@medeo-plugin/cli 0.8.0 → 0.9.0

package/locate.mjs

@@ -1,7 +1,5 @@
-// Where the CLI finds its own files. Installed from npm, the verifier and the
-// templates sit inside the package (`scripts/stage-cli.mjs` puts them there);
-// in this repository they are read from the checkout, so tests and the release
-// script need no staging step.
+// Templates live beside the CLI in both source and published installations.
+// The verifier is read from spec in the checkout, or the staged npm copy.
 import { createRequire } from 'node:module';
 import { existsSync, readFileSync } from 'node:fs';
 import path from 'node:path';
@@ -9,16 +7,17 @@ import { fileURLToPath } from 'node:url';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
 const repo = path.resolve(here, '../..');
-const TEMPLATES = { vanilla: 'examples/i18n-demo', react: 'examples/react-demo' };
+const TEMPLATES = ['vanilla', 'react'];
 
 export function verifierPath() {
   // In this repository the checkout's copy is the current one; a published package only has its own.
-  for (const candidate of [path.join(repo, 'verifier/medeo-verify.wasm'), path.join(here, 'verifier/medeo-verify.wasm')]) if (existsSync(candidate)) return candidate;
+  for (const candidate of [path.join(repo, 'spec/medeo-verify.wasm'), path.join(here, 'verifier/medeo-verify.wasm')]) if (existsSync(candidate)) return candidate;
   throw new Error('The package verifier (verifier/medeo-verify.wasm) is missing from this installation');
 }
 export function templatePath(name) {
-  if (!Object.hasOwn(TEMPLATES, name)) throw new Error(`Unknown template "${name}"; use ${Object.keys(TEMPLATES).join(' or ')}`);
-  for (const candidate of [path.join(repo, TEMPLATES[name]), path.join(here, 'templates', name)]) if (existsSync(candidate)) return candidate;
+  if (!TEMPLATES.includes(name)) throw new Error(`Unknown template "${name}"; use ${TEMPLATES.join(' or ')}`);
+  const candidate = path.join(here, 'templates', name);
+  if (existsSync(candidate)) return candidate;
   throw new Error(`Template "${name}" is missing from this installation`);
 }
 const SDK_ENTRIES = { '@medeo-plugin/sdk': 'index', '@medeo-plugin/sdk/ui': 'ui', '@medeo-plugin/sdk/ui/react': 'react', '@medeo-plugin/sdk/rpc': 'rpc', '@medeo-plugin/sdk/testing': 'testing' };

