@spicetify/kit 0.1.0

package/dist/vault.js

@@ -0,0 +1,108 @@
+/*
+ * Copyright (C) 2026 Afonso Jorge Ramos
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+/**
+ * vault - record a built module into a vault file for the module store.
+ *
+ * Card data (name, description, authors, tags) is embedded at the module
+ * level from the dist dir's own metadata.json so it cannot drift from what
+ * installs, alongside a per-version sha256 checksum of the artifact.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+const USAGE = "spicetify-kit vault add <dist-dir> --artifact <url> [--zip <file>] [--vault <path>]\n  (default target: vault/<id>.json, the shape a store submission takes)";
+const normalizeAuthors = (authors) => authors.flatMap((a) => {
+    if (typeof a === "string")
+        return [{ name: a }];
+    if (a && typeof a === "object" && typeof a.name === "string") {
+        const { name, github } = a;
+        return [{ name, ...(typeof github === "string" ? { github } : {}) }];
+    }
+    return [];
+});
+const metadataSubset = (meta) => {
+    const out = {};
+    if (typeof meta.name === "string")
+        out.name = meta.name;
+    if (typeof meta.description === "string")
+        out.description = meta.description;
+    if (Array.isArray(meta.authors))
+        out.authors = normalizeAuthors(meta.authors);
+    if (Array.isArray(meta.tags))
+        out.tags = meta.tags;
+    if (typeof meta.preview === "string" && /^https?:\/\//.test(meta.preview))
+        out.preview = meta.preview;
+    if (typeof meta.repository === "string" && meta.repository.startsWith("https://"))
+        out.repository = meta.repository;
+    if (typeof meta.readme === "string" && meta.readme.startsWith("https://"))
+        out.readme = meta.readme;
+    if (typeof meta.license === "string" && meta.license.trim())
+        out.license = meta.license.trim();
+    return out;
+};
+const sha256 = (bytes) => `sha256:${createHash("sha256").update(bytes).digest("hex")}`;
+const today = () => new Date().toISOString().slice(0, 10);
+async function download(url) {
+    const res = await fetch(url);
+    if (!res.ok)
+        throw new Error(`${url} -> HTTP ${res.status}`);
+    return Buffer.from(await res.arrayBuffer());
+}
+export async function runVault(argv, cwd = process.cwd()) {
+    const [cmd, ...rest] = argv;
+    if (cmd !== "add")
+        throw new Error(USAGE);
+    const distArg = rest.find((a) => !a.startsWith("--"));
+    const flag = (n) => {
+        const i = rest.indexOf(`--${n}`);
+        return i >= 0 ? rest[i + 1] : undefined;
+    };
+    const artifact = flag("artifact");
+    if (!distArg || !artifact)
+        throw new Error(USAGE);
+    const distDir = path.resolve(cwd, distArg);
+    const meta = JSON.parse(readFileSync(path.join(distDir, "metadata.json"), "utf8"));
+    const id = meta.name;
+    const version = meta.version;
+    if (!id || !version)
+        throw new Error(`${distArg}/metadata.json must set name and version`);
+    const zip = flag("zip");
+    const bytes = zip ? readFileSync(path.resolve(cwd, zip)) : await download(artifact);
+    const checksum = sha256(bytes);
+    // One file per module, which is exactly what a submission to the
+    // registry is: vault/<id>.json holding this module and nothing else.
+    const vaultPath = path.resolve(cwd, flag("vault") ?? path.join("vault", `${id}.json`));
+    const module = existsSync(vaultPath)
+        ? JSON.parse(readFileSync(vaultPath, "utf8"))
+        : { v: {} };
+    module.v ??= {};
+    // A published version is immutable: its checksum is what every install
+    // of it was verified against, so re-pointing it at different bytes is
+    // refused here as well as by the registry's validator.
+    const existing = module.v[version];
+    if (existing?.checksum && existing.checksum.toLowerCase() !== checksum.toLowerCase()) {
+        throw new Error(`${id}@${version}: checksum mismatch (vault ${existing.checksum}, artifact ${checksum}); refusing to overwrite`);
+    }
+    module.v[version] = {
+        artifacts: [artifact],
+        providers: [],
+        checksum,
+        updatedAt: today(),
+    };
+    // Card data lives at the module level (one identity per module); an
+    // add records the newest release, so the card follows it. Curated
+    // per-author github attribution usually doesn't come from the
+    // artifact and must survive the rewrite (artifact-declared wins).
+    const prev = module.metadata;
+    const next = metadataSubset(meta);
+    if (prev?.authors?.length && next.authors?.length) {
+        const curated = new Map(prev.authors.filter((a) => a.github).map((a) => [a.name, a.github]));
+        next.authors = next.authors.map((a) => !a.github && curated.has(a.name) ? { ...a, github: curated.get(a.name) } : a);
+    }
+    module.metadata = next;
+    mkdirSync(path.dirname(vaultPath), { recursive: true });
+    writeFileSync(vaultPath, `${JSON.stringify(module, null, "\t")}\n`);
+    console.log(`added ${id}@${version} to ${vaultPath}`);
+}

