flower-trellis 0.6.4 → 0.6.6

package/src/lib/telemetry.js

@@ -1,367 +1,18 @@
-import crypto from "node:crypto";
-import fs from "node:fs";
-import path from "node:path";
-import { flowerConfigDirectory } from "../plugin/sources/user-source-store.js";
-import { ProjectStore } from "../plugin/state/project-store.js";
-import { SKILL_GARDEN_PLUGIN_ID } from "../builtin-plugins/skill-garden/provider.js";
-import { readGitDeveloper } from "./developer.js";
-import { readManifest, readUpdateCheck } from "./manifest.js";
-import { flowerVersion, trellisVersion } from "./versions.js";
+import { queueLegacyTelemetry } from "./telemetry-queue.js";
 
-/** Flower 遥测接收地址。主机名与 `/api/flower-trellis` 路由前缀都由服务端契约固定,缺一不可。 */
-export const FLOWER_TELEMETRY_ENDPOINT = "https://ai-api.hub.flower-cli.com/api/flower-trellis/telemetry";
+// 对外保留旧模块入口；队列只依赖 context，避免兼容入口反向形成循环。
+export {
+  FLOWER_TELEMETRY_ENDPOINT, telemetryStatePath, readTelemetryState,
+  setTelemetryEnabled, buildTelemetryPayload,
+} from "./telemetry-context.js";
 
