@velven/cli 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 0.2.1
+
+- A `clip` in `velven.json` must be 5 to 10 seconds long. The CLI reads the length from the file's header and stops with
+  exit 2 (`invalid_media`) when it's outside that range. A file that doesn't say its length still goes through.
+- A `thumbnail` must be 4096 pixels or less on each side. The CLI reads the size from the picture's header and stops
+  with exit 2 (`invalid_media`) when it's larger.
+
 ## 0.2.0
 
 - `velven publish --prod` is usually live when the command ends: Velven reads every file of the version, and a clean

package/README.md

@@ -38,16 +38,29 @@ Optional: `description`, `engine`, `ai_tools`, `models`, `how_made`, `source_url
 | `spa` | `true` serves the entry page for any path without a file (client-side routing) |
 | `sdk` | `false` stops Velven adding the SDK's script tag (set it when you bundle `@velven/sdk` yourself) |
 | `start` | How to get past a start screen, so Velven can look at the space and record its clip: `{ "click": "Play" }`, `{ "click": [x, y] }` or `{ "key": "Space" }` |
-| `thumbnail` | A picture in the folder for the space's tile: JPEG, PNG or WebP, up to 2 MB |
-| `clip` | A video in the folder the tile plays on hover: MP4 or WebM, up to 3 MB (five seconds at 480p); without a `thumbnail` its first frame is the picture |
+| `thumbnail` | A picture in the folder for your space's tile. JPEG, PNG or WebP, up to 2 MB and 4096 pixels on each side |
+| `clip` | A video in the folder that your tile plays on hover. MP4 or WebM, up to 3 MB and 5 to 10 seconds long. Without a `thumbnail`, its first frame is the picture |
 | `boards`, `achievements`, `stats`, `toasts` | Leaderboards, achievements and stats, declared as in the SDK docs |
 | `space` | Written by the first publish; later publishes update that space |
 | `claim` | Written by a publish without an account; it updates the unlisted page until you claim it |
 
-`thumbnail` and `clip` must be files the publish sends (not left out by `.velvenignore`), of their kind by name and by
-their first bytes, and within their size: `velven publish` checks them before uploading anything and stops with exit 2
-(`invalid_media`) naming what is wrong. Velven then records nothing for the tile; a later version that names neither, or
-the same files, keeps what the space shows, a clip recorded again or uploaded on the Clip tab included.
+`velven publish` checks `thumbnail` and `clip` before it uploads anything. Each one must be:
+
+- a file the publish sends, so `.velvenignore` can't leave it out
+- the kind of file its name says, inside as well as in the name
+- within its size: 2 MB for a thumbnail, 3 MB for a clip
+- 4096 pixels or less on each side, for a thumbnail
+- 5 to 10 seconds long, for a clip
+
+If one isn't, the CLI stops with exit 2 (`invalid_media`) and tells you what to fix. Some files don't say how long
+they are. The CLI lets those through, and Velven measures the clip once your space is live. It uses the first 10
+seconds of a longer clip. It drops a clip under 5 seconds and records its own, unless you named a `thumbnail`.
+
+Name either one and Velven records nothing for your tile. A later version that names neither, or names the same files,
+keeps what your space shows. That includes a clip you recorded again or uploaded on the Clip tab.
+
+Your thumbnail and clip follow the same content policy as your space. They must show your space itself, not something
+unrelated or misleading.
 
 A `.velvenignore` file leaves files out: one pattern a line, `*`, `**` and `?`, `folder/` for folders, `#` comments.
 Dotfiles, `node_modules` and every `velven.json` are always left out, in any case, as is a name that ends in a dot or a space or holds `:` or `~` (the CLI names each such file);
@@ -123,7 +136,7 @@ Set `VELVEN_TOKEN` to a token from `velven login` (in `~/.config/velven/auth.jso
 | --- | --- |
 | 0 | Done |
 | 1 | Failed: the network, a server error, a failed upload, or cancelled |
-| 2 | A mistake in the command or in `velven.json`, such as a missing field, or a `thumbnail` or `clip` that is not right (`invalid_media`) |
+| 2 | A mistake in the command or in `velven.json`, such as a missing field, or a `thumbnail` or `clip` that breaks one of the rules above (`invalid_media`) |
 | 3 | Not signed in (or the token was refused) for something that needs an account, such as `--prod` |
 | 4 | Refused by Velven: not your space, too large, too many files, a program, installer or coin miner in the folder (`refused_file`, before anything is uploaded), not found |
 | 5 | Rate limited: try again later |

package/dist/velven.js

@@ -23,7 +23,7 @@ class CliError extends Error {
   }
 }
 // package.json
-var version = "0.2.0";
+var version = "0.2.1";
 
