@snap-rail/plugin-kit 0.2.0 → 0.2.1

package/lib/build.js

@@ -156,7 +156,8 @@ function hostBundle(entry) {
 		platform: "node",
 		target: "es2024",
 		dts: false,
-		clean: false
+		clean: false,
+		fixedExtension: false
 	});
 }
 /**

package/lib/index.js

@@ -1,7 +1,7 @@
 import { CLIENT_EXTERNALS, CONTRIBUTED_SEED_MODULES, SEED_ABI_REVISION, SEED_MODULES, checkSeedAbi } from "./seeds.js";
 import { clientBundle, hostBundle, seedImportGuard } from "./build.js";
 import { PLUGIN_KINDS, clientFaceSchema, seedAbiSchema, snapRailManifestSchema } from "./manifest.js";
-import { releaseFiles, releaseManifest, zipFileName } from "./pack.js";
+import { catalogEntryFromZip, releaseFiles, releaseManifest, zipFileName } from "./pack.js";
 import { packageNameOf, recipeDocumentSchema, recipePackageNames, recipeRowSchema } from "./recipe.js";
 import { RELEASE_METADATA_PATH, RELEASE_SIGNATURE_PATH, canonicalJson, releaseMetadata, sha256, signReleaseFiles, signReleaseMetadata, verifyReleaseFiles } from "./sign.js";
 //#region lib/types/slot-vocabulary.js
@@ -40,4 +40,4 @@ function defineSlotVocabulary(ids, options) {
 	};
 }
 //#endregion
-export { CLIENT_EXTERNALS, CONTRIBUTED_SEED_MODULES, CUSTOM_SLOT_PATTERN, PLUGIN_KINDS, RELEASE_METADATA_PATH, RELEASE_SIGNATURE_PATH, SEED_ABI_REVISION, SEED_MODULES, canonicalJson, checkSeedAbi, clientBundle, clientFaceSchema, defineSlotVocabulary, hostBundle, packageNameOf, recipeDocumentSchema, recipePackageNames, recipeRowSchema, releaseFiles, releaseManifest, releaseMetadata, seedAbiSchema, seedImportGuard, sha256, signReleaseFiles, signReleaseMetadata, snapRailManifestSchema, verifyReleaseFiles, zipFileName };
+export { CLIENT_EXTERNALS, CONTRIBUTED_SEED_MODULES, CUSTOM_SLOT_PATTERN, PLUGIN_KINDS, RELEASE_METADATA_PATH, RELEASE_SIGNATURE_PATH, SEED_ABI_REVISION, SEED_MODULES, canonicalJson, catalogEntryFromZip, checkSeedAbi, clientBundle, clientFaceSchema, defineSlotVocabulary, hostBundle, packageNameOf, recipeDocumentSchema, recipePackageNames, recipeRowSchema, releaseFiles, releaseManifest, releaseMetadata, seedAbiSchema, seedImportGuard, sha256, signReleaseFiles, signReleaseMetadata, snapRailManifestSchema, verifyReleaseFiles, zipFileName };

package/lib/pack.js

@@ -2,6 +2,8 @@ import { CLIENT_EXTERNALS } from "./seeds.js";
 import { createRequire } from "node:module";
 import { readFile, readdir } from "node:fs/promises";
 import { join, relative } from "node:path";
+import { createHash } from "node:crypto";
+import { unzipSync } from "fflate";
 //#region lib/types/pack.js
 /**
 * Final-format assembly: turn a built plugin package into the file set of
@@ -154,5 +156,50 @@ async function releaseFiles(spec) {
 function zipFileName(packageName) {
 	return `${packageName.replaceAll("/", "__")}.zip`;
 }
+/**
+* The one feed-entry emitter every producer shares: read a plugin zip's own
+* bytes back (release manifest + signature envelope), derive the
+* `index.json` entry from exactly what the zip carries, and digest the exact
+* bytes the client will download — the feed can never advertise something a
+* zip does not. The repo's pack/collect pipeline and the standalone
+* `snap-rail-plugin feed` command all converge here.
+*
+* @param zipped - the exact zip bytes the feed will serve.
+* @param file - the pure file name the entry advertises (no path).
+* @param fallbackName - the entry's name when the manifest carries none.
+* @param options.requireSignature - refuse unsigned zips (feed policy).
+* @param options.repository - an optional source-repository URL.
+* @returns the entry, unknown fields stripped by construction.
+* @throws when the zip has no readable manifest, or no signature while
+*   `requireSignature` is set.
+*/
+function catalogEntryFromZip(zipped, file, fallbackName, options = {}) {
+	const files = unzipSync(zipped);
+	const manifestFile = files["package.json"];
+	if (manifestFile === void 0) throw new Error(`catalog: ${file} 缺少 package.json`);
+	const manifest = JSON.parse(new TextDecoder().decode(manifestFile));
+	const signatureFile = files["META-INF/signature.json"];
+	if (signatureFile === void 0 && options.requireSignature === true) throw new Error(`catalog: ${file} 没有签名（META-INF/signature.json 缺失）`);
+	const signature = signatureFile === void 0 ? void 0 : JSON.parse(new TextDecoder().decode(signatureFile));
+	return {
+		name: manifest.name ?? fallbackName,
+		version: manifest.version ?? "0.0.0",
+		...manifest.description !== void 0 && manifest.description !== "" ? { description: manifest.description } : {},
+		...manifest.snapRail?.kind !== void 0 ? { kind: manifest.snapRail.kind } : {},
+		...manifest.snapRail?.title !== void 0 ? { title: manifest.snapRail.title } : {},
+		...manifest.snapRail?.category !== void 0 ? { category: manifest.snapRail.category } : {},
+		...manifest.snapRail?.requires !== void 0 ? { requires: manifest.snapRail.requires } : {},
+		...manifest.snapRail?.permissions !== void 0 ? { permissions: manifest.snapRail.permissions } : {},
+		...manifest.snapRail?.engines !== void 0 ? { engines: manifest.snapRail.engines } : {},
+		file,
+		sha256: createHash("sha256").update(zipped).digest("hex"),
+		size: zipped.length,
+		...signature === void 0 ? {} : { signature: {
+			algorithm: signature.algorithm,
+			keyId: signature.keyId
+		} },
+		...options.repository === void 0 ? {} : { repository: options.repository }
+	};
+}
 //#endregion
-export { releaseFiles, releaseManifest, zipFileName };
+export { catalogEntryFromZip, releaseFiles, releaseManifest, zipFileName };

