deck-plugin-sdk 1.11.0 → 1.12.0

package/publish.mjs

@@ -1,116 +1,116 @@
-// `deck-plugin publish`: put this version of a plugin in Deck's registry.
-//
-//   deck-plugin publish --dry-run    check everything, publish nothing
-//   deck-plugin publish              tag, release on GitHub, and open the submission PR
-//
-// Runs on the author's machine the checks the registry runs on its own (validate.mjs, shared),
-// so a submission that would fail fails here, before anything is public:
-//   the manifest, README, LICENSE and package-lock.json; a clean, pushed git tree; a build from
-//   the lockfile exactly as the registry will repeat it (npm ci, then this SDK's build); the
-//   release's files and sizes; and that its permissions cover what the bundle calls.
-// Then it tags v<version>, makes the GitHub release with the built files, and opens a pull
-// request to the registry adding submissions/<id>.json, through the author's fork. The registry's
-// checks run on that PR and merge it when they pass.
-//
-// Needs git and the GitHub CLI (gh), signed in.
-import { execFileSync } from "node:child_process";
-import { existsSync, readFileSync, statSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-import { checkAssets, checkId, checkLockfile, checkManifest, checkPermissions } from "./validate.mjs";
-
-const here = dirname(fileURLToPath(import.meta.url));
-const REGISTRY = "deck-desktop/deck-registry";
-
-/** npm's own entry point, run with node: on Windows npm is npm.cmd, which Node will not execFile. */
-function npmCli() {
-  for (const p of [join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js"),
-    join(dirname(process.execPath), "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")]) if (existsSync(p)) return p;
-  return null;
-}
-
-export async function publish(dir, manifest, { dryRun, buildPlugin }) {
-  const run = (cmd, args, opts = {}) => execFileSync(cmd, args, { cwd: dir, stdio: ["ignore", "pipe", "pipe"], ...opts }).toString().trim();
-  const ok = (cmd, args) => { try { run(cmd, args); return true; } catch { return false; } };
-  const errors = [], notes = [];
-  const say = (s) => console.log(s);
-
-  // ---- what is in the folder ----
-  errors.push(...checkId(manifest.id ?? ""), ...checkManifest(manifest));
-  if (!existsSync(join(dir, "README.md"))) errors.push("no README.md: it is the plugin's page in Deck and on the website");
-  if (!["LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING"].some((f) => existsSync(join(dir, f)))) errors.push("no LICENSE: say how others may use it (the scaffold's is MIT)");
-  if (existsSync(join(dir, ".npmrc"))) errors.push("there is an .npmrc: the registry installs from registry.npmjs.org only, so remove it");
-  const lockAt = join(dir, "package-lock.json");
-  if (!existsSync(lockAt)) errors.push("no package-lock.json: commit it, so the registry can repeat the build exactly");
-  else errors.push(...checkLockfile(JSON.parse(readFileSync(lockAt, "utf8"))));
-  const custom = existsSync(join(dir, "deck-plugin.config.mjs"));
-  if (custom) notes.push("It has a deck-plugin.config.mjs, which the build runs, so the registry will not rebuild it to check it: it is listed as build not verified.");
-
-  // ---- git and GitHub ----
-  if (!ok("git", ["rev-parse", "--is-inside-work-tree"])) errors.push("this is not a git repository");
-  let repo = "";
-  try {
-    const url = run("git", ["remote", "get-url", "origin"]);
-    repo = /github\.com[:/]([\w.-]+\/[\w.-]+?)(?:\.git)?$/.exec(url)?.[1] ?? "";
-    if (!repo) errors.push(`origin is ${url}, not a GitHub repository`);
-  } catch { errors.push("there is no origin remote: push it to a public GitHub repository first"); }
-  if (ok("git", ["rev-parse", "HEAD"]) && run("git", ["status", "--porcelain"])) errors.push("there are uncommitted changes: commit them, so the release is what the repository holds");