 // src/version.ts
 var VERSION = version;
@@ -973,17 +973,206 @@ function isClip(bytes) {
   return isMp4(bytes) || isWebm(bytes);
 }
 
+// ../../src/lib/media-header.ts
+var u16 = (b, i) => b[i] << 8 | b[i + 1];
+var u32 = (b, i) => (b[i] << 24 | b[i + 1] << 16 | b[i + 2] << 8 | b[i + 3]) >>> 0;
+var u64 = (b, i) => u32(b, i) * 2 ** 32 + u32(b, i + 4);
+var ascii = (b, i, n) => String.fromCharCode(...b.subarray(i, i + n));
+function mp4Seconds(b) {
+  const boxes = (start, end, visit) => {
+    for (let at = start;at + 8 <= end; ) {
+      let size = u32(b, at);
+      const type = ascii(b, at + 4, 4);
+      let body = at + 8;
+      if (size === 1) {
+        if (at + 16 > end)
+          return null;
+        size = u64(b, at + 8);
+        body = at + 16;
+      } else if (size === 0)
+        size = end - at;
+      if (size < body - at || at + size > end)
+        return null;
+      const found = visit(type, body, at + size);
+      if (found !== undefined)
+        return found;
+      at += size;
+    }
+    return null;
+  };
+  return boxes(0, b.length, (type, body, end) => type !== "moov" ? undefined : boxes(body, end, (inner, at, innerEnd) => {
+    if (inner !== "mvhd")
+      return;
+    const version2 = b[at];
+    const scaleAt = version2 === 1 ? at + 20 : at + 12;
+    if (scaleAt + (version2 === 1 ? 12 : 8) > innerEnd)
+      return null;
+    const scale = u32(b, scaleAt);
+    const duration = version2 === 1 ? u64(b, scaleAt + 4) : u32(b, scaleAt + 4);
+    if (!scale || !duration || duration === 4294967295)
+      return null;
+    return duration / scale;
+  }));
+}
+function ebmlId(b, at) {
+  const first = b[at];
+  const length = first >= 128 ? 1 : first >= 64 ? 2 : first >= 32 ? 3 : first >= 16 ? 4 : 0;
+  if (!length || at + length > b.length)
+    return null;
+  let id = 0;
+  for (let i = 0;i < length; i++)
+    id = id * 256 + b[at + i];
+  return { id, next: at + length };
+}
+function ebmlSize(b, at) {
+  const first = b[at];
+  let length = 1;
+  while (length <= 8 && !(first & 128 >> length - 1))
+    length++;
+  if (length > 8 || at + length > b.length)
+    return null;
+  let size = first & 255 >> length;
+  let allOnes = size === 255 >> length;
+  for (let i = 1;i < length; i++) {
+    size = size * 256 + b[at + i];
+    allOnes &&= b[at + i] === 255;
+  }
+  return { size: allOnes ? null : size, next: at + length };
+}
+var SEGMENT = 408125543;
+var INFO = 357149030;
+var TIMECODE_SCALE = 2807729;
+var DURATION = 17545;
+function webmSeconds(b) {
+  const view = new DataView(b.buffer, b.byteOffset, b.byteLength);
+  for (let at = 0;at < b.length; ) {
+    const id = ebmlId(b, at);
+    const size = id && ebmlSize(b, id.next);
+    if (!id || !size)
+      return null;
+    if (id.id === SEGMENT) {
+      at = size.next;
+      continue;
+    }
+    if (id.id === INFO && size.size !== null) {
+      let scale = 1e6;
+      let duration = null;
+      const end = Math.min(size.next + size.size, b.length);
+      for (let i = size.next;i < end; ) {
+        const child = ebmlId(b, i);
+        const childSize = child && ebmlSize(b, child.next);
+        if (!child || !childSize || childSize.size === null)
+          return null;
+        const body = childSize.next;
