@proveanything/smartlinks 2.1.10 → 2.1.12

package/package.json

@@ -1,87 +1,87 @@
-{
-  "name": "@proveanything/smartlinks",
-  "version": "2.1.10",
-  "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
-  "type": "module",
-  "main": "dist/index.js",
-  "types": "dist/index.d.ts",
-  "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js",
-      "default": "./dist/index.js"
-    },
-    "./testing": {
-      "types": "./dist/testing/index.d.ts",
-      "import": "./dist/testing/index.js",
-      "default": "./dist/testing/index.js"
-    },
-    "./*": {
-      "types": "./dist/*.d.ts",
-      "import": "./dist/*.js",
-      "default": "./dist/*.js"
-    },
-    "./baseline.css": "./dist/baseline.css",
-    "./baseline.classes.json": "./dist/baseline.classes.json",
-    "./theme.css": "./dist/theme.css",
-    "./theme-boot.js": "./dist/theme-boot.js",
-    "./package.json": "./package.json"
-  },
-  "bin": {
-    "smartlinks-register-release": "scripts/register-release.mjs",
-    "smartlinks-publish": "scripts/publish.mjs",
-    "smartlinks-doctor": "scripts/doctor.mjs",
-    "smartlinks-headless": "scripts/headless-check.mjs"
-  },
-  "files": [
-    "dist/",
-    "docs/",
-    "scripts/register-release.mjs",
-    "scripts/publish.mjs",
-    "scripts/doctor.mjs",
-    "scripts/headless-check.mjs",
-    "scripts/lib/",
-    "openapi.yaml",
-    "README.md"
-  ],
-  "scripts": {
-    "test": "node test/run.cjs",
-    "build": "tsc && node scripts/fix-esm-extensions.mjs && node generate-api-summary.cjs && node generate-openapi.cjs && node scripts/copy-docs-to-dist.cjs && node scripts/build-baseline.mjs",
-    "docs": "typedoc",
-    "docs:summary": "node generate-api-summary.cjs",
-    "docs:openapi": "node generate-openapi.cjs",
-    "docs:openapi:lint": "npx --yes @redocly/cli@latest lint openapi.yaml",
-    "docs:openapi:check": "node generate-openapi.cjs && npx --yes @redocly/cli@latest lint openapi.yaml",
-    "build:docs": "tsc build-docs.ts --outDir dist && node dist/build-docs.js",
-    "prepublishOnly": "npm run build"
-  },
-  "keywords": [
-    "smartlinks",
-    "api",
-    "authentication",
-    "traceability",
-    "blockchain",
-    "typescript",
-    "sdk"
-  ],
-  "author": "Glenn Shoosmith",
-  "license": "MIT",
-  "publishConfig": {
-    "access": "public"
-  },
-  "dependencies": {
-    "cross-fetch": "^3.1.5",
-    "es-module-lexer": "^1.7.0"
-  },
-  "devDependencies": {
-    "ts-node": "^10.9.1",
-    "typedoc": "^0.25.13",
-    "typedoc-plugin-markdown": "^3.17.1",
-    "typescript": "^4.9.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "https://github.com/Prove-Anything/smartlinks.git"
-  },
-  "homepage": "https://smartlinks.app"
-}
+{
+  "name": "@proveanything/smartlinks",
+  "version": "2.1.12",
+  "description": "Official JavaScript/TypeScript SDK for the Smartlinks API",
+  "type": "module",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    },
+    "./testing": {
+      "types": "./dist/testing/index.d.ts",
+      "import": "./dist/testing/index.js",
+      "default": "./dist/testing/index.js"
+    },
+    "./*": {
+      "types": "./dist/*.d.ts",
+      "import": "./dist/*.js",
+      "default": "./dist/*.js"
+    },
+    "./baseline.css": "./dist/baseline.css",
+    "./baseline.classes.json": "./dist/baseline.classes.json",
+    "./theme.css": "./dist/theme.css",
+    "./theme-boot.js": "./dist/theme-boot.js",
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "smartlinks-register-release": "scripts/register-release.mjs",
+    "smartlinks-publish": "scripts/publish.mjs",
+    "smartlinks-doctor": "scripts/doctor.mjs",
+    "smartlinks-headless": "scripts/headless-check.mjs"
+  },
+  "files": [
+    "dist/",
+    "docs/",
+    "scripts/register-release.mjs",
+    "scripts/publish.mjs",
+    "scripts/doctor.mjs",
+    "scripts/headless-check.mjs",
+    "scripts/lib/",
+    "openapi.yaml",
+    "README.md"
+  ],
+  "scripts": {
+    "test": "node test/run.cjs",
+    "build": "tsc && node scripts/fix-esm-extensions.mjs && node generate-api-summary.cjs && node generate-openapi.cjs && node scripts/copy-docs-to-dist.cjs && node scripts/build-baseline.mjs",
+    "docs": "typedoc",
+    "docs:summary": "node generate-api-summary.cjs",
+    "docs:openapi": "node generate-openapi.cjs",
+    "docs:openapi:lint": "npx --yes @redocly/cli@latest lint openapi.yaml",
+    "docs:openapi:check": "node generate-openapi.cjs && npx --yes @redocly/cli@latest lint openapi.yaml",
+    "build:docs": "tsc build-docs.ts --outDir dist && node dist/build-docs.js",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "smartlinks",
+    "api",
+    "authentication",
+    "traceability",
+    "blockchain",
+    "typescript",
+    "sdk"
+  ],
+  "author": "Glenn Shoosmith",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "cross-fetch": "^3.1.5",
+    "es-module-lexer": "^1.7.0"
+  },
+  "devDependencies": {
+    "ts-node": "^10.9.1",
+    "typedoc": "^0.25.13",
+    "typedoc-plugin-markdown": "^3.17.1",
+    "typescript": "^4.9.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Prove-Anything/smartlinks.git"
+  },
+  "homepage": "https://smartlinks.app"
+}