-  if (!ok("gh", ["auth", "status"])) errors.push("the GitHub CLI is not signed in: run `gh auth login`");
-  const tag = `v${manifest.version}`;
-  if (ok("git", ["rev-parse", "-q", "--verify", `refs/tags/${tag}`])) errors.push(`${tag} is already tagged: bump the version in plugin.json`);
-  if (repo && ok("gh", ["release", "view", tag, "--repo", repo])) errors.push(`${repo} already has a release ${tag}: bump the version in plugin.json`);
-  if (repo && ok("gh", ["api", `repos/${repo}`]) && JSON.parse(run("gh", ["api", `repos/${repo}`])).private) errors.push(`${repo} is private: a package's source has to be public`);
-
-  if (errors.length) {
-    for (const e of errors) console.error(`  ✗ ${e}`);
-    process.exit(1);
-  }
-
-  // ---- the build, exactly as the registry will repeat it ----
-  say("Building from the lockfile, as the registry will…");
-  const npm = npmCli();
-  if (!npm) { console.error("  ✗ npm was not found beside node"); process.exit(1); }
-  run(process.execPath, [npm, "ci", "--ignore-scripts", "--no-audit", "--no-fund"]);
-  await buildPlugin(dir);
-  const files = ["plugin.json", "plugin.js", "mcp.js"].filter((f) => existsSync(join(dir, f)));
-  errors.push(...checkAssets("plugin", files.map((f) => ({ name: f, size: statSync(join(dir, f)).size }))));
-  const table = JSON.parse(readFileSync(join(here, "permissions.json"), "utf8"));
-  const perms = checkPermissions(manifest.permissions, readFileSync(join(dir, "plugin.js"), "utf8"), table);
-  errors.push(...perms.errors);
-  notes.push(...perms.notes);
-  if (errors.length) {
-    for (const e of errors) console.error(`  ✗ ${e}`);
-    process.exit(1);
-  }
-
-  say(`\n${manifest.name} ${manifest.version} is ready: ${files.join(", ")}${manifest.permissions.length ? `; it uses ${manifest.permissions.join(", ")}` : ""}.`);
-  for (const n of notes) say(`  note: ${n}`);
-  if (dryRun) {
-    say(`\nDry run: nothing was tagged, released or submitted. Without --dry-run this tags ${tag}, releases it on ${repo}, and opens a PR to ${REGISTRY}.`);
-    return;
-  }
-
-  // ---- tag, release, submit ----
-  say(`Tagging ${tag} and pushing…`);
-  run("git", ["tag", tag]);
-  run("git", ["push", "-q", "origin", "HEAD", tag]);
-  say(`Releasing ${tag} on ${repo}…`);
-  run("gh", ["release", "create", tag, ...files.map((f) => join(dir, f)), "--repo", repo,
-    "--title", `${manifest.name} ${manifest.version}`, "--notes", `${manifest.name} ${manifest.version}, for Deck ${manifest.minDeck} and later.`]);
-
-  say(`Opening the submission to ${REGISTRY}…`);
-  const me = JSON.parse(run("gh", ["api", "user"])).login;
-  ok("gh", ["repo", "fork", REGISTRY, "--clone=false"]);
-  const fork = `${me}/${REGISTRY.split("/")[1]}`;
-  // The fork may be behind; the submission branch starts from the registry's main as it is now.
-  ok("gh", ["repo", "sync", fork, "--source", REGISTRY]);
-  const sha = JSON.parse(run("gh", ["api", `repos/${fork}/git/ref/heads/main`])).object.sha;
-  const branch = `submit/${manifest.id}-${manifest.version}`;
-  run("gh", ["api", "-X", "POST", `repos/${fork}/git/refs`, "-f", `ref=refs/heads/${branch}`, "-f", `sha=${sha}`]);
-  const body = JSON.stringify({ kind: "plugin", repo, tag }) + "\n";
-  run("gh", ["api", "-X", "PUT", `repos/${fork}/contents/submissions/${manifest.id}.json`,
-    "-f", `message=Submit ${manifest.id} ${tag}`, "-f", `content=${Buffer.from(body).toString("base64")}`, "-f", `branch=${branch}`]);
-  const pr = run("gh", ["pr", "create", "--repo", REGISTRY, "--base", "main", "--head", `${me}:${branch}`,
-    "--title", `Submit ${manifest.id} ${tag}`, "--body", `${manifest.name} ${manifest.version} from ${repo}.\n\nOpened by \`deck-plugin publish\`.`]);
-  say(`\nSubmitted: ${pr}\nThe registry's checks run there and comment what they find; when they pass it is merged and listed.`);
-}
+// `deck-plugin publish`: put this version of a plugin in Deck's registry.
