@javierfrancoleal/plugin-authoring 1.0.2 → 1.0.4

package/assets/plugin-authoring.md

@@ -230,10 +230,17 @@ async function apply(ctx) {
 3. New bundles are NOT picked up by HMR on external edits — restart the app.
 4. `dsh.bundle.patch` + `dsh.client` can coexist (dual-face).
 5. React / slots / primitives are baseline; don't list them in `dsh.client.inject`.
-6. **Bundle URLs are revisioned**: the real form is
-   `/plugins/??<id>/client.js&rev=<sha1(mtime:ctime:size)[0:12]>`; the bare
-   `/plugins/<id>/client.js` **always 404s**. Get the `rev` from the root HTML.
+6. **Bundle URLs are revisioned**: `/plugins/??<id>/client.js&rev=<rev>`; the bare
+   `/plugins/<id>/client.js` **always 404s**. Derive `rev` LOCALLY (no need to
+   scrape the HTML, which requires auth): sha1 over
+   `"plugin-artifact\0" + "<len>:mtimeMs" + "<len>:ctimeMs" + "<len>:size"`
+   (file stats of `lib/client.js`), first 12 hex chars — see the checklist.
+   The `/plugins` endpoint needs **no auth**.
 7. **The app may change port after a restart** — re-read the advertised URL.
+8. **First publish of a NEW package gets a `0.0.0-stage` placeholder** — that's
+   npm's staged publishing (registry feature, GA 2026), not a bug in your scripts
+   or in pnpm/npm. The real version lands ~1 min later on its own. Mitigation:
+   deprecate the placeholder; `publish.sh` / `sync-all.sh` now do it automatically.
 
 ## Validation checklist
 
@@ -241,8 +248,8 @@ async function apply(ctx) {
 node --check lib/index.js && node --check lib/client.js
 node tools/check-client.mjs lib/client.js
 dsh --profile testprices --dump-config | grep mi-plugin     # throwaway profile, not desktop
-curl -sS http://127.0.0.1:<puerto>/ | grep -o "mi-plugin/client[^\"']*"          # find your rev
-curl -sS "http://127.0.0.1:<puerto>/plugins/??@scope/mi-plugin/client.js&rev=<rev>"  # 200
+REV=$(node -e 'const fs=require("fs"),crypto=require("crypto");const st=fs.statSync("lib/client.js");const h=crypto.createHash("sha1").update("plugin-artifact").update("\0");for(const p of [String(st.mtimeMs),String(st.ctimeMs),String(st.size)])h.update(String(Buffer.byteLength(p))+":").update(p);console.log(h.digest("hex").slice(0,12))')
+curl -sS "http://127.0.0.1:<puerto>/plugins/??@scope/mi-plugin/client.js&rev=$REV"  # 200 (no auth needed)
 ```
 
 Full reference: `docs/PLUGIN-AUTHORING.md`. Template: `templates/dsh-plugin/`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@javierfrancoleal/plugin-authoring",
-  "version": "1.0.2",
+  "version": "1.0.4",
   "description": "Plugin-authoring skill for DeepSeek Harness: the distilled anatomy, client-UI recipe, slots, locale, theme tokens, install steps, gotchas, and validation checklist for building and publishing new DSH plugins.",
   "author": "J.Franco",
   "license": "MIT",