-const TELEMETRY_SCHEMA_VERSION = 1;
-/** 遥测请求保留 10 秒公网预算，避免慢速 TLS 建连或服务端响应被过早中止。 */
-const DEFAULT_TIMEOUT_MS = 10000;
-const VERSION_PATTERN = /^[0-9A-Za-z][0-9A-Za-z.+_-]{0,63}$/;
-const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
-const EVENTS = new Set(["version_check", "init_completed", "update_completed"]);
-
-/**
- * 规范化可上报的开发者名称。
- *
- * @param {unknown} value 原始名称
- * @returns {string|null} 有效名称，无法使用时返回 null
- */
-function normalizeDeveloperName(value) {
-  if (typeof value !== "string") return null;
-  const name = value.trim();
-  return name && name.length <= 100 ? name : null;
-}
-
-/**
- * 返回 Flower 用户级遥测状态文件路径。
- *
- * @param {NodeJS.ProcessEnv} [env] 环境变量
- * @returns {string} 状态文件绝对路径
- */
-export function telemetryStatePath(env = process.env) {
-  return path.join(flowerConfigDirectory(env), "telemetry.json");
-}
-
-/**
- * 校验并规范化遥测状态。
- *
- * @param {unknown} value 原始状态
- * @returns {object} 规范化状态
- */
-function normalizeTelemetryState(value) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new TypeError("遥测状态必须是对象");
-  }
-  if (value.schemaVersion !== TELEMETRY_SCHEMA_VERSION) {
-    throw new TypeError("遥测状态 schemaVersion 无效");
-  }
-  if (!UUID_PATTERN.test(String(value.deviceId || ""))) {
-    throw new TypeError("遥测设备 ID 无效");
-  }
-  if (typeof value.enabled !== "boolean") {
-    throw new TypeError("遥测 enabled 无效");
-  }
-  const developerName = normalizeDeveloperName(value.developerName);
-  if (value.developerName !== undefined && value.developerName !== null && !developerName) {
-    throw new TypeError("遥测 developerName 无效");
-  }
-  for (const field of ["lastAttemptAt", "lastSuccessAt"]) {
-    if (value[field] !== null && (
-      typeof value[field] !== "string" || Number.isNaN(Date.parse(value[field]))
-    )) {
-      throw new TypeError(`遥测 ${field} 无效`);
-    }
-  }
-  return {
-    schemaVersion: TELEMETRY_SCHEMA_VERSION,
-    deviceId: value.deviceId,
-    developerName,
-    enabled: value.enabled,
-    lastAttemptAt: value.lastAttemptAt,
-    lastSuccessAt: value.lastSuccessAt,
-  };
-}
-
-/**
- * 读取用户级遥测状态，并区分缺失与损坏。
- *
- * @param {{env?:NodeJS.ProcessEnv}} [options] 读取选项
- * @returns {{status:"missing"|"valid"|"corrupt",state:object|null,path:string,error?:Error}} 状态读取结果
- */
-export function readTelemetryState(options = {}) {
-  const filePath = telemetryStatePath(options.env);
-  try {
-    const stat = fs.lstatSync(filePath);
-    if (stat.isSymbolicLink() || !stat.isFile()) {
-      throw new TypeError("遥测状态必须是普通文件");
-    }
-    const state = normalizeTelemetryState(JSON.parse(fs.readFileSync(filePath, "utf8")));
-    return { status: "valid", state, path: filePath };
-  } catch (error) {
-    if (error?.code === "ENOENT") return { status: "missing", state: null, path: filePath };
-    return { status: "corrupt", state: null, path: filePath, error };
-  }
-}
-
-/**
- * 原子写入用户级遥测状态。
- *
- * @param {object} state 已规范化状态
- * @param {{env?:NodeJS.ProcessEnv,randomBytes?:(size:number)=>Buffer}} [options] 写入选项
- * @returns {object} 写入后的状态
- */
-function writeTelemetryState(state, options = {}) {
-  const filePath = telemetryStatePath(options.env);
-  const parent = path.dirname(filePath);
-  const randomBytes = options.randomBytes || crypto.randomBytes;
-  const temporary = path.join(
-    parent,
-    `.${path.basename(filePath)}.${process.pid}.${randomBytes(6).toString("hex")}.tmp`,
-  );
-  const normalized = normalizeTelemetryState(state);
-  let descriptor = null;
-
-  fs.mkdirSync(parent, { recursive: true, mode: 0o700 });
-  try {
-    fs.chmodSync(parent, 0o700);
-  } catch {
-    // Windows 等平台可能不支持 POSIX 权限，目录仍由当前用户配置目录边界保护。
-  }
-  try {
-    const existing = fs.lstatSync(filePath);
-    if (existing.isSymbolicLink() || !existing.isFile()) {
-      throw new TypeError(`遥测状态必须是普通文件:${filePath}`);
-    }
-  } catch (error) {
-    if (error?.code !== "ENOENT") throw error;
-  }
-
-  try {
-    descriptor = fs.openSync(temporary, "wx", 0o600);
-    fs.writeFileSync(descriptor, `${JSON.stringify(normalized, null, 2)}\n`, "utf8");
-    fs.fsyncSync(descriptor);
-    fs.closeSync(descriptor);
-    descriptor = null;
-    fs.renameSync(temporary, filePath);
-    try {
-      fs.chmodSync(filePath, 0o600);
-    } catch {
-      // Windows 等平台可能不支持 POSIX 权限，原子写入模式仍限制了 Unix 新文件权限。
-    }
-    return normalized;
-  } catch (error) {
-    if (descriptor !== null) {
-      try {
-        fs.closeSync(descriptor);
-      } catch {
-        // 保留原始写入错误。
-      }
-    }
-    try {
-      fs.unlinkSync(temporary);
-    } catch (cleanupError) {
-      if (cleanupError?.code !== "ENOENT") throw cleanupError;
-    }
-    throw error;
-  }
-}
-
-/**
- * 创建新的默认遥测状态。
- *
- * @param {{randomUUID?:()=>string}} [options] 随机 ID 注入
- * @returns {object} 默认启用的遥测状态
- */
-function createTelemetryState(options = {}) {
-  const randomUUID = options.randomUUID || crypto.randomUUID;
-  return {
-    schemaVersion: TELEMETRY_SCHEMA_VERSION,
-    deviceId: randomUUID(),
-    developerName: null,
-    enabled: true,
-    lastAttemptAt: null,
-    lastSuccessAt: null,
-  };
-}
-
-/**
- * 显式启用或停用用户级遥测。
- *
- * 损坏状态只允许通过显式设置修复，普通后台上报不会覆盖现场证据。
- *
- * @param {boolean} enabled 是否启用
- * @param {{env?:NodeJS.ProcessEnv,randomUUID?:()=>string,randomBytes?:(size:number)=>Buffer}} [options] 状态选项
- * @returns {object} 写入后的遥测状态
- */
-export function setTelemetryEnabled(enabled, options = {}) {
-  const result = readTelemetryState(options);
-  const state = result.status === "valid"
-    ? result.state
-    : createTelemetryState(options);
-  return writeTelemetryState({ ...state, enabled }, options);
-}
-
-/**
- * 读取项目 `.trellis/.developer` 中由 Trellis 明确记录的开发者名称。
- *
- * @param {string} target 项目根目录
- * @returns {string|null} 开发者名称
- */
-function readProjectDeveloper(target) {
-  try {
-    const content = fs.readFileSync(path.join(target, ".trellis", ".developer"), "utf8");