+//
+//   deck-plugin publish --dry-run    check everything, publish nothing
+//   deck-plugin publish              tag, release on GitHub, and open the submission PR
+//
+// Runs on the author's machine the checks the registry runs on its own (validate.mjs, shared),
+// so a submission that would fail fails here, before anything is public:
+//   the manifest, README, LICENSE and package-lock.json; a clean, pushed git tree; a build from
+//   the lockfile exactly as the registry will repeat it (npm ci, then this SDK's build); the
+//   release's files and sizes; and that its permissions cover what the bundle calls.
+// Then it tags v<version>, makes the GitHub release with the built files, and opens a pull
+// request to the registry adding submissions/<id>.json, through the author's fork. The registry's
+// checks run on that PR and merge it when they pass.
+//
+// Needs git and the GitHub CLI (gh), signed in.
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { checkAssets, checkId, checkLockfile, checkManifest, checkPermissions } from "./validate.mjs";
+
+const here = dirname(fileURLToPath(import.meta.url));
+const REGISTRY = "deck-desktop/deck-registry";
+
+/** npm's own entry point, run with node: on Windows npm is npm.cmd, which Node will not execFile. */
+function npmCli() {
+  for (const p of [join(dirname(process.execPath), "node_modules", "npm", "bin", "npm-cli.js"),
+    join(dirname(process.execPath), "..", "lib", "node_modules", "npm", "bin", "npm-cli.js")]) if (existsSync(p)) return p;
+  return null;
+}
+
+export async function publish(dir, manifest, { dryRun, buildPlugin }) {
+  const run = (cmd, args, opts = {}) => execFileSync(cmd, args, { cwd: dir, stdio: ["ignore", "pipe", "pipe"], ...opts }).toString().trim();
+  const ok = (cmd, args) => { try { run(cmd, args); return true; } catch { return false; } };
+  const errors = [], notes = [];
+  const say = (s) => console.log(s);
+
+  // ---- what is in the folder ----
+  errors.push(...checkId(manifest.id ?? ""), ...checkManifest(manifest));
+  if (!existsSync(join(dir, "README.md"))) errors.push("no README.md: it is the plugin's page in Deck and on the website");
+  if (!["LICENSE", "LICENSE.md", "LICENSE.txt", "COPYING"].some((f) => existsSync(join(dir, f)))) errors.push("no LICENSE: say how others may use it (the scaffold's is MIT)");
+  if (existsSync(join(dir, ".npmrc"))) errors.push("there is an .npmrc: the registry installs from registry.npmjs.org only, so remove it");
+  const lockAt = join(dir, "package-lock.json");
+  if (!existsSync(lockAt)) errors.push("no package-lock.json: commit it, so the registry can repeat the build exactly");
+  else errors.push(...checkLockfile(JSON.parse(readFileSync(lockAt, "utf8"))));
+  const custom = existsSync(join(dir, "deck-plugin.config.mjs"));
+  if (custom) notes.push("It has a deck-plugin.config.mjs, which the build runs, so the registry will not rebuild it to check it: it is listed as build not verified.");
+
+  // ---- git and GitHub ----
+  if (!ok("git", ["rev-parse", "--is-inside-work-tree"])) errors.push("this is not a git repository");
+  let repo = "";
+  try {
+    const url = run("git", ["remote", "get-url", "origin"]);
+    repo = /github\.com[:/]([\w.-]+\/[\w.-]+?)(?:\.git)?$/.exec(url)?.[1] ?? "";
+    if (!repo) errors.push(`origin is ${url}, not a GitHub repository`);
+  } catch { errors.push("there is no origin remote: push it to a public GitHub repository first"); }
+  if (ok("git", ["rev-parse", "HEAD"]) && run("git", ["status", "--porcelain"])) errors.push("there are uncommitted changes: commit them, so the release is what the repository holds");
+  if (!ok("gh", ["auth", "status"])) errors.push("the GitHub CLI is not signed in: run `gh auth login`");
