@velven/cli 0.1.0 → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,29 @@
+# Changelog
+
+## 0.2.1
+
+- A `clip` in `velven.json` must be 5 to 10 seconds long. The CLI reads the length from the file's header and stops with
+  exit 2 (`invalid_media`) when it's outside that range. A file that doesn't say its length still goes through.
+- A `thumbnail` must be 4096 pixels or less on each side. The CLI reads the size from the picture's header and stops
+  with exit 2 (`invalid_media`) when it's larger.
+
+## 0.2.0
+
+- `velven publish --prod` is usually live when the command ends: Velven reads every file of the version, and a clean
+  version goes live in the same request. The CLI prints the page at once, with no waiting. Sometimes a
+  version answers `publishing` instead and waits on Velven, usually for less than a minute; `--wait` waits for it as
+  before. An older server's `checking` is treated the same way.
+- A version Velven refuses in the publish itself (a program, an installer or a coin miner) prints the reason naming
+  the file and says to remove it and publish again, since no review changes that (`--json`: `code: "scan_refused"`),
+  and exits 6 with or without `--wait`.
+- A program, an installer or a coin miner in the folder is refused before anything is uploaded, naming the file: exit
+  4, code `refused_file`.
+- `velven.json` takes `thumbnail` (a JPEG, PNG or WebP up to 2 MB) and `clip` (an MP4 or WebM up to 3 MB) for the
+  space's tile. Each is checked before anything is uploaded: exit 2, code `invalid_media`.
+- The printed lines, the help and the README say "publishing" and "waiting on Velven to publish it" for a version that
+  waits.
+
+## 0.1.0
+
+- The first release: `login`, `logout`, `whoami`, `publish` (previews, `--prod`, `--wait`, `--json`, publishing
+  without an account), `versions`, `rollback`, `dev` and `reset`.

package/README.md

@@ -1,13 +1,13 @@
 # @velven/cli
 
 Publish a folder to [Velven](https://velven.ai), the community marketplace for spaces built with AI. Velven hosts the files
-and gives you a private preview link; `--prod` checks the version for safety, then puts it live on its own Velven page
-with the SDK added.
+and gives you a private preview link; `--prod` puts the version live on its own Velven page with the SDK added, usually
+within seconds.
 
 ```sh
 npx @velven/cli login
 npx @velven/cli publish ./dist          # a private preview, link printed
-npx @velven/cli publish ./dist --prod   # live once Velven's check passes
+npx @velven/cli publish ./dist --prod   # live on its Velven page
 ```
 
 Or install it: `npm install -g @velven/cli`, then run `velven`. Node 20 or later. No dependencies.
@@ -37,11 +37,31 @@ Optional: `description`, `engine`, `ai_tools`, `models`, `how_made`, `source_url
 | `entry` | The page to open, when it is not `index.html` |
 | `spa` | `true` serves the entry page for any path without a file (client-side routing) |
 | `sdk` | `false` stops Velven adding the SDK's script tag (set it when you bundle `@velven/sdk` yourself) |
-| `start` | How to get past a start screen for the safety check: `{ "click": "Play" }`, `{ "click": [x, y] }` or `{ "key": "Space" }` |
+| `start` | How to get past a start screen, so Velven can look at the space and record its clip: `{ "click": "Play" }`, `{ "click": [x, y] }` or `{ "key": "Space" }` |
+| `thumbnail` | A picture in the folder for your space's tile. JPEG, PNG or WebP, up to 2 MB and 4096 pixels on each side |
+| `clip` | A video in the folder that your tile plays on hover. MP4 or WebM, up to 3 MB and 5 to 10 seconds long. Without a `thumbnail`, its first frame is the picture |
 | `boards`, `achievements`, `stats`, `toasts` | Leaderboards, achievements and stats, declared as in the SDK docs |
 | `space` | Written by the first publish; later publishes update that space |
 | `claim` | Written by a publish without an account; it updates the unlisted page until you claim it |
 
+`velven publish` checks `thumbnail` and `clip` before it uploads anything. Each one must be:
+
+- a file the publish sends, so `.velvenignore` can't leave it out
+- the kind of file its name says, inside as well as in the name
+- within its size: 2 MB for a thumbnail, 3 MB for a clip
+- 4096 pixels or less on each side, for a thumbnail
+- 5 to 10 seconds long, for a clip
+
+If one isn't, the CLI stops with exit 2 (`invalid_media`) and tells you what to fix. Some files don't say how long
+they are. The CLI lets those through, and Velven measures the clip once your space is live. It uses the first 10
+seconds of a longer clip. It drops a clip under 5 seconds and records its own, unless you named a `thumbnail`.
+
+Name either one and Velven records nothing for your tile. A later version that names neither, or names the same files,
+keeps what your space shows. That includes a clip you recorded again or uploaded on the Clip tab.
+
+Your thumbnail and clip follow the same content policy as your space. They must show your space itself, not something
+unrelated or misleading.
+
 A `.velvenignore` file leaves files out: one pattern a line, `*`, `**` and `?`, `folder/` for folders, `#` comments.
 Dotfiles, `node_modules` and every `velven.json` are always left out, in any case, as is a name that ends in a dot or a space or holds `:` or `~` (the CLI names each such file);
 `velven dev` serves by the same rule, `.velvenignore` included, and a path only in the letter case the folder spells it, as the live version
@@ -49,6 +69,15 @@ looks paths up (`Assets/Hero.png` does not open `assets/hero.png`). A link to a
 link's name); a link outside the folder, to one of those, or back up to a folder it sits in is left out, and the CLI names each
 link it leaves out. A version holds at most 100 MB and 2,000 files.
 