package/pack.mjs

@@ -13,7 +13,23 @@ const STORED=new Set(['png','jpg','jpeg','gif','webp','woff','woff2','mp3','mp4'
 // Mirrors platform_contract: archive and unpacked size, file count, index entry.
 export const LIMITS={size:256*1024*1024,files:4096},INDEX_ENTRY='_package.json';
 // Mirrors platform_core::ICON_PATHS / MAX_ICON / validate_icon.
-export const ICON_PATHS=['icon.svg','icon.png'],MAX_ICON=256*1024;const PNG=Buffer.from([0x89,0x50,0x4e,0x47,0x0d,0x0a,0x1a,0x0a]);
+export const ICON_PATHS=['icon.svg','icon.png'],MAX_ICON=256*1024;
+// Mirrors platform_core::parse_about; Medeo drops an invalid field silently, so pack refuses it here.
+export const ABOUT_FILE='about.json',MAX_ABOUT=16*1024;
+export function checkAbout(text){
+ let value;try{value=JSON.parse(text)}catch{return ['not valid JSON']}
+ if(!value||typeof value!=='object'||Array.isArray(value))return ['must be a JSON object'];
+ const problems=[],plain=(v,max)=>typeof v==='string'&&v.trim()!==''&&[...v].length<=max&&!/[\u0000-\u001f\u007f-\u009f]/.test(v);
+ const link=v=>{if(typeof v!=='string'||v.length>2048||/[\s\u0000-\u001f]/.test(v)||!v.startsWith('https://'))return false;const host=v.slice(8).split(/[/?#]/)[0];return host!==''&&!host.includes('@')};
+ for(const key of Object.keys(value))if(!['author','license','homepage','repository','bugs'].includes(key))problems.push(`unknown field ${key}`);
+ if('author' in value&&!plain(value.author,80))problems.push('author must be one line of at most 80 characters');
+ if('license' in value&&!plain(value.license,64))problems.push('license must be one line of at most 64 characters');
+ for(const key of ['homepage','repository','bugs'])if(key in value&&!link(value[key]))problems.push(`${key} must be an https:// link`);
+ return problems;
+}
+export const README=/^README(\.[A-Za-z0-9_-]{1,16})?\.md$/,MAX_README=256*1024;
+// Screenshots a README shows, under media/: images only, each ≤ 2 MiB and ≤ 8 MiB together.
+export const MEDIA=/^media\/(?:[A-Za-z0-9_.-]+\/)*[A-Za-z0-9_.-]+\.(?:png|jpe?g|gif|webp)$/i,MAX_MEDIA=2*1024*1024,MAX_MEDIA_TOTAL=8*1024*1024;const PNG=Buffer.from([0x89,0x50,0x4e,0x47,0x0d,0x0a,0x1a,0x0a]);
 const UI_ENTRIES=['ui/entry.ts','ui/entry.tsx'];
 function assetKind(file){const ext=file.split('.').pop().toLowerCase();return TEXT.has(ext)?'text':BINARY.has(ext)?'binary':UI_ENTRIES.includes(file)?'text':null}
 const sha256=bytes=>createHash('sha256').update(bytes).digest('hex');
@@ -78,6 +94,31 @@ export async function pack(directory,keyFile,output,options={}){
   if(manifest.icon==='icon.png'?!bytes.subarray(0,8).equals(PNG):!bytes.toString('utf8').includes('<svg'))throw Error('icon does not match its type: '+manifest.icon);
   files[manifest.icon]=bytes;
  }
+ // The introduction Medeo's plugin center shows: README.md and README.<locale>.md at the root.
+ for(const item of (await readdir(source)).sort()){
+  if(!README.test(item))continue;
+  const full=path.join(source,item),stat=await lstat(full);
+  if(stat.isSymbolicLink()||!stat.isFile()||stat.size>MAX_README)throw Error(`${item} must be a regular file of at most 256 KiB`);
+  files[item]=Buffer.from((await readFile(full,'utf8')).replace(/\r\n/g,'\n'));
+ }
+ // About: author, license and https links for the plugin detail. A separate file rather than
+ // manifest fields, so every Medeo installs the package (older ones simply ignore it).
+ const aboutFile=path.join(source,ABOUT_FILE),aboutStat=await lstat(aboutFile).catch(()=>null);
+ if(aboutStat){
+  if(aboutStat.isSymbolicLink()||!aboutStat.isFile()||aboutStat.size>MAX_ABOUT)throw Error(`${ABOUT_FILE} must be a regular file of at most 16 KiB`);
+  const text=(await readFile(aboutFile,'utf8')).replace(/\r\n/g,'\n');
+  const problems=checkAbout(text);if(problems.length)throw Error(`${ABOUT_FILE}: ${problems.join('; ')}`);
+  files[ABOUT_FILE]=Buffer.from(text);
+ }
+ if(await access(path.join(source,'media')).then(()=>true,()=>false)){
+  await collect(path.join(source,'media'),'media/');
+  let total=0;
+  for(const p of Object.keys(files).filter(p=>p.startsWith('media/'))){
+   if(!MEDIA.test(p))throw Error('media/ holds only png, jpg, gif or webp images: '+p);
+   if(files[p].length>MAX_MEDIA)throw Error(p+' is larger than 2 MiB');total+=files[p].length;
+  }
+  if(total>MAX_MEDIA_TOTAL)throw Error('media/ is larger than 8 MiB in total');
+ }
  if(node&&await access(path.join(source,'resources')).then(()=>true,()=>false))await collect(path.join(source,'resources'),'resources/');
  if(manifest.localization){
   for(const relative of Object.values(manifest.localization.catalogs??{})){

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@medeo-plugin/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Command line for Medeo desktop plugins: scaffold, build, sign, check and live-reload a plugin in a running Medeo.",
   "license": "MIT",
   "repository": {
@@ -33,6 +33,9 @@
     "!*.test.mjs",
     "verifier/",
     "templates/",
+    "!templates/**/tests/**",
+    "!templates/**/dist/**",
+    "!templates/**/node_modules/**",
     "README.md"
   ],
   "scripts": {
@@ -40,7 +43,7 @@
     "prepack": "node ../../scripts/stage-cli.mjs"
   },
   "dependencies": {
-    "@medeo-plugin/sdk": "0.8.0",
+    "@medeo-plugin/sdk": "0.9.0",
     "esbuild": "^0.25.0"
   },
   "engines": {

package/templates/react/README.md

@@ -1,4 +1,4 @@
 # React counter
 
-The `init --template react` template: the same counter as `i18n-demo`, with the window written in React.
+The `init --template react` template: the same counter as the vanilla template, with the window written in React.
 `ui/entry.tsx` is the only compiled UI entry; components live in `src/ui/` so nothing unbuilt is packaged.