-    const line = content.split(/\r?\n/).find((entry) => entry.startsWith("name="));
-    return normalizeDeveloperName(line?.slice("name=".length));
-  } catch {
-    return null;
-  }
-}
-
-/**
- * 按项目自报、Git 配置、用户级缓存的顺序解析开发者名称。
- *
- * @param {string} target 项目根目录
- * @param {{developerName?:string|null,env?:NodeJS.ProcessEnv}} [options] 回退选项
- * @returns {string|null} 开发者名称
- */
-function resolveDeveloperName(target, options = {}) {
-  return readProjectDeveloper(target) ||
-    normalizeDeveloperName(readGitDeveloper(target, { env: options.env })) ||
-    normalizeDeveloperName(options.developerName);
-}
-
-/**
- * 读取项目当前 Flower 与 Trellis 版本，不采集任何项目路径或仓库信息。
- *
+/** 将兼容安装快照入队；网络由独立 sender 执行。
  * @param {string} target 项目根目录
- * @returns {{flower:string|null,trellis:string|null}} 项目版本
- */
-function readProjectVersions(target) {
-  let projectFlower = null;
-  let projectTrellis = null;
-  try {
-    const lock = new ProjectStore(target).readLock();
-    const skillGarden = lock?.plugins.find(({ id }) => id === SKILL_GARDEN_PLUGIN_ID);
-    projectFlower = skillGarden?.version || readManifest(target)?.flowerVersion || null;
-  } catch {
-    projectFlower = readManifest(target)?.flowerVersion || null;
-  }
-  try {
-    projectTrellis = fs.readFileSync(path.join(target, ".trellis", ".version"), "utf8").trim();
-  } catch {
-    projectTrellis = null;
-  }
-  return {
-    flower: VERSION_PATTERN.test(String(projectFlower || "")) ? projectFlower : null,
-    trellis: VERSION_PATTERN.test(String(projectTrellis || "")) ? projectTrellis : null,
-  };
-}
-
-/**
- * 构造严格白名单的匿名遥测载荷。
- *
- * @param {string} target 项目根目录
- * @param {string} event 遥测事件
- * @param {{deviceId:string,developerName?:string|null,env?:NodeJS.ProcessEnv,now?:Date}} options 设备、身份与时间参数
- * @returns {object|null} 可上报载荷；全部身份来源缺失时返回 null
- */
-export function buildTelemetryPayload(target, event, options) {
-  if (!EVENTS.has(event)) throw new TypeError(`未知遥测事件:${event}`);
-  if (!UUID_PATTERN.test(String(options?.deviceId || ""))) {
-    throw new TypeError("遥测设备 ID 无效");
-  }
-  const now = options.now instanceof Date ? options.now : new Date();
-  const resolvedTarget = path.resolve(target);
-  const developerName = resolveDeveloperName(resolvedTarget, options);
-  // 三种可信身份来源都缺失时无法诚实构造开发者名称，保留静默降级作为最后边界。
-  if (!developerName) return null;
-  const project = readProjectVersions(resolvedTarget);
-  const bundledTrellis = trellisVersion();
-  return {
-    schema_version: TELEMETRY_SCHEMA_VERSION,
-    device_id: options.deviceId,
-    event,
-    flower_version: flowerVersion(),
-    bundled_trellis_version: VERSION_PATTERN.test(bundledTrellis) ? bundledTrellis : null,
-    project_flower_version: project.flower,
-    project_trellis_version: project.trellis,
-    developer_name: developerName,
-    platform: process.platform,
-    arch: process.arch,
-    client_time: now.toISOString(),
-  };
-}
-
-/**
- * 判断常规遥测是否仍处于上报间隔内。
- *
- * @param {object} state 遥测状态
- * @param {Date} now 当前时间
- * @param {number} intervalHours 上报间隔小时数
- * @returns {boolean} 是否应跳过
- */
-function isWithinInterval(state, now, intervalHours) {
-  if (!state.lastAttemptAt) return false;
-  const attemptedAt = new Date(state.lastAttemptAt).getTime();
-  if (!Number.isFinite(attemptedAt)) return false;
-  return now.getTime() - attemptedAt < intervalHours * 60 * 60 * 1000;
-}
-
-/**
- * 尽力而为地上报 Flower 匿名安装遥测。
- *
- * 网络、状态文件或服务端失败均只返回状态，不输出日志也不影响调用命令。
- *
- * @param {string} target 项目根目录
- * @param {"version_check"|"init_completed"|"update_completed"} event 遥测事件
- * @param {{force?:boolean,env?:NodeJS.ProcessEnv,fetch?:typeof fetch,now?:Date,timeoutMs?:number,endpoint?:string,randomUUID?:()=>string,randomBytes?:(size:number)=>Buffer}} [options] 上报选项
- * @returns {Promise<{status:string}>} 上报结果
+ * @param {string} event v1 事件
+ * @param {object} options 本地采集依赖
+ * @returns {Promise<{status:string}>} 入队结果
  */
 export async function reportTelemetry(target, event, options = {}) {
-  try {
-    const env = options.env || process.env;
-    if (env.FLOWER_NO_TELEMETRY) return { status: "disabled_by_env" };
-
-    const readResult = readTelemetryState({ env });
-    if (readResult.status === "corrupt") return { status: "corrupt_state" };
-    let state = readResult.status === "valid"
-      ? readResult.state
-      : createTelemetryState(options);
-    if (!state.enabled) return { status: "disabled" };
-
-    const now = options.now instanceof Date ? options.now : new Date();
-    const payload = buildTelemetryPayload(target, event, {
-      deviceId: state.deviceId,
-      developerName: state.developerName,
-      env,
-      now,
-    });
-    if (!payload) return { status: "missing_developer" };
-    const intervalHours = readUpdateCheck(path.resolve(target)).intervalHours;
-    if (!options.force && isWithinInterval(state, now, intervalHours)) {
-      return { status: "throttled" };
-    }
-
-    state = writeTelemetryState({
-      ...state,
-      developerName: payload.developer_name,
-      lastAttemptAt: now.toISOString(),
-    }, options);
-    const controller = new AbortController();
-    const timer = setTimeout(() => controller.abort(), options.timeoutMs ?? DEFAULT_TIMEOUT_MS);
-    try {
-      const fetchRequest = options.fetch || fetch;
-      const response = await fetchRequest(options.endpoint || FLOWER_TELEMETRY_ENDPOINT, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify(payload),
-        signal: controller.signal,
-      });
-      if (!response.ok) return { status: "failed" };
-      writeTelemetryState({ ...state, lastSuccessAt: now.toISOString() }, options);
-      return { status: "reported" };
-    } finally {
-      clearTimeout(timer);
-    }
-  } catch {
-    return { status: "failed" };
-  }
+  try { return queueLegacyTelemetry(target, event, options); }
+  catch { return { status: "failed" }; }
 }