package/scripts/publish.mjs

@@ -30,19 +30,29 @@ const CHANNEL = flag('--channel', process.env.SMARTLINKS_CHANNEL || 'dev')
 const DIR = flag('--dir', 'dist')
 const WATCH = args.includes('--watch')
 
-// Mirror of the server's write allowlist — a bundle is static web assets only. Source maps (.map) are
-// never published: a release is promoted to beta and stable as-is, so a map would serve the app's
-// original source publicly (and maps are most of a bundle's size). Debug in Forge's preview; a
-// Release to dev is a readable, unminified build instead.
-const ALLOWED = new Set(['.js', '.mjs', '.css', '.json', '.wasm', '.html', '.txt',
-  '.svg', '.png', '.jpg', '.jpeg', '.gif', '.webp', '.avif', '.ico', '.woff', '.woff2', '.ttf', '.otf'])
+// Every built file is published except two kinds. Source maps (.map): a release is promoted to beta and
+// stable as-is, so a map would serve the app's original source publicly (and maps are most of a bundle's
+// size); debug in Forge's preview, and a Release to dev is a readable, unminified build instead. And the
+// server's block list (prove services/apps/appBucket.js — keep in step): programs and installers, server
+// config, keys. SmartLinks serves web types as themselves and anything else as a download.
+const BLOCKED_EXT = new Set(['.exe', '.msi', '.msix', '.dll', '.com', '.scr', '.bat', '.cmd', '.ps1', '.psm1', '.vbs', '.vbe',
+  '.wsf', '.hta', '.lnk', '.reg', '.cpl', '.jar', '.apk', '.aab', '.ipa', '.dmg', '.pkg', '.deb', '.rpm', '.appimage', '.sh',
+  '.bash', '.php', '.phtml', '.asp', '.aspx', '.jsp', '.cgi', '.pl', '.py', '.pem', '.key', '.p12', '.pfx', '.jks', '.keystore'])
+const BLOCKED_NAMES = new Set(['_headers', '_redirects', '.htaccess', '.htpasswd', 'web.config', '.npmrc', '.yarnrc', '.ds_store'])
 const extOf = (p) => { const i = p.lastIndexOf('.'); return i < 0 ? '' : p.slice(i).toLowerCase() }
+const isBlocked = (rel) => {
+  const base = rel.slice(rel.lastIndexOf('/') + 1).toLowerCase()
+  if (BLOCKED_NAMES.has(base) || BLOCKED_EXT.has(extOf(base))) return true
+  return /^\.env(\.|$)/.test(base) || rel.toLowerCase().split('/').some((seg) => seg === '.git' || seg === '.ssh')
+}
 
 function fail(msg) { console.error(`❌ ${msg}`); process.exit(1) }
 if (!APP_ID) fail('SMARTLINKS_APP_ID is required')
 if (!KEY) fail('SMARTLINKS_DEPLOY_KEY is required')
 
 let skippedMaps = 0
+/** Built files SmartLinks never serves (the block list) — said out loud: an app that loads one would 404. */
+let skippedOther = []
 
 function collectFiles(dir) {
   const out = {}
@@ -50,8 +60,9 @@ function collectFiles(dir) {
     for (const e of readdirSync(d, { withFileTypes: true })) {
       const full = join(d, e.name)
       if (e.isDirectory()) { walk(full); continue }
-      if (!ALLOWED.has(extOf(e.name))) { if (extOf(e.name) === '.map') skippedMaps++; continue }
       const rel = relative(dir, full).split(sep).join('/') // forward slashes for the bucket
+      if (extOf(e.name) === '.map') { skippedMaps++; continue }
+      if (isBlocked(rel)) { skippedOther.push(rel); continue }
       out[rel] = readFileSync(full)
     }
   }
@@ -173,9 +184,13 @@ async function publishOnce() {
   if (!stat.isDirectory()) fail(`${DIR} is not a directory`)
 
   skippedMaps = 0
+  skippedOther = []
   const files = collectFiles(DIR)
   if (!files['app.manifest.json']) fail(`${DIR}/app.manifest.json not found — is this a built app bundle?`)
   if (skippedMaps) console.log(`   (${skippedMaps} source map${skippedMaps === 1 ? '' : 's'} left out — maps are never published)`)
+  if (skippedOther.length) {
+    console.warn(`⚠️  ${skippedOther.length} file${skippedOther.length === 1 ? '' : 's'} left out — SmartLinks never serves programs, server config or keys, so the app can't load ${skippedOther.length === 1 ? 'it' : 'them'}: ${skippedOther.slice(0, 8).join(', ')}${skippedOther.length > 8 ? ', …' : ''}`)
+  }
 
   const t0 = Date.now()
   const entries = Object.entries(files)