promise<unknown>;
+/** The winning manifest's inline `mcpServers`, or undefined. */
+export declare function declaredMcpServers(root: string): Promise<Record<string, unknown> | undefined>;

package/lib/types/discovery/surfaces.d.ts

@@ -0,0 +1,15 @@
+import type { McpSuiteConfig, SuiteSkill, SuiteSurfaceCounts } from '../types.js';
+/** Discover SKILL.md files under the suite's skills directory, up to 3 levels deep. */
+export declare function discoverSkills(root: string, errors: string[], declared?: unknown): Promise<SuiteSkill[]>;
+/** Read the suite's MCP config: `mcp.json` or `.mcp.json`, else the winning manifest's inline `mcpServers`. */
+export declare function discoverMcp(root: string, errors: string[]): Promise<McpSuiteConfig | undefined>;
+/** Count surfaces for a suite; mcp counts only validated servers. */
+export declare function countSurfaces(root: string, skills: SuiteSkill[], mcp: McpSuiteConfig | undefined): Promise<SuiteSurfaceCounts>;
+export interface LspEntry {
+    name: string;
+    path: string;
+}
+/** LSP definitions: `.claude-plugin/lsp/*.json` plus reverse-domain `lsp/` dirs. */
+export declare function discoverLspEntries(root: string): Promise<LspEntry[]>;
+/** File names under a suite's commands/ or agents/ directory. */
+export declare function listMdFiles(dir: string): Promise<string[]>;

package/lib/types/discovery.d.ts

@@ -0,0 +1,16 @@
+import type { SourceRef, Suite, SuiteDimension } from './types.js';
+import { repoName } from './discovery/manifests.js';
+import { discoverLspEntries, listMdFiles, type LspEntry } from './discovery/surfaces.js';
+export { repoName, listMdFiles, discoverLspEntries };
+export type { LspEntry };
+/** Discover every suite under one cloned source checkout. */
+export declare function discoverSuitesInSource(checkoutDir: string, sourceId: string, dimension: SuiteDimension): Promise<Suite[]>;
+/** Whether a suite root path lies outside the checkout (defense for malformed marketplace sources). */
+export declare function isOutside(root: string, candidate: string): boolean;
+/**
+ * Discover every suite of one dimension's configured sources, plus manual
+ * checkouts present under the dimension's `.sources/` that no source entry
+ * names. Local sources read their directory directly; git sources read
+ * their clone; a missing checkout contributes nothing.
+ */
+export declare function discoverSourceList(sources: SourceRef[], dimension: SuiteDimension, dimensionRoot: string): Promise<Suite[]>;

package/lib/types/git.d.ts

@@ -0,0 +1,8 @@
+/** Clone a source (depth 1, optional branch) into a not-yet-existing directory. */
+export declare function gitClone(url: string, branch: string | undefined, dest: string, timeoutMs?: number): Promise<void>;
+/** Fast-forward a checked-out source to its configured branch. */
+export declare function gitPull(dir: string, timeoutMs?: number): Promise<void>;
+/** Read the checked-out HEAD commit. */
+export declare function gitHead(dir: string, timeoutMs?: number): Promise<string>;
+/** Remove a source checkout tree entirely. */
+export declare function gitRemove(dir: string): Promise<void>;

package/lib/types/hooks-mounts.d.ts

@@ -0,0 +1,19 @@
+import type { Context } from '@deepseek-ai/cordis';
+import type { Suite } from './types.js';
+export interface HooksMountDiagnostic {
+    suiteId: string;
+    reason: string;
+}
+export declare class HooksMountRegistry {
+    private readonly ctx;
+    private readonly live;
+    constructor(ctx: Context);
+    /** Mount/unmount one bridge per suite to match the enabled suites exactly. */
+    reconcile(enabledSuites: Suite[]): Promise<HooksMountDiagnostic[]>;
+    /** Dispose every live bridge; used at plugin teardown. */
+    disposeAll(): Promise<void>;
+    private mount;
+    private unmount;
+}
+/** The first existing CC hook config of a suite root. */
+export declare function hookConfigPath(root: string): Promise<string | undefined>;