package/src/patches/bundles/flower-platform-integration.json

@@ -7,6 +7,9 @@
     "codex/session-start-hooks",
     "codex/dispatch-mode",
     "codex/remove-multi-agent-v2",
-    "claude/startup-update-hook"
+    "claude/startup-update-hook",
+    "claude/session-start-hooks",
+    "claude/telemetry-hooks",
+    "codex/telemetry-hooks"
   ]
 }

package/src/patches/platforms/claude/session-start-hooks/patch.json

@@ -0,0 +1,28 @@
+{
+  "schemaVersion": 2,
+  "id": "flower-claude-session-start-hooks",
+  "purpose": "platform_config",
+  "operations": [{
+    "id": "flower-claude-trellis-session-start",
+    "operation": "replace",
+    "targets": [{
+      "kind": "json",
+      "path": ".claude/settings.json",
+      "missing": "create",
+      "requires": [".claude"]
+    }],
+    "selector": {
+      "type": "json-hook-command",
+      "event": "SessionStart",
+      "commandNeedle": ".claude/hooks/session-start.py"
+    },
+    "content": {
+      "value": {
+        "matcher": "startup|clear|compact",
+        "timeout": 30,
+        "commandResolver": "claude-session-start",
+        "sessionParts": ["state", "rules", "stages"]
+      }
+    }
+  }]
+}

