dshmarket 1.2.2 → 1.2.3

package/src/sources.ts

@@ -0,0 +1,84 @@
+/**
+ * Registry-source knowledge: how a curated registry entry's URL maps to an
+ * installable pnpm target. Pure string logic, no I/O.
+ */
+
+const REPO_RE = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/
+
+/** Registry tarball names must be plain npm package names, nothing fancier. */
+const NPM_NAME_RE = /^(@[a-z0-9-~][a-z0-9-._~]*\/)?[a-z0-9-~][a-z0-9-._~]*$/
+
+/**
+ * Parse a registry source url: a github repo, optionally with a
+ * `/tree/<branch>/<subpath>` suffix (how the curated list links monorepo
+ * subpackages, e.g. dsh-plugins#theme-gallery).
+ */
+export function parseSourceUrl(url: string): { repo: string; subpath: string | null } | null {
+  const m = /^https:\/\/github\.com\/([^/]+\/[^/]+?)(?:\/tree\/[^/]+\/(.+?))?\/?$/.exec(url)
+  if (m === null || !REPO_RE.test(m[1])) return null
+  const subpath = m[2] ?? null
+  if (subpath !== null) {
+    if (!/^[A-Za-z0-9_./-]+$/.test(subpath)) return null
+    // No empty/dot segments: `..` would escape the repo in the #path: selector.
+    if (subpath.split('/').some(seg => seg === '' || seg === '.' || seg === '..')) return null
+  }
+  return { repo: m[1], subpath }
+}
+
+/** GitHub `owner/repo` for a registry URL, or null when it is not a GitHub repo URL. */
+export function repoOf(url: string): string | null {
+  return parseSourceUrl(url)?.repo ?? null
+}
+
+/**
+ * The pnpm install target for a registry entry. Registry tarballs beat
+ * full-repo GitHub downloads: smaller, prebuilt, and CDN/mirror served. The
+ * npm name comes from our curated registry, which only maps repo-verified
+ * packages (name-squatting protection).
+ * @returns the target spec, or null when the source url is unsupported.
+ */
+export function installTargetFor(entry: { url: string; npm?: unknown }): string | null {
+  const source = parseSourceUrl(entry.url)
+  if (source === null) return null
+  if (typeof entry.npm === 'string' && NPM_NAME_RE.test(entry.npm)) return entry.npm
+  return source.subpath !== null
+    ? `github:${source.repo}#path:/${source.subpath}`
+    : `github:${source.repo}`
+}
+
+/**
+ * The name an entry is ALREADY installed under, or null — the server-side
+ * duplicate guard (#27): the same plugin listed under an alias entry must
+ * never install twice (two loader entries with one id brick the next boot).
+ *
+ * Identity is subpath-aware so monorepo siblings stay independent: an entry
+ * with a /tree/ subpath identifies as repo#path:/sub (never the bare repo),
+ * while an installed dependency contributes its bare repo AND its #path:
+ * form — so a collection root still matches the pieces it was retargeted
+ * into, but two different subpackages of one repo never cross-match.
+ */
+export function findInstalledAlias(
+  entry: { name: string; npm?: unknown; url: string },
+  installed: Record<string, string>,
+): string | null {
+  const source = parseSourceUrl(entry.url)
+  const ids = new Set<string>([entry.name.toLowerCase()])
+  if (typeof entry.npm === 'string' && entry.npm !== '') ids.add(entry.npm.toLowerCase())
+  if (source !== null) {
+    ids.add(source.subpath === null
+      ? source.repo.toLowerCase()
+      : `${source.repo.toLowerCase()}#path:/${source.subpath.toLowerCase()}`)
+  }
+  for (const [name, spec] of Object.entries(installed)) {
+    const dep = new Set<string>([name.toLowerCase()])
+    const scoped = /^@([^/]+)\/(.+)$/.exec(name)
+    if (scoped !== null) dep.add(`${scoped[1]}/${scoped[2]}`.toLowerCase())
+    const m = /github:([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+)(?:#path:\/([A-Za-z0-9_./-]+))?/i.exec(spec)
+    if (m !== null) {
+      dep.add(m[1].toLowerCase())
+      if (m[2] !== undefined) dep.add(`${m[1].toLowerCase()}#path:/${m[2].toLowerCase()}`)
+    }
+    for (const id of dep) if (ids.has(id)) return name
+  }
+  return null
+}