package/lib/types/index.d.ts

@@ -0,0 +1,27 @@
+/**
+ * dsh-agent-plugins-market host entry: the Agent Plugins Market manager.
+ *
+ * Function plugin (named exports, no default export). It registers one skill
+ * provider feeding enabled suites into `ctx.skills`, reconciles enabled
+ * suites' `mcp.json` servers into live `dsh-mcp-client` mounts, injects the
+ * enabled-suite catalog at session start, registers the `agent_plugins`
+ * tool, and mounts the market page's HTTP routes on the web server.
+ *
+ * Requires `ctx.skills` (the dsh skill registry). The MCP client package is
+ * optional at runtime: without it, suites still load their skills and the
+ * manager reports a per-server mount failure.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { SourceRef } from './types.js';
+export declare const name = "dsh-agent-plugins-market";
+export declare const inject: string[];
+/** Host configuration. */
+export interface Config {
+    /** User-dimension suite root; defaults to `~/.dsh/agent-plugins` (`$DSH_HOME/agent-plugins`). */
+    userRoot?: string;
+    /** Per-suite data root backing `${PLUGIN_DATA}`; defaults to `~/.dsh/agent-plugins-data`. */
+    dataRoot?: string;
+    /** Initial repository sources, merged into the persisted state on first load. */
+    sources?: SourceRef[];
+}
+export declare function apply(ctx: Context, config?: Config): void;

package/lib/types/manager.d.ts

@@ -0,0 +1,87 @@
+import type { OverviewPayload, SourceRef, Suite, SuiteDimension } from './types.js';
+export interface ManagerOptions {
+    userRoot: string;
+    dataRoot: string;
+    onChanged: () => void;
+}
+export declare class SuiteManager {
+    private readonly options;
+    private state;
+    private mutationQueue;
+    private readonly statePath;
+    constructor(options: ManagerOptions);
+    /** Load persisted state once at plugin activation. */
+    load(): Promise<void>;
+    get sources(): SourceRef[];
+    /** The user-dimension suite root this manager operates. */
+    get userRoot(): string;
+    /**
+     * One suite's full detail for the market detail modal: manifest fields,
+     * skill metadata, validated mcp.json servers, and per-surface file lists.
+     */
+    suiteDetail(sourceId: string, suiteId: string): Promise<Record<string, unknown>>;
+    private readPreview;
+    /** One skill's full SKILL.md text for the market detail modal. */
+    skillContent(sourceId: string, suiteId: string, skillName: string): Promise<{
+        name: string;
+        description: string;
+        content: string;
+        path: string;
+    }>;
+    /** The full market overview: fresh discovery merged with install entries. */
+    overview(): Promise<OverviewPayload>;
+    /** Enabled user-dimension suites (the MCP mount input). */
+    enabledUserSuites(): Promise<Suite[]>;
+    /** Enabled user- and project-dimension suites for a workspace cwd. */
+    enabledSuitesForCwd(cwd: string): Promise<{
+        user: Suite[];
+        project: Suite[];
+    }>;
+    /** All suites (any enabled state) of one dimension. */
+    suitesForDimension(dimension: SuiteDimension, dimensionRoot: string): Promise<Suite[]>;
+    /**
+     * Add a source and clone it immediately. The id is derived from the suite
+     * repository's own JSON (marketplace plugin entry name first, then the
+     * root manifest name, then the repo basename), sanitized; collisions get a
+     * numeric suffix.
+     */
+    addSource(input: {
+        url: string;
+        branch?: string;
+        local?: boolean;
+    }): Promise<SourceRef>;
+    private uniqueSourceId;
+    /**
+     * Update one source's url / branch / local flag. A git source whose URL
+     * changes drops its stale checkout (the next refresh clones the new URL);
+     * a local source's directory is never touched.
+     */
+    updateSource(sourceId: string, patch: {
+        url?: string;
+        branch?: string;
+        local?: boolean;
+    }): Promise<void>;
+    /** Remove a source: delete its checkout, forget its suites and install entries. */
+    removeSource(sourceId: string): Promise<void>;
+    /** Refresh one source checkout (pull), or every source when `sourceId` is omitted. */
+    refreshSource(sourceId?: string): Promise<void>;
+    /** Install a suite: the source must be cloned; the suite dir becomes an enabled install entry. */
+    install(sourceId: string, suiteId: string): Promise<void>;
+    /** Uninstall a suite: drop the install entry (the source clone stays for browsing). */
+    uninstall(sourceId: string, suiteId: string): Promise<void>;
+    /** Enable or disable an installed suite. */
+    setEnabled(sourceId: string, suiteId: string, enabled: boolean): Promise<void>;
+    /** Append config-seeded sources missing from state and persist; clones lazily on first refresh/install. */
+    mergeSources(sources: SourceRef[]): Promise<void>;
+    private setInstalled;
+    private ensureClone;
+    /** The filesystem location one source is read from. */
+    private sourceCheckoutPath;
+    private discoverDimension;
+    private commandPreviews;
+    private agentPreviews;
+    /** Parse CC hooks.json into flat {event, matcher, command} preview entries. */
+    private hooksPreviews;
+    private lspPreviews;
+    private enqueue;
+}