+Velven never serves a program, an installer or a coin miner. Before uploading anything, `velven publish` looks at the
+first bytes of every file (a Windows, Linux or Mac program is refused whatever its name), at every name (`.exe`, `.scr`,
+`.msi`, `.dmg`, `.pkg`, `.app`, `.apk`, `.deb`, `.rpm`, `.jar`, `.bat`, `.cmd`, `.ps1`, `.vbs`; a compressed
+`setup.exe.gz` or `setup.exe.br` by the name inside) and at the text of scripts, pages and WebAssembly for a coin
+miner (a compressed file's text is left to Velven, which reads it inflated), and stops naming the file, with exit 4:
+`dist/setup.exe is a Windows program; Velven does not serve programs. Remove it or add it to .velvenignore.`
+The upload on velven.ai checks the same way. Velven reads the whole version again once it is uploaded, and refuses it
+with exit 6 when it holds one of these.
+
 ## Commands
 
 | Command | What it does |
@@ -56,7 +85,7 @@ link it leaves out. A version holds at most 100 MB and 2,000 files.
 | `velven login` | Sign in: shows a code and opens velven.ai to approve it |
 | `velven logout` | Forget this computer's sign-in |
 | `velven whoami` | Who you are signed in as |
-| `velven publish [dir]` | Upload the folder (only files Velven does not already have) as a private preview; with `--prod`, Velven checks it and puts it live |
+| `velven publish [dir]` | Upload the folder (only files Velven does not already have) as a private preview; with `--prod`, live on its Velven page |
 | `velven versions` | The space's versions; `*` marks the live one |
 | `velven rollback [version]` | Put an earlier version live again (asks which when you leave it out) |
 | `velven dev [dir]` | Serve the folder on `localhost` and play it on Velven, with scores and saves going to the sandbox |
@@ -65,10 +94,13 @@ link it leaves out. A version holds at most 100 MB and 2,000 files.
 `velven publish` options:
 
 - Without `--prod`: a private preview. The link works for 24 hours; scores and saves made there go to the sandbox.
-- `--prod`: go live on the space's Velven page once Velven's safety check passes.
-- `--wait`: wait here for the preview link, or with `--prod` for the check's verdict. A refused version prints the
-  reason; a version the check could not judge prints what it saw, and a start hint usually fixes it. Either way you can
-  ask for a review from the link printed.
+- `--prod`: publish it live on the space's Velven page. Most versions are live when the command ends; a refused one
+  prints the reason, naming the file, and exits 6. Sometimes a version waits on
+  Velven to publish it, usually for less than a minute, and the CLI prints a link to follow it.
+- `--wait`: wait here for the preview link, or with `--prod` until a version that waits is live. A refused version
+  prints the reason; a version Velven could not judge prints what it saw, and a start hint usually fixes it. Either way
+  you can ask for a review from the link printed, except for a program or a miner, which is never served: remove the
+  file and publish again.
 - `--title`, `--type`, `--devices desktop,mobile`, `--description`, `--engine`: override `velven.json` for this run only.
 - `--yes`: never ask for missing fields; fail naming them instead.
 - `--json`: print one JSON object, for scripts and agents (also on `whoami` and `versions`).
@@ -77,7 +109,7 @@ link it leaves out. A version holds at most 100 MB and 2,000 files.
 
 ## Without an account
 
-`velven publish` works before you sign in. It makes an **unlisted page** on Velven: live once it passes Velven's check,
+`velven publish` works before you sign in. It makes an **unlisted page** on Velven: live as soon as Velven publishes it,
 with every SDK feature, but not listed anywhere on Velven until you claim it. The CLI prints the page's address, a claim
 token and a claim link, and saves the token in `velven.json` as `"claim"`, so publishing again from the folder updates
 the same page. When `velven.json` cannot be written (read-only, or a folder you cannot write to), the CLI says so, prints
@@ -88,7 +120,7 @@ To claim it, open the claim link, or run `velven login` and publish again from t
 on Velven, and `"claim"` in `velven.json` is replaced by `"space"`. Claimed it in the browser? Run `velven login`
 before publishing again: signed out, the claimed page's token exits 3 (`claim_spent`); claimed while the CLI uploads,
 the version was never finished, so it exits 3 saying to run `velven login` and publish again; claimed while it waits
-with `--wait`, it exits 3 with the space's Files tab link, where the check goes on. Without an account a version
+with `--wait`, it exits 3 with the space's Files tab link, where the version goes on. Without an account a version
 holds at most 50 MB and 1,000 files, and `--prod` needs you to sign in. By publishing you agree to Velven's Terms: https://velven.ai/terms
 
 ## In CI
@@ -104,10 +136,10 @@ Set `VELVEN_TOKEN` to a token from `velven login` (in `~/.config/velven/auth.jso
 | --- | --- |
 | 0 | Done |
 | 1 | Failed: the network, a server error, a failed upload, or cancelled |
-| 2 | A mistake in the command or in `velven.json`, such as a missing field |
+| 2 | A mistake in the command or in `velven.json`, such as a missing field, or a `thumbnail` or `clip` that breaks one of the rules above (`invalid_media`) |
 | 3 | Not signed in (or the token was refused) for something that needs an account, such as `--prod` |
-| 4 | Refused by Velven: not your space, too large, too many files, not found |
+| 4 | Refused by Velven: not your space, too large, too many files, a program, installer or coin miner in the folder (`refused_file`, before anything is uploaded), not found |
 | 5 | Rate limited: try again later |
-| 6 | With `--wait`: the safety check refused the version or could not judge it |
+| 6 | Not published: Velven refused the version, or with `--wait`, could not judge it |
 
 Docs: https://velven.ai/docs

package/dist/velven.js

@@ -23,7 +23,7 @@ class CliError extends Error {
   }
 }
 // package.json
-var version = "0.1.0";
+var version = "0.2.1";
 
