@overcrow/mcp 0.1.0 → 0.1.2

package/dist/content/reference/errors.json

@@ -1130,12 +1130,12 @@
   },
   "listing.json": {
    "en": {
-    "meaning": "The marketplace text of a submission; read by `admit`. — no",
+    "meaning": "The marketplace text of a submission; read by `admit`. In the creator space, where the listing is edited, only a proposal to import. — no",
     "page": "cli",
     "section": "Files of a project"
    },
    "fr": {
-    "meaning": "Le texte de marketplace d’une soumission ; lu par `admit`. — non",
+    "meaning": "Le texte de marketplace d’une soumission ; lu par `admit`. Dans l’espace créateurs, où la fiche se modifie, une simple proposition d’import. — non",
     "page": "cli",
     "section": "Fichiers d’un projet"
    }
@@ -1274,60 +1274,84 @@
   },
   "admission.reserved_id": {
    "en": {
-    "meaning": "error — A `com.playervox.*` ID, reserved for PlayerVox.",
+    "meaning": "error — A `com.playervox.*` ID, reserved for PlayerVox; without `--publisher`, also an ID under a reserved handle (`playervox.*`, `admin.*`…).",
     "page": "cli",
     "section": "admit"
    },
    "fr": {
-    "meaning": "erreur — Un ID `com.playervox.*`, réservé à PlayerVox.",
+    "meaning": "erreur — Un ID `com.playervox.*`, réservé à PlayerVox ; sans `--publisher`, aussi un ID sous un pseudo réservé (`playervox.*`, `admin.*`…).",
+    "page": "cli",
+    "section": "admit"
+   }
+  },
+  "admission.placeholder_id": {
+   "en": {
+    "meaning": "error — An example ID, without `--publisher`.",
+    "page": "cli",
+    "section": "admit"
+   },
+   "fr": {
+    "meaning": "erreur — Un ID d’exemple, sans `--publisher`.",
+    "page": "cli",
+    "section": "admit"
+   }
+  },
+  "admission.id_not_owned": {
+   "en": {
+    "meaning": "error — The ID does not belong to the publisher, or, without `--publisher`, cannot belong to any.",
+    "page": "cli",
+    "section": "admit"
+   },
+   "fr": {
+    "meaning": "erreur — L’ID n’appartient pas à l’éditeur, ou, sans `--publisher`, ne peut appartenir à personne.",
     "page": "cli",
     "section": "admit"
    }
   },
   "admission.listing_missing": {
    "en": {
-    "meaning": "error — No `listing.json`, or one that breaks the listing's rules.",
+    "meaning": "error — No `listing.json`, or one that breaks the listing's rules (a warning with `--listing optional`).",
     "page": "cli",
     "section": "admit"
    },
    "fr": {
-    "meaning": "erreur — Pas de `listing.json`, ou un fichier qui enfreint les règles de la fiche.",
+    "meaning": "erreur — Pas de `listing.json`, ou un fichier qui enfreint les règles de la fiche (un avertissement avec `--listing optional`).",
     "page": "cli",
     "section": "admit"
    }
   },
   "admission.listing": {
    "en": {
-    "meaning": "error — No `listing.json`, or one that breaks the listing's rules.",
+    "meaning": "error — No `listing.json`, or one that breaks the listing's rules (a warning with `--listing optional`).",
     "page": "cli",
     "section": "admit"
    },
    "fr": {
-    "meaning": "erreur — Pas de `listing.json`, ou un fichier qui enfreint les règles de la fiche.",
+    "meaning": "erreur — Pas de `listing.json`, ou un fichier qui enfreint les règles de la fiche (un avertissement avec `--listing optional`).",
     "page": "cli",
     "section": "admit"
    }
   },
   "admission.preview": {
    "en": {
-    "meaning": "error — `preview` does not name a packaged PNG within bounds.",
+    "meaning": "error — `preview` does not name a packaged PNG within bounds (a warning with `--listing optional`).",
     "page": "cli",
     "section": "admit"
    },
    "fr": {
-    "meaning": "erreur — `preview` ne désigne pas un PNG empaqueté dans les limites.",
+    "meaning": "erreur — `preview` ne désigne pas un PNG empaqueté dans les limites (un avertissement avec `--listing optional`).",
     "page": "cli",
     "section": "admit"
    }
   },
   "admission.license": {
    "en": {
-    "meaning": "error — A PlayerVox widget whose license is not MIT.",
+    "meaning": "error — A PlayerVox widget whose license is not MIT (a warning with `--listing optional`).",
     "page": "cli",
     "section": "admit"
    },
    "fr": {
-    "meaning": "erreur — Un widget PlayerVox dont la licence n’est pas MIT.",
+    "meaning": "erreur — Un widget PlayerVox dont la licence n’est pas MIT (un avertissement avec `--listing optional`).",
     "page": "cli",
     "section": "admit"
    }
@@ -1344,6 +1368,42 @@
     "section": "admit"
    }
   },
+  "admission.previous": {
+   "en": {
+    "meaning": "error — The previous version cannot be read.",
+    "page": "cli",
+    "section": "admit"
+   },
+   "fr": {
+    "meaning": "erreur — La version précédente ne peut pas être lue.",
+    "page": "cli",
+    "section": "admit"
+   }
+  },
+  "admission.previous_mismatch": {
+   "en": {
+    "meaning": "error — The previous version is another widget.",
+    "page": "cli",
+    "section": "admit"
+   },
+   "fr": {
+    "meaning": "erreur — La version précédente est un autre widget.",
+    "page": "cli",
+    "section": "admit"
+   }
+  },
+  "admission.version_not_newer": {
+   "en": {
+    "meaning": "error — The version is not above the previous one.",
+    "page": "cli",
+    "section": "admit"
+   },
+   "fr": {
+    "meaning": "erreur — La version n’est pas supérieure à la précédente.",
