@motrix/plugin-cli 2.0.0 → 2.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/README.md CHANGED
@@ -35,7 +35,16 @@ motrix-plugin validate
35
35
  ```
36
36
  Validate `motrix-plugin.json` against
37
37
  [`@motrix/plugin-manifest-schema`](https://www.npmjs.com/package/@motrix/plugin-manifest-schema) —
38
- the same schema the Motrix host uses when installing a plugin.
38
+ the same schema the Motrix host uses when installing a plugin. Beyond the
39
+ schema this also applies the rules a schema cannot express:
40
+
41
+ - **hooks ⇒ hostPermissions** — contributing any hook requires at least one
42
+ `hostPermissions` entry, or the host refuses to install the plugin
43
+ - **locale coverage** — every `%key%` the manifest interpolates must exist in
44
+ `en-US`, including the ones under `contributes.configuration`
45
+
46
+ `pack` runs this identical gate, so the two commands can never disagree about
47
+ whether a plugin is shippable.
39
48
 
40
49
  ### Schema versioning
41
50
 
@@ -49,22 +58,39 @@ staying current on the CLI keeps you current on the schema too.
49
58
  ```bash
50
59
  motrix-plugin lint
51
60
  ```
52
- Static checks beyond schema validation: locale coverage
53
- (`contributes`/UI strings present in every declared locale) and
54
- top-level side-effect detection (guest code must not run effectful code at
55
- module scope).
61
+ Static checks on the **packed bundle**, so run `pack` first: top-level
62
+ side-effect detection (guest code must not run effectful code at module
63
+ scope), a size warning as the bundle approaches the 1 MiB cap, and advisories
64
+ for `invokesCommands` entries whose callee may not be installed.
56
65
 
57
66
  ```bash
58
67
  motrix-plugin validate-host-permissions
59
68
  ```
60
- Sanity-check `hostPermissions` match patterns and warn on overly broad grants
61
- (e.g. `<all_urls>`).
69
+ Reviews `hostPermissions` in more depth than `validate` does: each pattern is
70
+ parsed with the host's own match-pattern grammar, and broad grants
71
+ (`<all_urls>`, `https://*/*`) are reported as warnings so you can narrow them.
62
72
 
63
73
  ```bash
64
74
  motrix-plugin pack
65
75
  ```
66
- Bundle the plugin with esbuild and zip it into a `.moext` distributable,
67
- enforcing the per-bundle and total package size limits.
76
+ Produce the `.moext` distributable at `dist/<id>-<version>.moext`.
77
+
78
+ Every gate — schema, hooks ⇒ hostPermissions, locale coverage — runs *before*
79
+ esbuild writes anything, so a rejected plugin leaves no half-built bundle
80
+ behind and a `.moext` the host would refuse to install cannot be created in the
81
+ first place. The bundle is then checked against the 1 MiB cap and the archive
82
+ against 5 MiB.
83
+
84
+ The archive is **reproducible**: entries are written in sorted order with
85
+ pinned timestamps and modes, so the same source tree always yields the same
86
+ bytes, on any machine and in any timezone. `pack` prints the resulting sha256 —
87
+ that is the value a registry entry's `package.sha256` needs, and re-packing an
88
+ unchanged tree must reprint it.
89
+
90
+ ```
91
+ Packed → …/dist/acme.demo-1.0.0.moext (4540 bytes)
92
+ sha256 5d69eaf3bb44992952beafc67d818ff376b8478de4b32b936ce5e603b963605d
93
+ ```
68
94
 
69
95
  ```bash
70
96
  pnpm create motrix-plugin my-plugin [template]