 // src/version.ts
 var VERSION = version;
@@ -469,6 +469,9 @@ function requiredProblem(field, value) {
 var isString = (v) => typeof v === "string";
 var isStringList = (v) => Array.isArray(v) && v.every(isString);
 var isBoolean = (v) => typeof v === "boolean";
+function isInsidePath(v) {
+  return isString(v) && !!v && !/^[\\/]/.test(v) && !v.split(/[\\/]/).includes("..");
+}
 function isStart(v) {
   if (!v || typeof v !== "object" || Array.isArray(v))
     return false;
@@ -492,7 +495,9 @@ var OPTIONAL = {
   models: [isStringList, "must be a list of text"],
   how_made: [(v) => isString(v) && v.length <= 2000, "must be text, under 2000 characters"],
   source_url: [isString, "must be a web address"],
-  entry: [(v) => isString(v) && !!v && !v.startsWith("/") && !v.split("/").includes(".."), 'must be a path inside the folder, like "index.html"'],
+  entry: [isInsidePath, 'must be a path inside the folder, like "index.html"'],
+  thumbnail: [isInsidePath, 'must be a path inside the folder, like "media/thumbnail.jpg"'],
+  clip: [isInsidePath, 'must be a path inside the folder, like "media/clip.mp4"'],
   spa: [isBoolean, "must be true or false"],
   sdk: [isBoolean, "must be true or false"],
   toasts: [isBoolean, "must be true or false"],
@@ -755,8 +760,447 @@ import { resolve as resolve2 } from "node:path";
 // src/files.ts
 import { createHash } from "node:crypto";
 import { createReadStream } from "node:fs";
-import { readdir as readdir3, readFile as readFile4, realpath as realpath2, stat as stat2 } from "node:fs/promises";
+import { open, readdir as readdir3, readFile as readFile4, realpath as realpath2, stat as stat2 } from "node:fs/promises";
 import { join as join4, relative as relative2 } from "node:path";
+
+// ../scan-rules/src/each-limit.ts
+async function eachLimit(items, limit, task) {
+  let next = 0;
+  const worker = async () => {
+    while (next < items.length)
+      await task(items[next++]);
+  };
+  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
+}
+// ../scan-rules/src/index.ts
+var HEAD_BYTES = 16;
+var TEXT_EXTENSIONS = new Set(["html", "htm", "xhtml", "js", "mjs", "cjs", "css", "json", "svg", "txt", "xml"]);
+var IGNORE_HINT = "Remove it or add it to .velvenignore.";
+var KIND_WORDS = {
+  windows: { what: "a Windows program", noun: "programs" },
+  linux: { what: "a Linux program", noun: "programs" },
+  mac: { what: "a Mac program", noun: "programs" },
+  "windows-installer": { what: "a Windows installer", noun: "installers" },
+  "mac-installer": { what: "a Mac installer", noun: "installers" },
+  "linux-installer": { what: "a Linux installer", noun: "installers" },
+  android: { what: "an Android app", noun: "programs" },
+  java: { what: "a Java program", noun: "programs" },
+  "windows-script": { what: "a Windows script", noun: "scripts that run outside a browser" }
+};
+var PROGRAM_EXTENSIONS = {
+  exe: "windows",
+  scr: "windows",
+  msi: "windows-installer",
+  dmg: "mac-installer",
+  pkg: "mac-installer",
+  app: "mac",
+  apk: "android",
+  deb: "linux-installer",
+  rpm: "linux-installer",
+  jar: "java",
+  bat: "windows-script",
+  cmd: "windows-script",
+  ps1: "windows-script",
+  vbs: "windows-script"
+};
+var baseName = (path) => path.slice(path.lastIndexOf("/") + 1);
+function extensionOf(path) {
+  const name = baseName(path).toLowerCase().replace(/\.(?:gz|br)$/, "");
+  const dot = name.lastIndexOf(".");
+  return dot > 0 ? name.slice(dot + 1) : "";
+}
+function isCompressed(path) {
+  return /\.(?:gz|br)$/i.test(path);
+}
+function isTextPath(path) {
+  return TEXT_EXTENSIONS.has(extensionOf(path));
+}
+function scansContent(path) {
+  return isTextPath(path) || extensionOf(path) === "wasm";
+}
+function nameHit(path) {
+  const ext = extensionOf(path);
+  const kind = Object.hasOwn(PROGRAM_EXTENSIONS, ext) ? PROGRAM_EXTENSIONS[ext] : undefined;
+  return kind ? { rule: "program-name", kind } : null;
+}
+var startsWith = (head, bytes) => head.length >= bytes.length && bytes.every((b, i) => head[i] === b);
+var u32be = (head, at) => (head[at] << 24 | head[at + 1] << 16 | head[at + 2] << 8 | head[at + 3]) >>> 0;
+function bytesHit(head) {
+  if (startsWith(head, [77, 90]) && head.subarray(2, HEAD_BYTES).includes(0))
+    return { rule: "executable", kind: "windows" };
+  if (startsWith(head, [127, 69, 76, 70]))
+    return { rule: "executable", kind: "linux" };
+  for (const magic of [
+    [254, 237, 250, 206],
+    [254, 237, 250, 207],
+    [206, 250, 237, 254],
+    [207, 250, 237, 254]
+  ]) {
+    if (startsWith(head, magic))
+      return { rule: "executable", kind: "mac" };
+  }
+  if ((startsWith(head, [202, 254, 186, 190]) || startsWith(head, [202, 254, 186, 191])) && head.length >= 8) {
+    const arches = u32be(head, 4);
+    if (arches > 0 && arches < 20)
+      return { rule: "executable", kind: "mac" };
+  }
+  return null;
+}
+var POOL_HOSTS = [
+  "supportxmr\\.com",
+  "minexmr\\.com",
+  "moneroocean\\.stream",
+  "xmrpool\\.eu",
+  "xmrpool\\.net",
+  "nanopool\\.org",
+  "hashvault\\.pro",
+  "herominers\\.com",
+  "c3pool\\.com",
+  "monerohash\\.com",
+  "minergate\\.com",
+  "2miners\\.com",
+  "f2pool\\.com",