package/src/themes.ts

@@ -0,0 +1,120 @@
+/**
+ * Theme lifecycle: classifying installed packages as themes (by the
+ * registry's theme category), live-toggling bundle-layer entries through
+ * the loader, and keeping exactly one theme active with the choice
+ * persisted across restarts.
+ */
+
+import { loadRegistry } from './registry.ts'
+import { hotMount, hotUnmount, listHotMounts, writeDisabledThemes } from './hot.ts'
+import { logEvent } from './log.ts'
+import { profileDir, readInstalled } from './profile.ts'
+import { repoOf } from './sources.ts'
+
+/** The slice of a cordis loader entry the market needs for live enable/disable. */
+export interface LoaderEntry {
+  options: { id?: string; name?: string; disabled?: boolean | null }
+  fiber?: unknown
+  update(options: { disabled: boolean | null }, create?: boolean, force?: boolean): Promise<void>
+}
+
+/** The host surface the theme manager needs (loader entries + hot-mount context). */
+export interface ThemeHost {
+  loader: { entries(): Iterable<LoaderEntry> }
+  plugin(plugin: unknown, config: unknown): { await(): Promise<unknown>; dispose(): Promise<unknown> | void }
+}
+
+/** Manages theme exclusivity for one profile. */
+export interface ThemeManager {
+  installedThemeNames(): Promise<Set<string>>
+  setEntryDisabled(name: string, disabledFlag: boolean): Promise<boolean>
+  activateTheme(name: string): Promise<boolean>
+}
+
+/**
+ * Create the theme manager. `disabledThemes` is the live, shared set of
+ * themes the user switched off — the caller owns reading it at boot and
+ * replaying it; the manager mutates and persists it on switches.
+ */
+export function createThemeManager(host: ThemeHost, profile: string, disabledThemes: Set<string>): ThemeManager {
+  /** Installed package names classified as themes by the registry's theme category. */
+  async function installedThemeNames(): Promise<Set<string>> {
+    const names = new Set<string>()
+    try {
+      const { registry } = await loadRegistry()
+      const themeEntries = registry.plugins.filter(p => p.category === 'theme')
+      const themeNames = new Set(themeEntries.map(p => p.name))
+      const themeRepos = new Set(
+        themeEntries.map(p => repoOf(p.url)).filter((r): r is string => r !== null).map(r => r.toLowerCase()),
+      )
+      for (const [name, spec] of Object.entries(readInstalled(profile))) {
+        if (themeNames.has(name)) {
+          names.add(name)
+          continue
+        }
+        const match = /github:([^#\s]+)/.exec(String(spec).toLowerCase())
+        if (match !== null && themeRepos.has(match[1])) names.add(name)
+      }
+    } catch { /* registry unavailable — nothing classifies as a theme */ }
+    return names
+  }
+
+  /**
+   * Live-toggle a bundle-layer plugin through its loader entry. Bundle trees
+   * are in-memory (write is a no-op), so this never touches any file — the
+   * market persists the choice itself and replays it at boot.
+   * @returns true when a matching live entry was found and updated.
+   */
+  async function setEntryDisabled(name: string, disabledFlag: boolean): Promise<boolean> {
+    let found = false
+    for (const entry of host.loader.entries()) {
+      if (entry.options.name !== name) continue
+      // A disable can land while the entry's init is still in flight: the
+      // options flip but the finishing init brings the fiber up anyway, and a
+      // plain re-update no-ops on the empty diff. Force the update and verify
+      // the live state, retrying until reality matches the flag.
+      for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+          await entry.update({ disabled: disabledFlag ? true : null }, false, true)
+          found = true
+        } catch (error) {
+          logEvent('warn', 'toggle', `${name}: entry update failed — ${error instanceof Error ? error.message : String(error)}`)
+          break
+        }
+        const live = entry.fiber !== undefined
+        if (live !== disabledFlag) break
+        await new Promise(resolvePromise => setTimeout(resolvePromise, 200))
+      }
+      logEvent('info', 'toggle',
+        `${name} -> ${disabledFlag ? 'off' : 'on'}: fiber=${String(entry.fiber !== undefined)}`)
+    }
+    if (!found) logEvent('info', 'toggle', `${name}: no loader entry matched`)
+    return found
+  }
+
+  /**
+   * Make `name` the one active theme: deactivate every other installed theme
+   * (market hot mounts unmount; bundle-layer entries live-disable) and bring
+   * it up. The choice persists in state.json and is replayed at boot.
+   */
+  async function activateTheme(name: string): Promise<boolean> {
+    const dir = profileDir(profile)
+    const themes = await installedThemeNames()
+    for (const other of themes) {
+      if (other === name) continue
+      if (listHotMounts().includes(other)) {
+        await hotUnmount(other)
+        disabledThemes.add(other)
+      } else if (await setEntryDisabled(other, true)) {
+        disabledThemes.add(other)
+      }
+    }
+    disabledThemes.delete(name)
+    writeDisabledThemes(dir, disabledThemes)
+    if (listHotMounts().includes(name)) return true
+    if (await setEntryDisabled(name, false)) return true
+    return hotMount(host, dir, name)
+  }
+
+  return { installedThemeNames, setEntryDisabled, activateTheme }
+}