package/src/patches/platforms/claude/telemetry-hooks/patch.json

@@ -0,0 +1,59 @@
+{
+  "schemaVersion": 2,
+  "id": "flower-claude-telemetry-hooks",
+  "purpose": "platform_config",
+  "operations": [
+    {
+      "id": "flower-claude-telemetry-sessionstart",
+      "operation": "replace",
+      "targets": [
+        {
+          "kind": "json",
+          "path": ".claude/settings.json",
+          "missing": "create",
+          "requires": [
+            ".claude"
+          ]
+        }
+      ],
+      "selector": {
+        "type": "json-hook-command",
+        "event": "SessionStart",
+        "commandNeedle": ".trellis/scripts/flower_telemetry_hook.py"
+      },
+      "content": {
+        "value": {
+          "matcher": "startup|resume|clear|compact",
+          "timeout": 5,
+          "commandResolver": "claude-flower-telemetry"
+        }
+      }
+    },
+    {
+      "id": "flower-claude-telemetry-userpromptsubmit",
+      "operation": "replace",
+      "targets": [
+        {
+          "kind": "json",
+          "path": ".claude/settings.json",
+          "missing": "create",
+          "requires": [
+            ".claude"
+          ]
+        }
+      ],
+      "selector": {
+        "type": "json-hook-command",
+        "event": "UserPromptSubmit",
+        "commandNeedle": ".trellis/scripts/flower_telemetry_hook.py"
+      },
+      "content": {
+        "value": {
+          "matcher": "*",
+          "timeout": 5,
+          "commandResolver": "claude-flower-telemetry"
+        }
+      }
+    }
+  ]
+}

package/src/patches/platforms/codex/session-start-hooks/patch.json

@@ -19,9 +19,10 @@
       },
       "content": {
         "value": {
-          "matcher": "startup|resume|clear|compact",
+          "matcher": "startup|clear|compact",
           "timeout": 30,
-          "commandResolver": "codex-session-start"
+          "commandResolver": "codex-session-start",
+          "sessionParts": ["state", "rules", "stages"]
         }
       }
     },

package/src/patches/platforms/codex/telemetry-hooks/patch.json

@@ -0,0 +1,59 @@
+{
+  "schemaVersion": 2,
+  "id": "flower-codex-telemetry-hooks",
+  "purpose": "platform_config",
+  "operations": [
+    {
+      "id": "flower-codex-telemetry-sessionstart",
+      "operation": "replace",
+      "targets": [
+        {
+          "kind": "json",
+          "path": ".codex/hooks.json",
+          "missing": "create",
+          "requires": [
+            ".codex"
+          ]
+        }
+      ],
+      "selector": {
+        "type": "json-hook-command",
+        "event": "SessionStart",
+        "commandNeedle": ".trellis/scripts/flower_telemetry_hook.py"
+      },
+      "content": {
+        "value": {
+          "matcher": "startup|resume|clear|compact",
+          "timeout": 5,
+          "commandResolver": "codex-flower-telemetry"
+        }
+      }
+    },
+    {
+      "id": "flower-codex-telemetry-userpromptsubmit",
+      "operation": "replace",
+      "targets": [
+        {
+          "kind": "json",
+          "path": ".codex/hooks.json",
+          "missing": "create",
+          "requires": [
+            ".codex"
+          ]
+        }
+      ],
+      "selector": {
+        "type": "json-hook-command",
+        "event": "UserPromptSubmit",
+        "commandNeedle": ".trellis/scripts/flower_telemetry_hook.py"
+      },
+      "content": {
+        "value": {
+          "matcher": "*",
+          "timeout": 5,
+          "commandResolver": "codex-flower-telemetry"
+        }
+      }
+    }
+  ]
+}

package/src/plugin/application-service.js

@@ -21,29 +21,10 @@ import {
   normalizeContentSelection,
   selectContentSkillEntries,
 } from "./content-selection.js";
+import { classifyLockReachability } from "./lock-reachability.js";
 
 const SKILL_GARDEN_MIGRATION_OWNER_ID = "flower/skill-garden";
 