+  "unmineable\\.com",
+  "nicehash\\.com",
+  "dwarfpool\\.com",
+  "ethermine\\.org",
+  "miningpoolhub\\.com"
+].join("|");
+var MINER_RULES = [
+  { needles: ["stratum+"], pattern: /stratum\+(?:tcp|ssl|tls):\/\//i },
+  { needles: ["coinhive", "coin-hive", "authedmine"], pattern: /coinhive\.(?:anonymous|user|token|min\.js|com)|coin-hive\.com|authedmine\.com/i },
+  { needles: ["cryptoloot", "crypto-loot"], pattern: /cryptoloot\.(?:anonymous|user)|crypto-loot\.(?:com|org)/i },
+  { needles: ["coinimp", "hostingcloud"], pattern: /coinimp\.com|hostingcloud\.(?:racing|science|win|download)/i },
+  { needles: ["deepminer"], pattern: /deepminer\.(?:anonymous|init)/i },
+  { needles: ["cryptonight", "cn_slow_hash"], pattern: /cryptonight(?:_hash|_create|wasmwrapper|\.wasm|-asmjs|_light)|cn_slow_hash/i },
+  { needles: ["randomx_"], pattern: /randomx_(?:calculate_hash|create_vm|init_cache|alloc_cache)/i },
+  {
+    needles: ["jsecoin", "webminerpool", "webmine.", "minero.cc", "coinhave", "ppoi.org", "projectpoi", "monerise", "nerohut", "minemytraffic"],
+    pattern: /jsecoin\.com|webminerpool|webmine\.(?:pro|cz)|minero\.cc|coinhave\.com|ppoi\.org|projectpoi\.com|monerise\.com|nerohut\.com|minemytraffic\.com/i
+  },
+  {
+    needles: ["supportxmr", "minexmr", "moneroocean", "xmrpool", "nanopool", "hashvault", "herominers", "c3pool", "monerohash", "minergate", "2miners", "f2pool", "unmineable", "nicehash", "dwarfpool", "ethermine", "miningpoolhub"],
+    pattern: new RegExp(`(?:${POOL_HOSTS}):\\d{2,5}\\b|(?:wss?|stratum\\+[a-z]+):\\/\\/[a-z0-9.-]{0,200}?(?:${POOL_HOSTS})`, "i")
+  }
+];
+function lineAt(text, index) {
+  let line = 1;
+  for (let at = text.indexOf(`
+`);at !== -1 && at < index; at = text.indexOf(`
+`, at + 1))
+    line++;
+  return line;
+}
+function excerptAt(text, index, length) {
+  const from = Math.max(0, index - 40);
+  const to = Math.min(text.length, index + Math.max(length, 1) + 40);
+  const cut = text.slice(from, to).replace(/\s+/g, " ").trim();
+  return `${from > 0 ? "…" : ""}${cut.slice(0, 120)}${to < text.length || cut.length > 120 ? "…" : ""}`;
+}
+function matchRules(rules, text, lower = text.toLowerCase()) {
+  const hits = [];
+  for (const { rule, test } of rules) {
+    if (!test.needles.some((n) => lower.includes(n)))
+      continue;
+    const m = test.pattern.exec(text);
+    if (m)
+      hits.push({ rule, line: lineAt(text, m.index), excerpt: excerptAt(text, m.index, m[0].length) });
+  }
+  return hits;
+}
+var literal = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var ANY_MINER = new RegExp(MINER_RULES.flatMap((r) => r.needles).map(literal).join("|"));
+function textHits(text, lower = text.toLowerCase()) {
+  if (!ANY_MINER.test(lower))
+    return [];
+  return matchRules(MINER_RULES.map((test) => ({ rule: "miner", test })), text, lower).slice(0, 1);
+}
+function refuseFinding(hit, path) {
+  const at = { ...hit.line ? { line: hit.line } : {}, ...hit.excerpt ? { excerpt: hit.excerpt } : {} };
+  if (hit.rule === "miner") {
+    const where = hit.line ? ` (line ${hit.line})` : "";
+    return { rule: hit.rule, path, ...at, message: `${path} runs a coin miner in the browser${where}; Velven does not serve miners. Remove the miner and publish again.` };
+  }
+  const words = KIND_WORDS[hit.kind ?? "windows"];
+  return { rule: hit.rule, path, ...at, message: `${path} is ${words.what}; Velven does not serve ${words.noun}. ${IGNORE_HINT}` };
+}
+function refuseFindings(path, head, text) {
+  const hits = [];
+  const byBytes = bytesHit(head.subarray(0, HEAD_BYTES));
+  if (byBytes)
+    hits.push(byBytes);
+  else {
+    const byName = nameHit(path);
+    if (byName)
+      hits.push(byName);
+  }
+  if (text !== undefined)
+    hits.push(...textHits(text));
+  return hits.map((hit) => refuseFinding(hit, path));
+}
+function refusalSentence(findings) {
+  const [first, ...rest] = findings;
+  const others = [...new Set(rest.map((f) => f.path).filter((p) => p !== first.path))];
+  if (!others.length)
+    return first.message;
+  const shown = others.slice(0, 5).join(", ");
+  const more = others.length > 5 ? ` and ${others.length - 5} more` : "";
+  return `${first.message} Also refused: ${shown}${more}.`;
+}
+
+// ../../src/lib/file-magic.ts
+function isJpeg(bytes) {
+  return bytes.length >= 3 && bytes[0] === 255 && bytes[1] === 216 && bytes[2] === 255;
+}
+function isPng(bytes) {
+  const signature = [137, 80, 78, 71, 13, 10, 26, 10];
+  return bytes.length >= 8 && signature.every((b, i) => bytes[i] === b);
+}
+function isWebp(bytes) {
+  const at = (i, text) => [...text].every((c, j) => bytes[i + j] === c.charCodeAt(0));
+  return bytes.length >= 12 && at(0, "RIFF") && at(8, "WEBP");
+}
+function isThumbnail(bytes) {
+  return isJpeg(bytes) || isPng(bytes) || isWebp(bytes);
+}
+function isMp4(bytes) {
+  return bytes.length >= 8 && bytes[4] === 102 && bytes[5] === 116 && bytes[6] === 121 && bytes[7] === 112;
+}
+function isWebm(bytes) {
+  return bytes.length >= 4 && bytes[0] === 26 && bytes[1] === 69 && bytes[2] === 223 && bytes[3] === 163;
+}
+function isClip(bytes) {
+  return isMp4(bytes) || isWebm(bytes);
+}
+