package/lib/types/mcp-config.d.ts

@@ -0,0 +1,28 @@
+import type { StdioConfig, StreamableHttpConfig } from '@deepseek-ai/dsh-mcp-client';
+import type { Suite } from './types.js';
+export interface McpMountRequest {
+    suiteId: string;
+    serverKey: string;
+    config: StdioConfig | StreamableHttpConfig;
+}
+export interface McpMountFailure {
+    serverKey: string;
+    reason: string;
+}
+/**
+ * Build one mount request per supported mcp.json server.
+ * @returns mount requests plus per-server failures (unsupported transport,
+ *   invalid server key, or derived serverName collision candidates are
+ *   checked by the mount registry, not here).
+ */
+export declare function toMcpMounts(suite: Suite, pluginDataRoot: string): {
+    mounts: McpMountRequest[];
+    failures: McpMountFailure[];
+};
+/**
+ * Derive a stable, unique-ish `dsh-mcp-client` serverName from the suite and
+ * server ids: `${suiteId}__${serverKey}` sanitized, truncated to 32 chars
+ * with a deterministic 12-hex suffix when the join exceeds the budget (the
+ * same deterministic-hash policy the MCP client uses for long tool names).
+ */
+export declare function deriveServerName(suiteId: string, serverKey: string): string;

package/lib/types/mcp-mounts.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Runtime MCP mounts: one live `dsh-mcp-client` child plugin per enabled
+ * suite's mcp.json server, mounted through `ctx.plugin`.
+ *
+ * Mounts reconcile against the enabled-suite set: reconcile() unmounts rows
+ * whose suite was disabled or removed and mounts rows that appeared. A
+ * missing `@deepseek-ai/dsh-mcp-client` install, a duplicate derived
+ * serverName, or a load failure is contained per server — a broken third-party
+ * suite must not take the host down — and reported through the manager's
+ * diagnostic list.
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import type { Suite } from './types.js';
+export interface McpMountDiagnostic {
+    suiteId: string;
+    serverKey: string;
+    reason: string;
+}
+export declare class McpMountRegistry {
+    private readonly ctx;
+    private readonly pluginDataRoot;
+    private readonly live;
+    private readonly names;
+    constructor(ctx: Context, pluginDataRoot: string);
+    /** Mount/unmount MCP servers to match the enabled suites exactly. */
+    reconcile(enabledSuites: Suite[]): Promise<McpMountDiagnostic[]>;
+    /** Dispose every live mount; used at plugin teardown. */
+    disposeAll(): Promise<void>;
+    private mount;
+    private unmount;
+}

package/lib/types/paths.d.ts

@@ -0,0 +1,29 @@
+/** Source checkouts live under `<dimensionRoot>/.sources/<sourceId>/`. */
+export declare const SOURCES_DIR_NAME = ".sources";
+/** Per-suite mutable data directory (the `${PLUGIN_DATA}` placeholder). */
+export declare const DATA_DIR_NAME = "data";
+export declare const STATE_FILE_NAME = "state.json";
+/** Expand a leading `~/` (or `~\` on Windows) to the home directory; other values pass through. */
+export declare function expandHome(path: string): string;
+/** Resolve the harness home (`$DSH_HOME` or `~/.dsh`). */
+export declare function resolveDshHome(): string;
+/** Resolve the user-dimension suite root. */
+export declare function resolveUserRoot(configUserRoot?: string): string;
+/** Resolve the suite data root hosting `${PLUGIN_DATA}` directories. */
+export declare function resolveDataRoot(configDataRoot?: string): string;
+/** Resolve a project root from a workspace cwd: nearest ancestor with `.git`. */
+export declare function findProjectRoot(cwd: string): Promise<string>;
+/** Resolve the project-dimension suite root for a workspace cwd. */
+export declare function resolveProjectRoot(cwd: string): Promise<string>;
+/** Source checkout directory for one source id. */
+export declare function sourcesDir(dimensionRoot: string): string;
+/** Source checkout directory for one source id. */
+export declare function sourceCheckoutDir(dimensionRoot: string, sourceId: string): string;
+/** Per-suite data directory for `${PLUGIN_DATA}`. */
+export declare function suiteDataDir(dataRoot: string, suiteId: string): string;
+/** Async existence probe that follows symlinks for a final component. */
+export declare function isDirectory(path: string): Promise<boolean>;
+/** Sanitize a plugin or server id into `[a-z0-9-]` (lowercased). */
+export declare function sanitizeId(raw: string): string;
+/** Derive a source id from a repository URL or local path: last path segment, `.git` stripped. */
+export declare function deriveSourceId(url: string): string;

