@minnovate/shadow-publisher 0.13.0 → 0.14.1

package/dist/claude/plugin/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "git-publisher",
   "displayName": "Git Publisher",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "Publish an app folder's Git history to the serverless Git publishing backend and keep it updated (\"publish my app\", \"update my app\", \"fetch the engineered version\").",
   "author": { "name": "git-publisher project" },
   "keywords": ["git", "publish", "deploy", "serverless"]

package/dist/claude/plugin/skills/publish-app/SKILL.md

@@ -29,7 +29,7 @@ publisher --version
 ```
 
 If the command is not found, or the version is older than 0.11.0, install it:
-`npm install -g @minnovate/shadow-publisher@latest` (it needs Node.js 22). In a Claude Cowork task
+`npm install -g @minnovate/shadow-publisher@latest` (it needs Node.js 22.12 or a later 22). In a Claude Cowork task
 this is normal: the sandbox starts empty every time, so install it without asking. On the person's
 own computer, say in one line that you are installing the publisher. If `npm` itself is missing,
 tell them Node.js 22 must be installed first, and stop.
@@ -142,6 +142,13 @@ in its folder. The checks refuse an app that does not (see "When the checks find
 Keep it small too: each file at most 4 MB, the whole app at most 10 MB, at most 500 files —
 a larger app is refused before it is checked, and the refusal names the file or the limit it broke.
 
+An app is one folder in one of three shapes: static files with `index.html` at the root, a
+standard-library Python `app.py`, or a Node.js `server.mjs` beside a `package.json` of exactly
+`{"type":"module","scripts":{"start":"node server.mjs"}}`. It has no build step and no npm or pip
+dependencies. Only .html .js .mjs .py .css .csv .json .svg .txt files are part of the app: any
+other file, such as an image, an icon or a font, is left out, so draw images as SVG and use system
+font stacks.
+
 ## 4. Telling them how it goes, step by step
 
 After a publish, the app goes through four steps: **received**, **checked**, **going live**,
@@ -214,8 +221,8 @@ sentence, and `progress.next.action` is `"fix"`. Then:
 2. Fix every finding in the app folder, by its `kind`:
    - `external-resource`: the app loads `url` from another site (a CDN script, Google Fonts, an
      image). **Apps may not load anything from other sites.** Download the file into the app
-     folder and point to it with a relative path — only if it is at most 4 MB; a charting
-     library usually is not (Chart.js is 201 KB). Otherwise replace it with code of your own: a
+     folder and point to it with a relative path, if it is at most 4 MB (a charting library
+     such as Chart.js, about 200 KB, fits). Otherwise replace it with code of your own: a
      font falls back to a system font stack, a chart is drawn as inline SVG. Never keep the
      external address.
    - `console-error` / `application-error`: fix the code that logs or throws `message`.

package/dist/claude/plugin/skills/sync-app/SKILL.md

@@ -53,6 +53,8 @@ publisher suggestions --json              # what colleagues asked for, still ope
 publisher suggestion decline <id> --json  # when the person does not want one
 publisher share invited --add ann@example.com --json   # who can open it
 publisher columns <id> --json             # the column names of connected data, before code reads it
+publisher data add <sheet link> --app <app> --name "<name>" --json   # a Google sheet the app reads
+publisher data remove <id> --app <app> --json                        # the app stops reading that data
 ```
 
 The portal writes `next` for an assistant in the chat, so it can name a connector tool. At a
@@ -68,6 +70,8 @@ terminal, do what it says with the command that does the same thing:
 | `share_app`                       | `publisher share <access> --json`                               |
 | `list_apps`                       | `publisher list --json`                                         |
 | `data_columns`                    | `publisher columns <id> --json`                                 |
+| `connect_data_source`             | `publisher data add <sheet link> --app <app> --name "<name>" --json` |
+| `remove_data_source`              | `publisher data remove <id> --app <app> --json`                 |
 
 `<publication>` is the `publication` that `go-back` or `start` answered.
 