+// ../../src/lib/media-header.ts
+var u16 = (b, i) => b[i] << 8 | b[i + 1];
+var u32 = (b, i) => (b[i] << 24 | b[i + 1] << 16 | b[i + 2] << 8 | b[i + 3]) >>> 0;
+var u64 = (b, i) => u32(b, i) * 2 ** 32 + u32(b, i + 4);
+var ascii = (b, i, n) => String.fromCharCode(...b.subarray(i, i + n));
+function mp4Seconds(b) {
+  const boxes = (start, end, visit) => {
+    for (let at = start;at + 8 <= end; ) {
+      let size = u32(b, at);
+      const type = ascii(b, at + 4, 4);
+      let body = at + 8;
+      if (size === 1) {
+        if (at + 16 > end)
+          return null;
+        size = u64(b, at + 8);
+        body = at + 16;
+      } else if (size === 0)
+        size = end - at;
+      if (size < body - at || at + size > end)
+        return null;
+      const found = visit(type, body, at + size);
+      if (found !== undefined)
+        return found;
+      at += size;
+    }
+    return null;
+  };
+  return boxes(0, b.length, (type, body, end) => type !== "moov" ? undefined : boxes(body, end, (inner, at, innerEnd) => {
+    if (inner !== "mvhd")
+      return;
+    const version2 = b[at];
+    const scaleAt = version2 === 1 ? at + 20 : at + 12;
+    if (scaleAt + (version2 === 1 ? 12 : 8) > innerEnd)
+      return null;
+    const scale = u32(b, scaleAt);
+    const duration = version2 === 1 ? u64(b, scaleAt + 4) : u32(b, scaleAt + 4);
+    if (!scale || !duration || duration === 4294967295)
+      return null;
+    return duration / scale;
+  }));
+}
+function ebmlId(b, at) {
+  const first = b[at];
+  const length = first >= 128 ? 1 : first >= 64 ? 2 : first >= 32 ? 3 : first >= 16 ? 4 : 0;
+  if (!length || at + length > b.length)
+    return null;
+  let id = 0;
+  for (let i = 0;i < length; i++)
+    id = id * 256 + b[at + i];
+  return { id, next: at + length };
+}
+function ebmlSize(b, at) {
+  const first = b[at];
+  let length = 1;
+  while (length <= 8 && !(first & 128 >> length - 1))
+    length++;
+  if (length > 8 || at + length > b.length)
+    return null;
+  let size = first & 255 >> length;
+  let allOnes = size === 255 >> length;
+  for (let i = 1;i < length; i++) {
+    size = size * 256 + b[at + i];
+    allOnes &&= b[at + i] === 255;
+  }
+  return { size: allOnes ? null : size, next: at + length };
+}
+var SEGMENT = 408125543;
+var INFO = 357149030;
+var TIMECODE_SCALE = 2807729;
+var DURATION = 17545;
+function webmSeconds(b) {
+  const view = new DataView(b.buffer, b.byteOffset, b.byteLength);
+  for (let at = 0;at < b.length; ) {
+    const id = ebmlId(b, at);
+    const size = id && ebmlSize(b, id.next);
+    if (!id || !size)
+      return null;
+    if (id.id === SEGMENT) {
+      at = size.next;
+      continue;
+    }
+    if (id.id === INFO && size.size !== null) {
+      let scale = 1e6;
+      let duration = null;
+      const end = Math.min(size.next + size.size, b.length);
+      for (let i = size.next;i < end; ) {
+        const child = ebmlId(b, i);
+        const childSize = child && ebmlSize(b, child.next);
+        if (!child || !childSize || childSize.size === null)
+          return null;
+        const body = childSize.next;
+        if (body + childSize.size > b.length)
+          return null;
+        if (child.id === TIMECODE_SCALE && childSize.size <= 6) {
+          scale = 0;
+          for (let j = 0;j < childSize.size; j++)
+            scale = scale * 256 + b[body + j];
+        } else if (child.id === DURATION && (childSize.size === 4 || childSize.size === 8)) {
+          duration = childSize.size === 4 ? view.getFloat32(body) : view.getFloat64(body);
+        }
+        i = body + childSize.size;
+      }
+      const seconds = duration !== null ? duration * scale / 1e9 : null;
+      return seconds && Number.isFinite(seconds) && seconds > 0 ? seconds : null;
+    }
+    if (size.size === null)
+      return null;
+    at = size.next + size.size;
+  }
+  return null;
+}
+function clipHeaderSeconds(bytes) {
+  try {
+    if (bytes.length >= 4 && bytes[0] === 26 && bytes[1] === 69 && bytes[2] === 223 && bytes[3] === 163)
+      return webmSeconds(bytes);
+    return mp4Seconds(bytes);
+  } catch {
+    return null;
+  }
+}
+function jpegSize(b) {
+  for (let at = 2;at + 9 <= b.length; ) {
+    if (b[at] !== 255)
+      return null;
+    const marker = b[at + 1];
+    if (marker === 255) {
+      at += 1;
+      continue;
+    }
+    if (marker === 1 || marker >= 208 && marker <= 215) {
+      at += 2;
+      continue;
+    }
+    if (marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204) {
+      return { height: u16(b, at + 5), width: u16(b, at + 7) };
+    }
+    if (marker === 218 || marker === 217)
+      return null;
+    at += 2 + u16(b, at + 2);
+  }
+  return null;
+}
+function webpSize(b) {
+  if (b.length < 30)
+    return null;
+  const chunk = ascii(b, 12, 4);
+  const at = 20;
+  if (chunk === "VP8 ") {
+    if (b[at + 3] !== 157 || b[at + 4] !== 1 || b[at + 5] !== 42)
+      return null;
+    return { width: (b[at + 6] | b[at + 7] << 8) & 16383, height: (b[at + 8] | b[at + 9] << 8) & 16383 };
+  }
+  if (chunk === "VP8L") {
+    if (b[at] !== 47)
+      return null;
+    const bits = (b[at + 1] | b[at + 2] << 8 | b[at + 3] << 16 | b[at + 4] << 24) >>> 0;