-/**
- * 计算 lock roots 可达的全部 Plugin。
- *
- * @param {import("./contracts.js").PluginLock} lock Plugin lock
- * @returns {Set<string>} 可达 Plugin ID
- */
-function reachableLockIds(lock) {
-  const byId = new Map(lock.plugins.map((plugin) => [plugin.id, plugin]));
-  const reachable = new Set();
-  const visit = (id) => {
-    if (reachable.has(id)) return;
-    reachable.add(id);
-    const plugin = byId.get(id);
-    if (!plugin) return;
-    Object.keys(plugin.dependencies).sort(compareUtf8).forEach(visit);
-  };
-  [...lock.roots].sort(compareUtf8).forEach(visit);
-  return reachable;
-}
-
 /**
  * 汇总既有 Plugin state 的实际投影平台，供无显式选择的生命周期继续复用。
  *
@@ -489,10 +470,10 @@ export class PluginApplicationService {
       }
     }
     if (lock) {
-      const reachable = reachableLockIds(lock);
+      const { reachableIds } = classifyLockReachability(pluginsFile.plugins, lock);
       for (const id of [...lockById.keys()].sort(compareUtf8)) {
         if (options.id && id !== options.id) continue;
-        if (!reachable.has(id)) {
+        if (!reachableIds.has(id)) {
           diagnostics.push({
             code: "verify.lock-orphan",
             path: id,
@@ -788,6 +769,7 @@ export class PluginApplicationService {
           if (desiredDirectoryPaths.has(entry.path)) continue;
           const target = path.join(this.projectRoot, ...entry.path.split("/"));
           const currentHash = hashDirectoryIfExists(target);
+          if (currentHash === null) continue;
           if (currentHash !== entry.hash) {
             throw new PluginRuntimeError(`受管 Plugin 目录已被用户修改，拒绝删除:${entry.path}`, {
               code: PLUGIN_RUNTIME_ERROR_CODES.CONTENT_CONFLICT,
@@ -803,6 +785,7 @@ export class PluginApplicationService {
         if (desiredPaths.has(entry.path)) continue;
         const target = path.join(this.projectRoot, ...entry.path.split("/"));
         const currentHash = hashFileIfExists(target);
+        if (currentHash === null) continue;
         if (currentHash !== entry.hash) {
           throw new PluginRuntimeError(`受管 Plugin 文件已被用户修改，拒绝删除:${entry.path}`, {
             code: PLUGIN_RUNTIME_ERROR_CODES.CONTENT_CONFLICT,

package/src/plugin/contracts.js

@@ -118,6 +118,7 @@
  * @property {"gitlab"} type GitLab 来源
  * @property {string} reference GitLab project path
  * @property {string} [indexCommit] Marketplace 索引 commit
+ * @property {string} [indexPath] Marketplace 索引安全相对路径
  */
 
 /**

package/src/plugin/lock-reachability.js

@@ -0,0 +1,37 @@
+import { compareUtf8 } from "./stable-order.js";
+
+/**
+ * 从当前直接声明出发，分类既有 lock 中的可达、孤立和缺失节点。
+ *
+ * lock roots 可能来自半清理的旧项目，不能作为活跃 Plugin 的事实入口。调用方应使用当前
+ * `plugins.json` 声明开始遍历，才能在不访问外部来源的前提下识别可冻结节点和孤立状态。
+ *
+ * @param {import("./contracts.js").ProjectPluginDeclaration[]} declarations 当前直接声明
+ * @param {import("./contracts.js").PluginLock|null} lock 既有 Plugin lock
+ * @returns {{reachableIds:Set<string>,orphanIds:Set<string>,missingIds:Set<string>}} lock 节点分类
+ */
+export function classifyLockReachability(declarations, lock) {
+  const plugins = lock?.plugins || [];
+  const byId = new Map(plugins.map((plugin) => [plugin.id, plugin]));
+  const visited = new Set();
+  const reachableIds = new Set();
+  const missingIds = new Set();
+
+  const visit = (id) => {
+    if (visited.has(id)) return;
+    visited.add(id);
+    const plugin = byId.get(id);
+    if (!plugin) {
+      missingIds.add(id);
+      return;
+    }
+    reachableIds.add(id);
+    Object.keys(plugin.dependencies).sort(compareUtf8).forEach(visit);
+  };
+
+  declarations.map(({ id }) => id).sort(compareUtf8).forEach(visit);
+  const orphanIds = new Set(
+    plugins.map(({ id }) => id).filter((id) => !reachableIds.has(id)).sort(compareUtf8),
+  );
+  return { reachableIds, orphanIds, missingIds };
+}

package/src/plugin/schemas/project-files.js

@@ -38,6 +38,7 @@ const sourceDescriptorSchema = {
         type: { const: "gitlab" },
         reference: { type: "string", format: "gitlab-project" },
         indexCommit: { type: "string", format: "git-commit" },
+        indexPath: SAFE_PATH_SCHEMA,
       },
     },
     {