package/lib/types/routes.d.ts

@@ -0,0 +1,11 @@
+import type { IncomingMessage, ServerResponse } from 'node:http';
+import type { SuiteManager } from './manager.js';
+export interface WebServerService {
+    register(route: {
+        kind: 'exact' | 'prefix';
+        path: string;
+        handler: (request: IncomingMessage, response: ServerResponse) => void | Promise<void>;
+    }): () => void;
+}
+/** Mount every route; returns the disposer releasing them all. */
+export declare function mountSuiteRoutes(hostCtx: unknown, manager: SuiteManager): () => void;

package/lib/types/skills-parse.d.ts

@@ -0,0 +1,22 @@
+import type { SkillInvocationPolicy } from '@deepseek-ai/dsh-skill';
+export interface ParsedSkillFrontmatter {
+    name: string;
+    description: string;
+    whenToUse?: string;
+    invocation: SkillInvocationPolicy;
+}
+/** Kebab-case skill names only, matching the shipped provider's rule. */
+export declare function isSkillName(name: string): boolean;
+/**
+ * Normalize a display-style skill name into kebab-case (e.g. "Presentations"
+ * → "presentations"), or `undefined` when nothing usable remains.
+ */
+export declare function normalizeSkillName(name: string): string | undefined;
+/**
+ * Parse skill frontmatter with the shipped provider's fail-closed semantics.
+ * @returns the parsed frontmatter, or a rejection string explaining why the
+ *   skill must be dropped from discovery.
+ */
+export declare function parseSkillFrontmatter(text: string, expectedName: string | undefined): ParsedSkillFrontmatter | string;
+/** Strip the frontmatter block, returning the instruction body. */
+export declare function stripFrontmatter(text: string): string;

package/lib/types/skills-provider.d.ts

@@ -0,0 +1,16 @@
+import type { SkillCandidate, SkillDefinition, SkillLookupOptions, SkillProvider } from '@deepseek-ai/dsh-skill';
+import type { SuiteManager } from './manager.js';
+export declare const SUITE_PROJECT_SOURCE = "agent-plugin-project";
+export declare const SUITE_USER_SOURCE = "agent-plugin-user";
+export declare class SuiteSkillProvider implements SkillProvider {
+    private readonly manager;
+    readonly name = "agent-plugin";
+    constructor(manager: SuiteManager);
+    list(options: SkillLookupOptions): Promise<SkillCandidate[]>;
+    /** Parse `agents/*.md` of one suite into agent-definition candidates. */
+    private agentsOf;
+    get(candidate: SkillCandidate, options: SkillLookupOptions): Promise<SkillDefinition | undefined>;
+    private candidateFor;
+    private locate;
+    private locateProject;
+}

package/lib/types/state.d.ts

@@ -0,0 +1,6 @@
+import type { SuiteState } from './types.js';
+export declare const EMPTY_STATE: SuiteState;
+/** Parse persisted state; unreadable or wrong-version files yield a contained empty state. */
+export declare function loadState(statePath: string): Promise<SuiteState>;
+/** Persist state atomically through a sibling-temp rename. */
+export declare function saveState(statePath: string, state: SuiteState): Promise<void>;