+  const tag = `v${manifest.version}`;
+  if (ok("git", ["rev-parse", "-q", "--verify", `refs/tags/${tag}`])) errors.push(`${tag} is already tagged: bump the version in plugin.json`);
+  if (repo && ok("gh", ["release", "view", tag, "--repo", repo])) errors.push(`${repo} already has a release ${tag}: bump the version in plugin.json`);
+  if (repo && ok("gh", ["api", `repos/${repo}`]) && JSON.parse(run("gh", ["api", `repos/${repo}`])).private) errors.push(`${repo} is private: a package's source has to be public`);
+
+  if (errors.length) {
+    for (const e of errors) console.error(`  ✗ ${e}`);
+    process.exit(1);
+  }
+
+  // ---- the build, exactly as the registry will repeat it ----
+  say("Building from the lockfile, as the registry will…");
+  const npm = npmCli();
+  if (!npm) { console.error("  ✗ npm was not found beside node"); process.exit(1); }
+  run(process.execPath, [npm, "ci", "--ignore-scripts", "--no-audit", "--no-fund"]);
+  await buildPlugin(dir);
+  const files = ["plugin.json", "plugin.js", "mcp.js"].filter((f) => existsSync(join(dir, f)));
+  errors.push(...checkAssets("plugin", files.map((f) => ({ name: f, size: statSync(join(dir, f)).size }))));
+  const table = JSON.parse(readFileSync(join(here, "permissions.json"), "utf8"));
+  const perms = checkPermissions(manifest.permissions, readFileSync(join(dir, "plugin.js"), "utf8"), table);
+  errors.push(...perms.errors);
+  notes.push(...perms.notes);
+  if (errors.length) {
+    for (const e of errors) console.error(`  ✗ ${e}`);
+    process.exit(1);
+  }
+
+  say(`\n${manifest.name} ${manifest.version} is ready: ${files.join(", ")}${manifest.permissions.length ? `; it uses ${manifest.permissions.join(", ")}` : ""}.`);
+  for (const n of notes) say(`  note: ${n}`);
+  if (dryRun) {
+    say(`\nDry run: nothing was tagged, released or submitted. Without --dry-run this tags ${tag}, releases it on ${repo}, and opens a PR to ${REGISTRY}.`);
+    return;
+  }
+
+  // ---- tag, release, submit ----
+  say(`Tagging ${tag} and pushing…`);
+  run("git", ["tag", tag]);
+  run("git", ["push", "-q", "origin", "HEAD", tag]);
+  say(`Releasing ${tag} on ${repo}…`);
+  run("gh", ["release", "create", tag, ...files.map((f) => join(dir, f)), "--repo", repo,
+    "--title", `${manifest.name} ${manifest.version}`, "--notes", `${manifest.name} ${manifest.version}, for Deck ${manifest.minDeck} and later.`]);
+
+  say(`Opening the submission to ${REGISTRY}…`);
+  const me = JSON.parse(run("gh", ["api", "user"])).login;
+  ok("gh", ["repo", "fork", REGISTRY, "--clone=false"]);
+  const fork = `${me}/${REGISTRY.split("/")[1]}`;
+  // The fork may be behind; the submission branch starts from the registry's main as it is now.
+  ok("gh", ["repo", "sync", fork, "--source", REGISTRY]);
+  const sha = JSON.parse(run("gh", ["api", `repos/${fork}/git/ref/heads/main`])).object.sha;
+  const branch = `submit/${manifest.id}-${manifest.version}`;
+  run("gh", ["api", "-X", "POST", `repos/${fork}/git/refs`, "-f", `ref=refs/heads/${branch}`, "-f", `sha=${sha}`]);
+  const body = JSON.stringify({ kind: "plugin", repo, tag }) + "\n";
+  run("gh", ["api", "-X", "PUT", `repos/${fork}/contents/submissions/${manifest.id}.json`,
+    "-f", `message=Submit ${manifest.id} ${tag}`, "-f", `content=${Buffer.from(body).toString("base64")}`, "-f", `branch=${branch}`]);
+  const pr = run("gh", ["pr", "create", "--repo", REGISTRY, "--base", "main", "--head", `${me}:${branch}`,
+    "--title", `Submit ${manifest.id} ${tag}`, "--body", `${manifest.name} ${manifest.version} from ${repo}.\n\nOpened by \`deck-plugin publish\`.`]);
+  say(`\nSubmitted: ${pr}\nThe registry's checks run there and comment what they find; when they pass it is merged and listed.`);
+}