+    return { width: (bits & 16383) + 1, height: (bits >>> 14 & 16383) + 1 };
+  }
+  if (chunk === "VP8X") {
+    return { width: (b[at + 4] | b[at + 5] << 8 | b[at + 6] << 16) + 1, height: (b[at + 7] | b[at + 8] << 8 | b[at + 9] << 16) + 1 };
+  }
+  return null;
+}
+function pictureSize(bytes) {
+  try {
+    const b = bytes;
+    if (b.length >= 24 && b[0] === 137 && ascii(b, 1, 3) === "PNG" && ascii(b, 12, 4) === "IHDR")
+      return { width: u32(b, 16), height: u32(b, 20) };
+    if (b.length >= 3 && b[0] === 255 && b[1] === 216 && b[2] === 255)
+      return jpegSize(b);
+    if (b.length >= 12 && ascii(b, 0, 4) === "RIFF" && ascii(b, 8, 4) === "WEBP")
+      return webpSize(b);
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+// src/media.ts
+var MEDIA_KINDS = ["thumbnail", "clip"];
+var MEDIA_RULES = {
+  thumbnail: { maxBytes: 2 * 1024 * 1024, extensions: ["jpg", "jpeg", "png", "webp"], what: "a JPEG, PNG or WebP picture", bytes: isThumbnail },
+  clip: { maxBytes: 3 * 1024 * 1024, extensions: ["mp4", "webm"], what: "an MP4 or WebM video", bytes: isClip }
+};
+var CLIP_MIN_SECONDS = 5;
+var CLIP_MAX_SECONDS = 10;
+var CLIP_SLACK_SECONDS = 0.25;
+function clipLengthProblem(seconds) {
+  if (seconds < CLIP_MIN_SECONDS - CLIP_SLACK_SECONDS)
+    return "short";
+  if (seconds > CLIP_MAX_SECONDS + CLIP_SLACK_SECONDS)
+    return "long";
+  return null;
+}
+var MAX_PICTURE_SIDE = 4096;
+function mediaPath(raw) {
+  return raw.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
+}
+var megabytes = (bytes) => `${String(Math.ceil(bytes / (1024 * 1024) * 10) / 10)} MB`;
+function mediaProblem(kind, path, size, bytes, missing = "is not among the files published") {
+  const rule = MEDIA_RULES[kind];
+  const extension = /\.([^./]+)$/.exec(path)?.[1]?.toLowerCase() ?? "";
+  if (!rule.extensions.includes(extension))
+    return `"${kind}" must be ${rule.what} (${rule.extensions.map((e) => `.${e}`).join(", ")}), and ${path} is not.`;
+  if (size === undefined)
+    return `"${kind}" names ${path}, which ${missing}.`;
+  if (size > rule.maxBytes) {
+    return `"${kind}" must be ${megabytes(rule.maxBytes)} at most, and ${path} is ${megabytes(size)}.${kind === "clip" ? ` A 480p clip of ${CLIP_MIN_SECONDS} to ${CLIP_MAX_SECONDS} seconds fits.` : ""}`;
+  }
+  if (!bytes)
+    return null;
+  if (!rule.bytes(bytes))
+    return `${path} is not ${rule.what} by its contents, so it cannot be the "${kind}".`;
+  if (kind === "clip") {
+    const seconds = clipHeaderSeconds(bytes);
+    if (seconds !== null && clipLengthProblem(seconds)) {
+      return `${path} is ${seconds.toFixed(1)} seconds long. Keep your clip between ${CLIP_MIN_SECONDS} and ${CLIP_MAX_SECONDS} seconds.`;
+    }
+  } else {
+    const picture = pictureSize(bytes);
+    if (picture && (picture.width > MAX_PICTURE_SIDE || picture.height > MAX_PICTURE_SIDE)) {
+      return `${path} is ${picture.width} by ${picture.height} pixels. Keep your thumbnail to ${MAX_PICTURE_SIDE} pixels or less on each side.`;
+    }
+  }
+  return null;
+}
+
+// src/files.ts
 var ACCOUNT_LIMITS = { maxBytes: 100 * 1024 * 1024, maxFiles: 2000 };
 var GUEST_LIMITS = { maxBytes: 50 * 1024 * 1024, maxFiles: 1000 };
 async function walk(root, skipped = () => {}) {
@@ -825,22 +1269,61 @@ function checkLimits(files, { maxBytes, maxFiles } = ACCOUNT_LIMITS) {
     throw new CliError(`The folder is ${formatSize(total)}; a version holds at most ${formatSize(maxBytes)}. The largest files: ${largest}.`, EXIT.refused, "too_large");
   }
 }
+async function readHead(abs) {
+  const handle = await open(abs, "r");
+  try {
+    const head = new Uint8Array(HEAD_BYTES);
+    const { bytesRead } = await handle.read(head, 0, HEAD_BYTES, 0);
+    return head.subarray(0, bytesRead);
+  } finally {
+    await handle.close();
+  }
+}
+async function refusePrograms(files) {
+  const found = new Map;
+  await eachLimit(files, 8, async (file) => {
+    let head;
+    let text;
+    if (scansContent(file.path) && !isCompressed(file.path)) {
+      const bytes = await readFile4(file.abs);
+      head = bytes.subarray(0, HEAD_BYTES);
+      text = bytes.toString(extensionOf(file.path) === "wasm" ? "latin1" : "utf8");
+    } else
+      head = await readHead(file.abs);
+    const findings2 = refuseFindings(file.path, head, text);
+    if (findings2.length)
+      found.set(file.path, findings2);
+  });
+  const findings = files.flatMap((f) => found.get(f.path) ?? []);
+  if (findings.length)
+    throw new CliError(refusalSentence(findings), EXIT.refused, "refused_file");
+}
+async function checkMedia(config, files) {
+  const out = {};
+  const problems = [];
+  for (const kind of MEDIA_KINDS) {
+    const raw = config[kind];
+    if (typeof raw !== "string")
+      continue;
+    const path = mediaPath(raw);
+    const file = files.find((f) => f.path === path);
+    const bytes = !file ? undefined : file.size <= MEDIA_RULES[kind].maxBytes ? new Uint8Array(await readFile4(file.abs)) : await readHead(file.abs);
+    const problem = mediaProblem(kind, path, file?.size, bytes, "is not among the files this publish sends: check the path, and that .velvenignore does not leave it out");