package/lib/types/types.d.ts

@@ -0,0 +1,165 @@
+/**
+ * Shared shapes for the dsh-agent-plugins-market Agent Plugins manager.
+ *
+ * A suite is the portable Agent Plugins package defined by the
+ * agent-plugins.org v1.0.0 specification, plus the two dialect layouts this
+ * manager normalizes as inputs (Claude Code `.claude-plugin/plugin.json` and
+ * Codex `.codex-plugin/plugin.json`). Discovery maps every layout onto this
+ * internal shape; runtime injection consumes only the internal shape.
+ */
+/** One configured repository source. */
+export interface SourceRef {
+    /** Stable local id; `[a-z0-9][a-z0-9-]*`, unique across sources. */
+    id: string;
+    /** Git URL to clone, or a local directory path when `local` is set. */
+    url: string;
+    /** Optional branch to pin (git sources only). */
+    branch?: string;
+    /** Read the source directory directly instead of cloning it. */
+    local?: boolean;
+}
+/** The manifest layout a suite root was discovered under. */
+export type SuiteLayoutKind = 'agent-plugin-v1' | 'universal' | 'claude-code' | 'cursor' | 'kimi' | 'codex' | 'skill-collection' | 'remote';
+/** Normalized suite manifest fields. */
+export interface SuiteManifest {
+    layout: SuiteLayoutKind;
+    /** Absolute manifest file path. */
+    path: string;
+    /** Suite id derived from the manifest name or its root directory, sanitized to `[a-z0-9-]`. */
+    id: string;
+    name: string;
+    version?: string;
+    description?: string;
+    author?: string;
+    keywords?: string[];
+    /** For agent-plugin-v1: the recognized `$schema` identifier. */
+    schemaVersion?: string;
+}
+/** One skill shipped inside a suite (`<suiteRoot>/skills/<name>/SKILL.md`). */
+export interface SuiteSkill {
+    /** Skill directory name; validated kebab-case. */
+    name: string;
+    /** Absolute skill directory. */
+    directory: string;
+    /** Absolute SKILL.md path. */
+    file: string;
+    /** Frontmatter description, required for model catalogs. */
+    description: string;
+    /** Optional extra routing guidance from frontmatter. */
+    whenToUse?: string;
+    /** Invocation policy parsed from frontmatter with fail-closed semantics. */
+    invocation: {
+        modelInvocable: boolean;
+        userInvocable: boolean;
+    };
+}
+/** Counted surface tags rendered on market cards. */
+export interface SuiteSurfaceCounts {
+    skills: number;
+    mcp: number;
+    hooks: number;
+    commands: number;
+    agents: number;
+    lsp: number;
+}
+/** agent-plugins.org v1 `mcp.json` server variants. */
+export interface McpServerStdio {
+    type: 'stdio';
+    command: string;
+    args?: string[];
+    env?: Record<string, string>;
+    cwd?: string;
+}
+export interface McpServerStreamableHttp {
+    type: 'streamable-http';
+    url: string;
+    headers?: Record<string, string>;
+}
+export interface McpServerSse {
+    type: 'sse';
+    url: string;
+    headers?: Record<string, string>;
+}
+export type McpServer = McpServerStdio | McpServerStreamableHttp | McpServerSse;
+/** Parsed and validated `mcp.json` content. */
+export interface McpSuiteConfig {
+    schema: string;
+    servers: Record<string, McpServer>;
+}
+/** Install dimension of a suite. */
+export type SuiteDimension = 'user' | 'project';
+/** One discovered suite with runtime-relevant fields resolved. */
+export interface Suite {
+    sourceId: string;
+    id: string;
+    root: string;
+    manifest: SuiteManifest;
+    skills: SuiteSkill[];
+    /** Validated mcp.json content; absent when the file is missing or invalid. */
+    mcp?: McpSuiteConfig;
+    surfaces: SuiteSurfaceCounts;
+    dimension: SuiteDimension;
+    enabled: boolean;
+    lockCommit?: string;
+    installedAt?: string;
+    /** Remote marketplace reference (not cloned): the source URL plus the
+     *  marketplace entry metadata; no local content is available. */
+    remote?: {
+        url: string;
+    };
+    /** Discovery/validation failures for this suite; skills of a suite with a
+     * broken manifest are still exposed when they parse, per spec §7.1. */
+    errors: string[];
+}
+/** Persisted install entry, keyed `${sourceId}/${suiteId}`. */
+export interface InstalledEntry {
+    enabled: boolean;
+    lockCommit?: string;
+    installedAt: string;
+}
+/** The persisted suite state file (`<dimensionRoot>/state.json`). */
+export interface SuiteState {
+    version: 1;
+    sources: SourceRef[];
+    installed: Record<string, InstalledEntry>;
+}
+/** Card-shaped view for the market UI. */
+export interface SuiteOverviewCard {
+    sourceId: string;
+    suiteId: string;
+    name: string;
+    version?: string;
+    description?: string;
+    keywords: string[];
+    surfaces: SuiteSurfaceCounts;
+    enabled: boolean;
+    installed: boolean;
+    dimension: SuiteDimension;
+    layout: SuiteLayoutKind;
+    errors: string[];
+}
+export interface SourceOverview {
+    id: string;
+    url: string;
+    branch?: string;
+    /** Local-directory source (read directly, never cloned or deleted). */
+    local?: boolean;
+    /** Whether the checkout (or local directory) is present. */
+    cloned: boolean;
+    lockCommit?: string;
+    error?: string;
+    suiteIds: string[];
+}
+export interface OverviewPayload {
+    sources: SourceOverview[];
+    suites: SuiteOverviewCard[];
+    totals: {
+        all: number;
+        installed: number;
+        enabled: number;
+    };
+    roots: {
+        user: string;
+        data: string;
+    };
+}