package/dist/publisher.cjs

@@ -324,8 +324,8 @@ function mergeDefs(...defs) {
 }
 var captureStackTrace = "captureStackTrace" in Error ? Error.captureStackTrace : (..._args) => {
 };
-function isObject(data) {
-  return typeof data === "object" && data !== null && !Array.isArray(data);
+function isObject(data2) {
+  return typeof data2 === "object" && data2 !== null && !Array.isArray(data2);
 }
 function isPlainObject(o) {
   if (isObject(o) === false)
@@ -503,20 +503,20 @@ function getLengthableOrigin(input) {
     return "string";
   return "unknown";
 }
-function parsedType(data) {
-  const t = typeof data;
+function parsedType(data2) {
+  const t = typeof data2;
   switch (t) {
     case "number": {
-      return Number.isNaN(data) ? "nan" : "number";
+      return Number.isNaN(data2) ? "nan" : "number";
     }
     case "object": {
-      if (data === null) {
+      if (data2 === null) {
         return "null";
       }
-      if (Array.isArray(data)) {
+      if (Array.isArray(data2)) {
         return "array";
       }
-      const obj = data;
+      const obj = data2;
       if (obj && Object.getPrototypeOf(obj) !== Object.prototype && "constructor" in obj && obj.constructor) {
         return obj.constructor.name;
       }
@@ -2375,17 +2375,17 @@ var ZodMiniType = /* @__PURE__ */ $constructor("ZodMiniType", (inst, def) => {
   set with(value) {
     own(this, "with", value);
   },
-  parse(data, params) {
-    return parse(this, data, params, { callee: this.parse });
+  parse(data2, params) {
+    return parse(this, data2, params, { callee: this.parse });
   },
-  parseAsync(data, params) {
-    return parseAsync(this, data, params, { callee: this.parseAsync });
+  parseAsync(data2, params) {
+    return parseAsync(this, data2, params, { callee: this.parseAsync });
   },
-  safeParse(data, params) {
-    return safeParse(this, data, params);
+  safeParse(data2, params) {
+    return safeParse(this, data2, params);
   },
-  safeParseAsync(data, params) {
-    return safeParseAsync(this, data, params);
+  safeParseAsync(data2, params) {
+    return safeParseAsync(this, data2, params);
   },
   check(...checks) {
     const def = this.def;
@@ -6852,6 +6852,7 @@ var OPTIONS = {
   token: { type: "string" },
   portal: { type: "string" },
   name: { type: "string" },
+  app: { type: "string" },
   repo: { type: "string" },
   message: { type: "string" },
   publication: { type: "string" },
@@ -8074,6 +8075,24 @@ var share = {
     return run(inv, dir, "share_app", { app, access: access2, add: listFlag(inv, "add"), remove: listFlag(inv, "remove") });
   }
 };
+function dataCall(cmd, app, name) {
+  const [, verb, subject] = cmd;
+  const on = app === void 0 ? {} : { app };
+  if (verb === "add" && subject !== void 0) {
+    return { tool: "connect_data_source", args: { source: "google-sheet", describes: name ?? "", fields: { link: subject }, ...on } };
+  }
+  if (verb === "remove" && subject !== void 0) {
+    return { tool: "remove_data_source", args: { id: subject, ...on } };
+  }
+  throw new PublisherError("INVALID_REQUEST", "data takes add <sheet link>, or remove <id> with an id from publisher columns");
+}
+var data = {
+  git: false,
+  async run(inv) {
+    const { tool, args } = dataCall(inv.cmd, inv.str("app"), inv.str("name"));
+    return run(inv, void 0, tool, args);
+  }
+};
 
 // src/commands/sync.ts
 var sync = {
@@ -8433,6 +8452,10 @@ Usage:
                                                         who can open this folder's app; new invitees get the link by mail
   publisher columns [<id>]                              the column names of connected data, for the code that reads it;
                                                         its first rows only to an owner or admin who allowed that
+  publisher data add <sheet link> [--app <app>] [--name <name>]
+                                                        connect a Google sheet anyone with the link can view, and
+                                                        turn it on for that app (an app you made, or any as owner or admin)
+  publisher data remove <id> --app <app>                that app stops using that data; the organisation keeps it
   publisher merge-check [dir] --ours <ref> --theirs <ref> [--apply]
   publisher info [dir]                                   repository state as seen by the server
   publisher doctor                                       environment check (node, git, credentials, association)
@@ -8484,7 +8507,8 @@ var COMMANDS = /* @__PURE__ */ new Map([
   ["suggestions", suggestions],
   ["suggestion", suggestion],
   ["share", share],
-  ["columns", columns]
+  ["columns", columns],
+  ["data", data]
 ]);
 async function main(argv) {
   const inv = new Invocation(parseArgs(argv));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@minnovate/shadow-publisher",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "publisher: publish an app's Git history to the serverless Git backend",
   "license": "Apache-2.0",
   "type": "module",