+    "page": "cli",
+    "section": "admit"
+   }
+  },
   "admission.package_rebuilt": {
    "en": {
     "meaning": "warning — The submitted archive differs from the rebuild in other files.",
@@ -1368,6 +1428,150 @@
     "section": "admit"
    }
   },
+  "sources.archive_size": {
+   "en": {
+    "meaning": "More than 32 MiB.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Plus de 32 Mio.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.too_large": {
+   "en": {
+    "meaning": "More than 64 MiB or 2,000 files once uncompressed.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Plus de 64 Mio ou de 2 000 fichiers une fois décompressée.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.too_many_files": {
+   "en": {
+    "meaning": "More than 64 MiB or 2,000 files once uncompressed.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Plus de 64 Mio ou de 2 000 fichiers une fois décompressée.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.unsafe_name": {
+   "en": {
+    "meaning": "A name that could leave the widget folder (`../`, `/` first), or that some system cannot use: a character Windows forbids (`\\`, `:`, `*`, `?`, `\"`, `<`, `>`, \\|), anything but printable ASCII, a final dot or space, `CON`, `NUL`, `COM1`… The message names the character and the file.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Un nom qui pourrait sortir du dossier du widget (`../`, `/` en tête), ou qu’un système ne peut pas utiliser : un caractère interdit par Windows (`\\`, `:`, `*`, `?`, `\"`, `<`, `>`, \\|), autre chose que de l’ASCII imprimable, un point ou une espace final, `CON`, `NUL`, `COM1`… Le message nomme le caractère et le fichier.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.backslash": {
+   "en": {
+    "meaning": "Folders separated by `\\`, as Windows PowerShell 5.1 `Compress-Archive` writes them. Send the widget folder itself in the creator space, or use `submit`, which makes a correct ZIP.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Des dossiers séparés par `\\`, comme les écrit `Compress-Archive` de Windows PowerShell 5.1. Envoyez le dossier du widget lui-même dans l’espace créateurs, ou utilisez `submit`, qui fait un ZIP correct.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.duplicate_name": {
+   "en": {
+    "meaning": "Two names that differ only by case, or a file that is also a folder.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Deux noms qui ne diffèrent que par la casse, ou un fichier qui est aussi un dossier.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.link": {
+   "en": {
+    "meaning": "A link, or a device, a FIFO or a socket.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Un lien, ou un périphérique, une FIFO ou un socket.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.special_file": {
+   "en": {
+    "meaning": "A link, or a device, a FIFO or a socket.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Un lien, ou un périphérique, une FIFO ou un socket.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.bomb": {
+   "en": {
+    "meaning": "An entry that inflates far beyond its compressed size, or beyond its declared size.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Une entrée qui se décompresse bien au-delà de sa taille compressée, ou de sa taille déclarée.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.read": {
+   "en": {
+    "meaning": "The file cannot be read (exit status 2).",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Le fichier ne peut pas être lu (code de sortie 2).",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.encrypted": {
+   "en": {
+    "meaning": "An encrypted entry.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Une entrée chiffrée.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
+  "sources.archive": {
+   "en": {
+    "meaning": "Anything else a ZIP should not hold: a comment above 1,024 bytes or holding an end record, bytes before, between or after the entries or after an entry's compressed data, another name in an extra field, sizes or checksums that disagree.",
+    "page": "cli",
+    "section": "Source archives"
+   },
+   "fr": {
+    "meaning": "Tout autre élément qu’un ZIP ne doit pas contenir : un commentaire de plus de 1 024 octets ou qui contient un enregistrement de fin, des octets avant, entre ou après les entrées ou après les données compressées d’une entrée, un autre nom dans un champ extra, des tailles ou des sommes de contrôle qui ne concordent pas.",
+    "page": "cli",
+    "section": "Archives de sources"
+   }
+  },
   "shortcuts.toggle": {
    "en": {
     "meaning": "text — Host-formatted key chord.",
@@ -1696,6 +1900,10 @@
    "from": "Scenarios",
    "codes": "`scenario`, `scenario_name`, `too_many_scenarios`"
   },
+  "sources": {
+   "from": "A source archive",
+   "codes": "see source archives"
+  },
   "init": {
    "from": "Those commands",
    "codes": "listed above"
@@ -1707,6 +1915,10 @@
   "admission": {
    "from": "Those commands",
    "codes": "listed above"
+  },
+  "submit": {
+   "from": "What `submit` checks before sending",
+   "codes": "`widget_not_submittable`, `agreement_required`, `limit_reached`, `version_too_low`, `justification_missing`, `archive_too_large`, `archive_mismatch`, `release_notes`, `justification`, `review_message`"
   }
  }
 }