package/lib/types/validate.d.ts

@@ -0,0 +1,34 @@
+import type { McpSuiteConfig } from './types.js';
+export declare const PLUGIN_SCHEMA_ID = "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json";
+export declare const MCP_SCHEMA_ID = "https://agent-plugins.org/schemas/1.0.0/mcp.schema.json";
+/** Validate one JSON document against a vendored schema; errors joined for surfacing. */
+export declare function validateAgainstSchema(schemaId: string, document: unknown): Promise<string[]>;
+/** Whether a `$schema` value selects the local v1.0.0 ruleset. */
+export declare function isRecognizedSchema(value: unknown): boolean;
+/**
+ * Spec §4 containment: a plugin-relative path must begin with `./` and, after
+ * resolution against the plugin root, stay inside the filesystem-resolved
+ * plugin root. Symlinks resolving outside the root are rejected.
+ * @returns `undefined` when contained, or the rejection reason.
+ */
+export declare function pathContainmentError(pluginRoot: string, value: string): Promise<string | undefined>;
+/** Validate a plugin manifest per the vendored schema plus `$schema` recognition. */
+export declare function validatePluginManifest(raw: unknown): Promise<string[]>;
+export interface McpValidateOptions {
+    /** Strict portable mode (`mcp.json`): `$schema` required and schema-validated.
+     *  Lenient mode (`.mcp.json`, native client file): no `$schema` requirement,
+     *  unknown transports skipped per server, known transports still validated. */
+    strict?: boolean;
+}
+export declare function validateMcpJson(pluginRoot: string, raw: unknown, options?: McpValidateOptions): Promise<{
+    config?: McpSuiteConfig;
+    errors: string[];
+}>;
+/** Expand `${PLUGIN_ROOT}`, `${PLUGIN_DATA}`, and `${NAME}` (process env) in one string.
+ *  Claude Code aliases `${CLAUDE_PLUGIN_ROOT}` / `${CLAUDE_PLUGIN_DATA}` and
+ *  `${NAME:-default}` fallbacks are honored for unset/empty env vars. */
+export declare function expandPlaceholders(value: string, pluginRoot: string, pluginData: string, env?: NodeJS.ProcessEnv): string;
+/** Resolve an expanded plugin-relative cwd to an absolute path. */
+export declare function resolveCwd(value: string, pluginRoot: string, pluginData: string): string;
+/** Whether one absolute path equals or lies under another absolute path. */
+export declare function isWithin(root: string, candidate: string): boolean;

package/lib/types.js

@@ -0,0 +1,10 @@
+/**
+ * Shared shapes for the dsh-agent-plugins-market Agent Plugins manager.
+ *
+ * A suite is the portable Agent Plugins package defined by the
+ * agent-plugins.org v1.0.0 specification, plus the two dialect layouts this
+ * manager normalizes as inputs (Claude Code `.claude-plugin/plugin.json` and
+ * Codex `.codex-plugin/plugin.json`). Discovery maps every layout onto this
+ * internal shape; runtime injection consumes only the internal shape.
+ */
+export {};