+    if (problem)
+      problems.push(problem);
+    else
+      out[kind] = path;
+  }
+  if (problems.length)
+    throw new CliError(`velven.json: ${problems.join(" ")}`, EXIT.usage, "invalid_media");
+  return out;
+}
 function hashFile(abs) {
   return new Promise((resolve2, reject) => {
     const hash = createHash("sha256");
     createReadStream(abs).on("data", (chunk) => hash.update(chunk)).on("error", reject).on("end", () => resolve2(hash.digest("hex")));
   });
 }
-async function eachLimit(items, limit, task) {
-  let next = 0;
-  async function worker() {
-    while (next < items.length) {
-      const item = items[next++];
-      await task(item);
-    }
-  }
-  await Promise.all(Array.from({ length: Math.min(limit, items.length) }, worker));
-}
 async function hashAll(files) {
   await eachLimit(files, 8, async (file) => {
     file.sha256 = await hashFile(file.abs);
@@ -923,7 +1406,7 @@ function claimedMeanwhile(base, slug, versionId, when) {
       if (when === "finish")
         throw new CliError("The page was claimed before this version was finished. Run velven login and publish again.", EXIT.auth, error.code);
       const files = `${base}/s/${seg(slug)}/edit/files?version=${encodeURIComponent(versionId)}`;
-      throw new CliError(`The page was claimed. Follow the check on its Files tab: ${files}`, EXIT.auth, error.code);
+      throw new CliError(`The page was claimed. Follow it on its Files tab: ${files}`, EXIT.auth, error.code);
     }
     throw error;
   };
@@ -973,6 +1456,8 @@ async function publish(ctx, options) {
   if (!files.some((f) => f.path === entry)) {
     throw new CliError(`The folder has no ${entry}. Add one, or name the page to open with "entry" in velven.json.`, EXIT.usage, "no_entry");
   }
+  await refusePrograms(files);
+  const media = await checkMedia(config, files);
   const terms = `${base.replace(/^https?:\/\//, "")}/terms`;
   if (guest)
     say(`By publishing you agree to Velven's Terms: ${terms}`);
@@ -990,6 +1475,7 @@ async function publish(ctx, options) {
   for (const key of PASSED)
     if (config[key] !== undefined)
       body[key] = config[key];
+  Object.assign(body, media);
   const created = await call(api, "POST", "/api/v1/hosting/versions", body).catch((error) => {
     throw spentClaim(error) ?? error;
   });
@@ -1038,7 +1524,10 @@ async function publish(ctx, options) {
     const claimUrl = claim ? claimLink(base, claim) : undefined;
     Object.assign(result, { pageUrl, claimToken: claim, claimUrl, expiresAt: created.expiresAt, terms });
     say(`Published version ${number} of an unlisted page: ${pageUrl}`);
-    say("It goes live once it passes Velven's check, and stays unlisted until you claim it.");
+    if (finished.status === "live")
+      say("It is live, and stays unlisted until you claim it.");
+    else if (finished.status !== "refused")
+      say("It is waiting on Velven to publish it, and stays unlisted until you claim it.");
     if (claim) {
       say(notSaved ? `Claim token: ${claim} (velven.json could not be written: put it there as "claim", so publishing again from this folder updates the same page)` : `Claim token: ${claim} (saved in velven.json as "claim"; publishing again from this folder updates the same page)`);
       say(`Claim it: ${claimUrl}, or run velven login and publish again.`);
@@ -1046,27 +1535,28 @@ async function publish(ctx, options) {
     const expires = created.expiresAt ? ` (${created.expiresAt.slice(0, 10)})` : "";
     say(`Unclaimed pages are deleted 7 days after the first publish${expires}.`);
   }
-  let status = { status: finished.status, previewUrl: finished.previewUrl };
+  let status = { status: finished.status, previewUrl: finished.previewUrl, pageUrl: finished.pageUrl, reason: finished.reason, code: finished.code };
   if (!DONE.includes(finished.status)) {
     if (guest)
-      say(`Follow the check: ${finished.watchUrl}`);
+      say(`Follow it: ${finished.watchUrl}`);
     else if (options.prod) {
-      say(`Publishing version ${number} of ${slug} to production. Velven checks it before it goes live.`);
-      say(`Follow the check: ${finished.watchUrl}`);
+      say(`Version ${number} of ${slug} is waiting on Velven to publish it, usually for less than a minute.`);
+      say(`Follow it: ${finished.watchUrl}`);
     } else
       say(`Preparing a preview of ${slug} (version ${number}). Follow it: ${finished.watchUrl}`);
     if (!options.wait) {
-      say(`Run with --wait to wait here for ${options.prod || guest ? "the verdict" : "the preview link"}.`);
+      say(`Run with --wait to wait here for ${options.prod || guest ? "it to go live" : "the preview link"}.`);
       if (options.json)
         ctx.out(JSON.stringify(result));
       return EXIT.ok;
     }
     say("Waiting...");
-    status = await waitForVerdict(ctx, api, versionPath).catch(claimedMeanwhile(base, slug, created.version.id, "check"));
+    status = await waitForVerdict(ctx, api, versionPath).catch(claimedMeanwhile(base, slug, created.version.id, "wait"));
   }
   Object.assign(result, {
     status: status.status,
     reason: status.reason,