+        if (body + childSize.size > b.length)
+          return null;
+        if (child.id === TIMECODE_SCALE && childSize.size <= 6) {
+          scale = 0;
+          for (let j = 0;j < childSize.size; j++)
+            scale = scale * 256 + b[body + j];
+        } else if (child.id === DURATION && (childSize.size === 4 || childSize.size === 8)) {
+          duration = childSize.size === 4 ? view.getFloat32(body) : view.getFloat64(body);
+        }
+        i = body + childSize.size;
+      }
+      const seconds = duration !== null ? duration * scale / 1e9 : null;
+      return seconds && Number.isFinite(seconds) && seconds > 0 ? seconds : null;
+    }
+    if (size.size === null)
+      return null;
+    at = size.next + size.size;
+  }
+  return null;
+}
+function clipHeaderSeconds(bytes) {
+  try {
+    if (bytes.length >= 4 && bytes[0] === 26 && bytes[1] === 69 && bytes[2] === 223 && bytes[3] === 163)
+      return webmSeconds(bytes);
+    return mp4Seconds(bytes);
+  } catch {
+    return null;
+  }
+}
+function jpegSize(b) {
+  for (let at = 2;at + 9 <= b.length; ) {
+    if (b[at] !== 255)
+      return null;
+    const marker = b[at + 1];
+    if (marker === 255) {
+      at += 1;
+      continue;
+    }
+    if (marker === 1 || marker >= 208 && marker <= 215) {
+      at += 2;
+      continue;
+    }
+    if (marker >= 192 && marker <= 207 && marker !== 196 && marker !== 200 && marker !== 204) {
+      return { height: u16(b, at + 5), width: u16(b, at + 7) };
+    }
+    if (marker === 218 || marker === 217)
+      return null;
+    at += 2 + u16(b, at + 2);
+  }
+  return null;
+}
+function webpSize(b) {
+  if (b.length < 30)
+    return null;
+  const chunk = ascii(b, 12, 4);
+  const at = 20;
+  if (chunk === "VP8 ") {
+    if (b[at + 3] !== 157 || b[at + 4] !== 1 || b[at + 5] !== 42)
+      return null;
+    return { width: (b[at + 6] | b[at + 7] << 8) & 16383, height: (b[at + 8] | b[at + 9] << 8) & 16383 };
+  }
+  if (chunk === "VP8L") {
+    if (b[at] !== 47)
+      return null;
+    const bits = (b[at + 1] | b[at + 2] << 8 | b[at + 3] << 16 | b[at + 4] << 24) >>> 0;
+    return { width: (bits & 16383) + 1, height: (bits >>> 14 & 16383) + 1 };
+  }
+  if (chunk === "VP8X") {
+    return { width: (b[at + 4] | b[at + 5] << 8 | b[at + 6] << 16) + 1, height: (b[at + 7] | b[at + 8] << 8 | b[at + 9] << 16) + 1 };
+  }
+  return null;
+}
+function pictureSize(bytes) {
+  try {
+    const b = bytes;
+    if (b.length >= 24 && b[0] === 137 && ascii(b, 1, 3) === "PNG" && ascii(b, 12, 4) === "IHDR")
+      return { width: u32(b, 16), height: u32(b, 20) };
+    if (b.length >= 3 && b[0] === 255 && b[1] === 216 && b[2] === 255)
+      return jpegSize(b);
+    if (b.length >= 12 && ascii(b, 0, 4) === "RIFF" && ascii(b, 8, 4) === "WEBP")
+      return webpSize(b);
+    return null;
+  } catch {
+    return null;
+  }
+}
+
 // src/media.ts
 var MEDIA_KINDS = ["thumbnail", "clip"];
 var MEDIA_RULES = {
   thumbnail: { maxBytes: 2 * 1024 * 1024, extensions: ["jpg", "jpeg", "png", "webp"], what: "a JPEG, PNG or WebP picture", bytes: isThumbnail },
   clip: { maxBytes: 3 * 1024 * 1024, extensions: ["mp4", "webm"], what: "an MP4 or WebM video", bytes: isClip }
 };
+var CLIP_MIN_SECONDS = 5;
+var CLIP_MAX_SECONDS = 10;
+var CLIP_SLACK_SECONDS = 0.25;