package/src/updates.ts

@@ -0,0 +1,70 @@
+/**
+ * Update detection: per-plugin comparison of what the profile has against
+ * the source of truth — git HEAD for github installs, the npm latest
+ * dist-tag for registry installs — with a TTL cache.
+ */
+
+import { readInstalled, readInstalledVersion, readLockCommits } from './profile.ts'
+
+export interface UpdateStatus {
+  kind: 'github' | 'npm' | 'linked'
+  version: string | null
+  current: string | null
+  latest: string | null
+  updateAvailable: boolean
+}
+
+const UPDATES_TTL_MS = 30 * 60 * 1000
+let updatesCache: { at: number; data: Record<string, UpdateStatus> } | null = null
+
+/** Drop the cached listing (after a successful install/update/uninstall). */
+export function invalidateUpdates(): void {
+  updatesCache = null
+}
+
+async function fetchJson(url: string): Promise<unknown> {
+  const res = await fetch(url, {
+    headers: { accept: 'application/json', 'user-agent': 'dsh-market' },
+    signal: AbortSignal.timeout(4000),
+  })
+  if (!res.ok) throw new Error(`HTTP ${res.status}`)
+  return res.json() as unknown
+}
+
+/** Per-plugin update checks; a failed check reports no update rather than failing the listing. */
+export async function checkUpdates(profile: string, force = false): Promise<Record<string, UpdateStatus>> {
+  if (!force && updatesCache && Date.now() - updatesCache.at < UPDATES_TTL_MS) return updatesCache.data
+  const installed = readInstalled(profile)
+  const lockCommits = readLockCommits(profile)
+  const result: Record<string, UpdateStatus> = {}
+  await Promise.all(Object.entries(installed).map(async ([name, spec]) => {
+    const version = readInstalledVersion(profile, name)
+    if (spec.startsWith('link:') || spec.startsWith('file:')) {
+      result[name] = { kind: 'linked', version, current: null, latest: null, updateAvailable: false }
+      return
+    }
+    const gh = /^(?:github:)?([A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+?)(?:#.*)?$/.exec(spec)
+    try {
+      if (spec.startsWith('github:') && gh !== null) {
+        const current = lockCommits.get(gh[1].toLowerCase()) ?? null
+        const head = (await fetchJson(`https://api.github.com/repos/${gh[1]}/commits/HEAD`)) as { sha?: string }
+        const latest = typeof head.sha === 'string' ? head.sha : null
+        result[name] = {
+          kind: 'github', version, current, latest,
+          updateAvailable: current !== null && latest !== null && current !== latest,
+        }
+      } else {
+        const meta = (await fetchJson(`https://registry.npmjs.org/${encodeURIComponent(name)}/latest`)) as { version?: string }
+        const latest = typeof meta.version === 'string' ? meta.version : null
+        result[name] = {
+          kind: 'npm', version, current: version, latest,
+          updateAvailable: version !== null && latest !== null && version !== latest,
+        }
+      }
+    } catch {
+      result[name] = { kind: spec.startsWith('github:') ? 'github' : 'npm', version, current: null, latest: null, updateAvailable: false }
+    }
+  }))
+  updatesCache = { at: Date.now(), data: result }
+  return result
+}