+    ...status.code ? { code: status.code } : {},
     shownOnTake: status.shownOnTake,
     pageUrl: status.pageUrl ?? result.pageUrl,
     previewUrl: status.previewUrl ?? finished.previewUrl
@@ -1095,9 +1585,9 @@ async function waitForVerdict(ctx, api, versionPath) {
     if (DONE.includes(status.status))
       return status;
     if (status.stopped)
-      throw new CliError("The check ended before it finished, because the space was hidden, held or moved, or its checks are over the hourly limit. Publish again to check it.", EXIT.failed, "check_stopped");
+      throw new CliError("Publishing stopped before the version went live, because the space was hidden, held or moved, or it is over the hourly limit. Publish again.", EXIT.failed, "check_stopped");
   }
-  throw new CliError("The check is still running after 20 minutes. Follow it on the watch link.", EXIT.failed, "wait_timeout");
+  throw new CliError("The version is still waiting on Velven after 20 minutes. Follow it on the watch link.", EXIT.failed, "wait_timeout");
 }
 function sentence(text) {
   const clean = text.trim().replace(/^the (recording|take|video) (showed|shows)[:,]?\s*/i, "").replace(/[\s.]+$/, "");
@@ -1115,16 +1605,19 @@ function report(say, slug, number, status, watchUrl) {
       say(`${label} is live: ${status.pageUrl ?? watchUrl}`);
       return EXIT.ok;
     case "replaced":
-      say(`${label} was replaced before its check finished: a newer version was published, or the space moved to another address.`);
+      say(`${label} was replaced before it went live: a newer version was published, or the space moved to another address.`);
       return EXIT.ok;
     case "refused":
-      say(`${label} was refused. ${sentence(status.reason ?? "It did not pass the safety check")}`);
+      say(`${label} was refused. ${sentence(status.reason ?? "Velven does not allow what it holds")}`);
       if (status.shownOnTake)
         say(`The take showed: ${sentence(status.shownOnTake)}`);
-      say(`If you think that is wrong, open ${watchUrl} and press Ask for review.`);
+      if (status.code === "scan_refused")
+        say("Velven never serves a program or a miner, so a review cannot change this: remove the file and publish again.");
+      else
+        say(`If you think that is wrong, open ${watchUrl} and press Ask for review.`);
       return EXIT.notLive;
     default:
-      say(`Velven could not judge version ${number} of ${slug}. The take showed: ${sentence(status.shownOnTake ?? status.reason ?? "Nothing it could judge")}`);
+      say(`Velven could not publish version ${number} of ${slug}. The take showed: ${sentence(status.shownOnTake ?? status.reason ?? "Nothing it could judge")}`);
       say('If it needs a click or a key to start, add a start hint to velven.json, like "start": { "click": "Play" } or "start": { "key": "Space" }, and publish again.');
       say(`Or open ${watchUrl} and press Ask for review.`);
       return EXIT.notLive;
@@ -1242,9 +1735,9 @@ Usage:
   velven logout               Forget this computer's sign-in
   velven whoami [--json]      Show who you are signed in as
   velven publish [dir]        Upload a folder as a private preview (the link is printed)
-      --prod                  Go live on its Velven page once Velven's safety check passes
+      --prod                  Publish it live on its Velven page
                               (not signed in: an unlisted page with a claim token, no --prod)
-      --wait                  Wait for the preview link, or with --prod for the check's verdict
+      --wait                  Wait for the preview link, or with --prod until it is live
       --title <text>          Override velven.json for this run
       --type <type>           game, world, tool or wonder
       --devices <list>        desktop, mobile, vr (comma separated)
@@ -1269,8 +1762,8 @@ Environment:
 
 Exit codes:
   0 done   1 failed (network, server, cancelled)   2 bad command or velven.json
-  3 needs sign-in (or the token was refused)   4 refused by Velven (not the owner, too large, not found)
-  5 rate limited, try later   6 with --wait: refused or not judged by the safety check`;
+  3 needs sign-in (or the token was refused)   4 refused by Velven (not the owner, too large, a program in the folder, not found)
+  5 rate limited, try later   6 not published: refused, or with --wait not judged`;
 var COMMANDS = {
   login: { flags: {}, run: (ctx) => login(ctx) },
   logout: { flags: {}, run: (ctx) => logout(ctx) },

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@velven/cli",
-  "version": "0.1.0",
-  "description": "Publish a folder to Velven, the community marketplace for spaces built with AI: a private preview first, then hosted, checked and live on its own page.",
+  "version": "0.2.1",
+  "description": "Publish a folder to Velven, the community marketplace for spaces built with AI: a private preview first, then hosted and live on its own page in seconds.",
   "license": "MIT",
   "homepage": "https://velven.ai/docs",
   "type": "module",
@@ -14,7 +14,8 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "CHANGELOG.md"
   ],
   "engines": {
     "node": ">=20"