package/package.json

@@ -0,0 +1,49 @@
+{
+  "name": "@spicetify/kit",
+  "version": "0.1.0",
+  "description": "Developer kit for spicetify v3 modules: scaffold, build, hot-push, and pack",
+  "license": "GPL-3.0-or-later",
+  "homepage": "https://github.com/spicetify/modules#readme",
+  "bugs": {
+    "url": "https://github.com/spicetify/modules/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/spicetify/modules.git",
+    "directory": "packages/kit"
+  },
+  "type": "module",
+  "bin": {
+    "spicetify-kit": "bin/spicetify-kit.js"
+  },
+  "exports": {
+    ".": "./dist/cli.js",
+    "./create": "./dist/create.js",
+    "./build": "./dist/build.js",
+    "./dev": "./dist/dev.js",
+    "./pack": "./dist/pack.js",
+    "./from-theme": "./dist/from-theme.js",
+    "./check": "./dist/check.js",
+    "./vault": "./dist/vault.js",
+    "./install": "./dist/install.js"
+  },
+  "files": [
+    "bin",
+    "dist",
+    "vendor"
+  ],
+  "engines": {
+    "node": ">=22"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "dependencies": {
+    "rolldown": "^1.2.0",
+    "sass-embedded": "^1.80.0"
+  },
+  "scripts": {
+    "build": "../../node_modules/.bin/tsc -p tsconfig.build.json",
+    "test": "node --test \"test/*.test.mts\""
+  }
+}

package/vendor/classmaps/1020096/classmap-19f856aefd5.json

@@ -0,0 +1,109 @@
+{
+  "main": {
+    "topbar": {
+      "wrapper": "NXttmW3KPwE1r4Am",
+      "left": {
+        "button": {
+          "wrapper": "kUHE42xvQVzWqabl",
+          "icon": {
+            "wrapper": "IYDlXmBmmUKHveMzIPCF"
+          }
+        },
+        "button_t": {
+          "wrapper": "_Bg_zSvFrEutyacG"
+        }
+      },
+      "right": {
+        "button": {
+          "wrapper": "kUHE42xvQVzWqabl"
+        },
+        "button_t": {
+          "wrapper": "sXjzYBob5Y4psogB"
+        },
+        "upgrade_button": {
+          "wrapper": "Upqw01TOXETOmR5Td7Dj"
+        }
+      }
+    },
+    "playbar": {
+      "widget": {},
+      "controls": {},
+      "buttons": {
+        "button": {
+          "wrapper": "_EuXSrqTA94N1Evn",
+          "wrapper__active": "v1kNYVvW5P8Wa4jS",
+          "wrapper__indicator": "EHxL6K_6WWDlTCZP6x5w"
+        }
+      }
+    },
+    "navbar": {
+      "link": {
+        "wrapper": "kUHE42xvQVzWqabl",
+        "container": "kUHE42xvQVzWqabl",
+        "container__active": "kUHE42xvQVzWqabl"
+      }
+    },
+    "global_navbar": {},
+    "sidebar": {},
+    "panel": {}
+  },
+  "tracklist": {
+    "column_header": "F_VvNCRKZ2cKj1a9"
+  },
+  "search_chips": {
+    "wrapper_wrapper": "qZHfdckfFVY5AURF",
+    "wrapper": "x_HLN829yDsvJDgl",
+    "container": "dxlv5wfAu8zgm7HY",
+    "chip": "U4idT8HUFwfj7PWP"
+  },
+  "modal": {
+    "widget_generator": {
+      "container": "gx9qsprOAO4ubEFc",
+      "header": {
+        "container": "g9sFYudWkUldbuNa",
+        "close": "Pk4GI8WfBMjS5R2J"
+      },
+      "content": {
+        "container": "ywtSYUL2xRwVlvSo"
+      }
+    },
+    "track_credits": {
+      "container": "p5LJBmlswjcRT458",
+      "header": {
+        "container": "idsrX6VAUY49Eczw",
+        "close": "_18qFNPzv7Eyyck8"
+      },
+      "content": {
+        "container": "yKG9lWaUWIBUyVCu"
+      }
+    }
+  },
+  "settings": {
+    "header": {
+      "container": "fEEfljGMIEhhmWVi"
+    },
+    "section": {
+      "container": "nWR7PbHjFXQJiYNL"
+    },
+    "button": {
+      "wrapper": "nHgEqWYM1q0omZ6y"
+    },
+    "text_input": "e-10451-form-input e-10451-form-control encore-text-body-medium"
+  },
+  "scrollable_text": {
+    "container": "MyaStf5D5Im3gt9M",
+    "wrapper": "dxlv5wfAu8zgm7HY"
+  },
+  "sort_box": {
+    "list": {
+      "button": "LQ6y2jhZZtMS7xCr"
+    }
+  },
+  "search_box": {
+    "container": "S0nU7XTXYMOBcASz",
+    "expand_button": "eu6ObgEHE5owtzi_"
+  },
+  "context_menu": {
+    "menu_item": "yqG4N5YYcY4uEujt"
+  }
+}

package/vendor/shims/chunks.d.ts

@@ -0,0 +1,10 @@
+// Ambient declaration for the chunk-promise table the modular loader
+// maintains on globalThis; keyed by chunk path plus aliases like "xpui".
+declare global {
+	var CHUNKS: Record<
+		string,
+		{ promise: Promise<unknown>; resolve?: (value?: unknown) => void; reject?: (reason?: unknown) => void }
+	>;
+}
+
+export {};

package/vendor/shims/remote-modules.d.ts

@@ -0,0 +1,6 @@
+// Remote and data-URL imports carry no local type information; stitch
+// leaves the URLs untouched at build time and the editor treats them
+// as any.
+declare module "https://*";
+declare module "npm:*";
+declare module "data:*";