package/dist/content/reference/manifest.md

@@ -8,7 +8,7 @@ Generated from the creator documentation (pages `manifest`, `services`) and the
 | --- | --- | --- | --- |
 | `schemaVersion` | integer 1 to 1 | yes | Manifest document version. |
 | `apiVersion` | integer 1 to 1 | yes | Widget API version; selects this schema. |
-| `id` | `widget ID` | yes | Reverse-DNS ID, from 3 bytes to 128 bytes: at least two dot-separated segments of `[a-z0-9-]`, each at most 63 bytes and not starting or ending with `-`. `com.playervox` and `com.playervox.*` are reserved for packages signed by PlayerVox. |
+| `id` | `widget ID` | yes | Widget ID, from 3 bytes to 128 bytes: at least two dot-separated segments of `[a-z0-9-]`, each at most 63 bytes and not starting or ending with `-`; `<handle>.<name>` with the publisher's handle, or a domain the publisher verified, reversed, then a name. `com.playervox` and `com.playervox.*` are reserved for packages signed by PlayerVox. |
 | `version` | `version` | yes | SemVer 2.0.0 `MAJOR.MINOR.PATCH[-PRERELEASE]` in canonical form, at most 64 bytes; build metadata is rejected. |
 | `name` | `WidgetName` | yes | Localized widget name shown by the host. |
 | `sizing` | `Sizing` | yes | Size and fit rules applied by the widget's frame. |

package/dist/hidden.js

@@ -0,0 +1,47 @@
+// Characters a widget name never holds, as the widget schema refuses them
+// (crates/overcrow-widget-schema/src/text.rs, kept equal by a test):
+// invisible, blank and text-direction characters, so that a name cannot
+// read otherwise than it is written.
+/** Inclusive ranges of code points. */
+export const INVISIBLE_CHARACTERS = [
+    [0x00ad, 0x00ad],
+    [0x034f, 0x034f],
+    [0x061c, 0x061c],
+    [0x115f, 0x1160],
+    [0x17b4, 0x17b5],
+    [0x180b, 0x180f],
+    [0x200b, 0x200f],
+    [0x2028, 0x202e],
+    [0x2060, 0x206f],
+    [0x2800, 0x2800],
+    [0x3164, 0x3164],
+    [0xfeff, 0xfeff],
+    [0xffa0, 0xffa0],
+    [0xfff9, 0xfffb],
+    [0x1bca0, 0x1bca3],
+    [0x1d173, 0x1d17a],
+    [0xe0000, 0xe0fff],
+];
+const isSelector = (code) => code >= 0xfe00 && code <= 0xfe0f;
+/**
+ * The first hidden character of `text`, its position counted in characters
+ * from 1: an invisible character, or a variation selector that starts the
+ * text or follows another one (an emoji keeps its presentation selector).
+ */
+export function hiddenCharacter(text) {
+    let previous;
+    let position = 0;
+    for (const character of text) {
+        position += 1;
+        const code = character.codePointAt(0) ?? 0;
+        const misplacedSelector = isSelector(code) && (previous === undefined || isSelector(previous));
+        if (misplacedSelector ||
+            INVISIBLE_CHARACTERS.some(([start, end]) => code >= start && code <= end)) {
+            return { position, code };
+        }
+        previous = code;
+    }
+    return undefined;
+}
+/** `U+202E`. */
+export const codePoint = (code) => `U+${code.toString(16).toUpperCase().padStart(4, "0")}`;