+function clipLengthProblem(seconds) {
+  if (seconds < CLIP_MIN_SECONDS - CLIP_SLACK_SECONDS)
+    return "short";
+  if (seconds > CLIP_MAX_SECONDS + CLIP_SLACK_SECONDS)
+    return "long";
+  return null;
+}
+var MAX_PICTURE_SIDE = 4096;
 function mediaPath(raw) {
   return raw.replace(/\\/g, "/").replace(/^(\.\/)+/, "");
 }
 var megabytes = (bytes) => `${String(Math.ceil(bytes / (1024 * 1024) * 10) / 10)} MB`;
-function mediaProblem(kind, path, size, head, missing = "is not among the files published") {
+function mediaProblem(kind, path, size, bytes, missing = "is not among the files published") {
   const rule = MEDIA_RULES[kind];
   const extension = /\.([^./]+)$/.exec(path)?.[1]?.toLowerCase() ?? "";
   if (!rule.extensions.includes(extension))
@@ -991,10 +1180,23 @@ function mediaProblem(kind, path, size, head, missing = "is not among the files
   if (size === undefined)
     return `"${kind}" names ${path}, which ${missing}.`;
   if (size > rule.maxBytes) {
-    return `"${kind}" must be ${megabytes(rule.maxBytes)} at most, and ${path} is ${megabytes(size)}.${kind === "clip" ? " Five seconds at 480p fits." : ""}`;
+    return `"${kind}" must be ${megabytes(rule.maxBytes)} at most, and ${path} is ${megabytes(size)}.${kind === "clip" ? ` A 480p clip of ${CLIP_MIN_SECONDS} to ${CLIP_MAX_SECONDS} seconds fits.` : ""}`;
   }
-  if (head && !rule.bytes(head))
+  if (!bytes)
+    return null;
+  if (!rule.bytes(bytes))
     return `${path} is not ${rule.what} by its contents, so it cannot be the "${kind}".`;
+  if (kind === "clip") {
+    const seconds = clipHeaderSeconds(bytes);
+    if (seconds !== null && clipLengthProblem(seconds)) {
+      return `${path} is ${seconds.toFixed(1)} seconds long. Keep your clip between ${CLIP_MIN_SECONDS} and ${CLIP_MAX_SECONDS} seconds.`;
+    }
+  } else {
+    const picture = pictureSize(bytes);
+    if (picture && (picture.width > MAX_PICTURE_SIDE || picture.height > MAX_PICTURE_SIDE)) {
+      return `${path} is ${picture.width} by ${picture.height} pixels. Keep your thumbnail to ${MAX_PICTURE_SIDE} pixels or less on each side.`;
+    }
+  }
   return null;
 }
 
@@ -1105,8 +1307,8 @@ async function checkMedia(config, files) {
       continue;
     const path = mediaPath(raw);
     const file = files.find((f) => f.path === path);
-    const head = file ? await readHead(file.abs) : undefined;
-    const problem = mediaProblem(kind, path, file?.size, head, "is not among the files this publish sends: check the path, and that .velvenignore does not leave it out");
+    const bytes = !file ? undefined : file.size <= MEDIA_RULES[kind].maxBytes ? new Uint8Array(await readFile4(file.abs)) : await readHead(file.abs);
+    const problem = mediaProblem(kind, path, file?.size, bytes, "is not among the files this publish sends: check the path, and that .velvenignore does not leave it out");
     if (problem)
       problems.push(problem);
     else

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@velven/cli",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Publish a folder to Velven, the community marketplace for spaces built with AI: a private preview first, then hosted and live on its own page in seconds.",
   "license": "MIT",
   "homepage": "https://velven.ai/docs",