package/lib/types/index.d.ts

@@ -12,7 +12,7 @@ export { SEED_MODULES } from './seeds.ts';
 export { CLIENT_EXTERNALS, CONTRIBUTED_SEED_MODULES, SEED_ABI_REVISION, checkSeedAbi, type SeedAbi, type SeedAbiVerdict, } from './seeds.ts';
 export { clientBundle, hostBundle, seedImportGuard } from './build.ts';
 export { CUSTOM_SLOT_PATTERN, defineSlotVocabulary, type SlotIdOf, type SlotVocabulary, } from './slot-vocabulary.ts';
-export { releaseFiles, releaseManifest, zipFileName, type ReleaseSpec } from './pack.ts';
+export { catalogEntryFromZip, releaseFiles, releaseManifest, zipFileName, type FeedEntry, type ReleaseSpec } from './pack.ts';
 export { packageNameOf, recipeDocumentSchema, recipePackageNames, recipeRowSchema, type RecipeDocument, type RecipeRow, } from './recipe.ts';
 export { RELEASE_METADATA_PATH, RELEASE_SIGNATURE_PATH, canonicalJson, releaseMetadata, sha256, signReleaseFiles, signReleaseMetadata, verifyReleaseFiles, type ReleaseFileDigests, type ReleaseMetadata, type ReleaseSignature, type TrustedReleaseKey, } from './sign.ts';
 //# sourceMappingURL=index.d.ts.map

package/lib/types/pack.d.ts

@@ -75,5 +75,51 @@ export declare function releaseManifest(source: SourceManifest, main: string, ex
 export declare function releaseFiles(spec: ReleaseSpec): Promise<Record<string, Uint8Array>>;
 /** The zip file name a package's release takes under dist-plugins/. */
 export declare function zipFileName(packageName: string): string;
+/** One plugin entry the feed's `index.json` carries (feed facts only). */
+export interface FeedEntry {
+    name: string;
+    version: string;
+    description?: string;
+    kind?: string;
+    title?: string;
+    category?: string;
+    requires?: string[];
+    permissions?: string[];
+    engines?: {
+        snapRail?: string;
+        hostProtocol?: string;
+        renderer?: string;
+    };
+    /** The pure file name the entry advertises (no path). */
+    file: string;
+    sha256: string;
+    size: number;
+    signature?: {
+        algorithm: 'Ed25519';
+        keyId: string;
+    };
+    repository?: string;
+}
+/**
+ * The one feed-entry emitter every producer shares: read a plugin zip's own
+ * bytes back (release manifest + signature envelope), derive the
+ * `index.json` entry from exactly what the zip carries, and digest the exact
+ * bytes the client will download — the feed can never advertise something a
+ * zip does not. The repo's pack/collect pipeline and the standalone
+ * `snap-rail-plugin feed` command all converge here.
+ *
+ * @param zipped - the exact zip bytes the feed will serve.
+ * @param file - the pure file name the entry advertises (no path).
+ * @param fallbackName - the entry's name when the manifest carries none.
+ * @param options.requireSignature - refuse unsigned zips (feed policy).
+ * @param options.repository - an optional source-repository URL.
+ * @returns the entry, unknown fields stripped by construction.
+ * @throws when the zip has no readable manifest, or no signature while
+ *   `requireSignature` is set.
+ */
+export declare function catalogEntryFromZip(zipped: Uint8Array, file: string, fallbackName: string, options?: {
+    requireSignature?: boolean;
+    repository?: string;
+}): FeedEntry;
 export {};
 //# sourceMappingURL=pack.d.ts.map

package/package.json

@@ -1,10 +1,23 @@
 {
   "name": "@snap-rail/plugin-kit",
-  "description": "The plugin author's kit: snapRail manifest vocabulary, the renderer seed whitelist, and tsdown presets for installable host + client faces",
-  "version": "0.2.0",
+  "description": "The plugin author's kit: snapRail manifest vocabulary, the renderer seed whitelist, tsdown presets for installable host + client faces, release signing, and the final-format packer",
+  "version": "0.2.1",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
+  "homepage": "https://www.snap-rail.top/dev.html",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/yansijian/snap-rail.git",
+    "directory": "packages/base/plugin-kit"
+  },
+  "keywords": [
+    "snap-rail",
+    "plugin",
+    "cordis",
+    "industrial",
+    "electron"
+  ],
   "exports": {
     ".": {
       "types": "./lib/types/index.d.ts",
@@ -43,6 +56,7 @@
   ],
   "license": "Apache-2.0",
   "dependencies": {
+    "fflate": "^0.8.3",
     "zod": "^4.4.3",
     "@snap-rail/util": "^0.1.2"
   },