package/dist/texts.js

@@ -9,7 +9,7 @@ Work in this order: status, setup (once), create_widget, install_sdk, check, tes
 
 Widget ID: it is final and can never be reused. Ask the user for it: <handle>.<name>, where <handle> is their publisher handle in the OverCrow creator space (such as nova.lol-timers), or a reverse domain they can verify (such as gg.nova.lol-timers). Never com.playervox.*: it is reserved for PlayerVox.
 
-Submission: prepare_submission checks everything the creator space asks for, writes the ZIP of the sources to dist/, and lists the texts to write: why the widget needs each permission, the release notes and the description in English and French. Draft them and show them to the user. The user sends the ZIP and the texts in the OverCrow creator space on overcrow.playervox.com.
+Submission: prepare_submission checks everything the creator space asks for, writes the ZIP of the sources to dist/, and lists the texts to write: why the widget needs each permission, the release notes and the description in English and French. Draft them and show them to the user. The user sends the ZIP and the texts in the OverCrow creator space, at creators.playervox.com.
 
 Security: ask for the least. Declare only the permissions the widget uses. Network: exact routes (method and path, parameters constrained), a tight maxResponseBytes, no user data sent without a reason. No secret in a widget: it is public. Clipboard writes only in the handler of a user action. Bounded storage.
 

package/dist/tools/project.js

@@ -5,6 +5,7 @@ import { z } from "zod";
 import { Cli } from "../cli.js";
 import { projects } from "../content.js";
 import { installPackages } from "../npm.js";
+import { codePoint, hiddenCharacter } from "../hidden.js";
 import { cleanLine } from "../text.js";
 import { DESCRIPTIONS, TEMPLATE_SUMMARIES } from "../texts.js";
 import { ID_FORMS, idProblem, isPlaceholderId } from "../ids.js";
@@ -19,6 +20,10 @@ export function nameProblem(name) {
         REFUSED_IN_NAME.test(name)) {
         return "The name must be 1 to 48 characters, without spaces at either end, control characters, < or >.";
     }
+    const hidden = hiddenCharacter(name);
+    if (hidden) {
+        return `The name holds a hidden character, ${codePoint(hidden.code)}, at position ${hidden.position}: remove it.`;
+    }
     return undefined;
 }
 async function listFiles(directory) {

package/dist/tools/submission.js

@@ -23,7 +23,7 @@ const DIRECTORY = z
 const VERSION = /^\d+\.\d+\.\d+$/;
 const MAX_LISTED_INCLUDED = 200;
 const MAX_LISTED_EXCLUDED = 100;
-export const SEND = "The user sends the ZIP and these texts in the OverCrow creator space on overcrow.playervox.com.";
+export const SEND = "The user sends the ZIP and these texts in the OverCrow creator space, at creators.playervox.com.";
 const KIB = 1024;
 const kib = (bytes) => `${Math.max(1, Math.round(bytes / KIB))} KiB`;
 const size = (bytes) => bytes >= KIB * KIB && bytes % (KIB * KIB) === 0

package/dist/version.js

@@ -1,3 +1,3 @@
 // The package version; scripts/build.mjs refuses a build where it differs
 // from package.json.
-export const VERSION = "0.1.0";
+export const VERSION = "0.1.2";

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@overcrow/mcp",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@overcrow/mcp",
-      "version": "0.1.0",
+      "version": "0.1.2",
       "license": "MIT",
       "dependencies": {
         "@modelcontextprotocol/server": "2.3.1",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@overcrow/mcp",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "MCP server that lets an AI assistant create, check, test, audit and package PlayerVox OverCrow widgets.",
   "license": "MIT",
   "type": "module",