dsh-enterprise-market 0.1.0 → 0.2.0

package/lib/client.js

@@ -31,8 +31,8 @@ window.__ModuleLoader__.load({
       updated: '更新',
       local: '本机发布',
       uploadHeading: '发布自建插件',
-      uploadHint: '选择打包好的 .tgz，发布到企业 npm 仓库。上传人姓名取自当前企业身份并写入包元数据，同事在市场里就能看到。',
-      chooseFile: '选择 .tgz 文件',
+      uploadHint: '选择 .zip 或 .tgz，发布到企业 npm 仓库。zip 由宿主自动解包打包，上传人姓名取自当前企业身份并写入包元数据，同事在市场里就能看到。',
+      chooseFile: '选择 .zip 或 .tgz 文件',
       noFile: '尚未选择文件',
       namePlaceholder: '包名（可留空，用包内 package.json）',
       descPlaceholder: '一句话用途（可留空）',
@@ -41,8 +41,8 @@ window.__ModuleLoader__.load({
       published: '已发布',
       publishFailed: '发布失败',
       needIdentity: '未认证企业身份，不能发布',
-      needFile: '请先选择 .tgz 文件',
-      packHint: '在插件目录执行 npm pack，再上传生成的 .tgz。',
+      needFile: '请先选择 .zip 或 .tgz 文件',
+      packHint: '直接上传插件目录压缩成的 .zip，或已打包的 .tgz；插件名必须以 traness- 开头。',
       npmSignedIn: 'npm 已登录',
       npmSignedOut: 'npm 未登录',
       npmLoginHint: '本机 npm 未登录，发布会被仓库拒绝。先在终端执行 npm login，再回来上传。',
@@ -56,7 +56,9 @@ window.__ModuleLoader__.load({
         'origin-refused': '请求来源不受信任，已拒绝。',
         'registry-unreachable': '企业仓库暂时不可达。',
         'publish-failed': 'npm 拒绝发布，请检查包名是否已被占用、是否已登录。',
-        'invalid-tarball': '这个 .tgz 读不出 package/package.json。',
+        'invalid-tarball': '这个归档读不出 package.json，请确认压缩包里是插件目录本身。',
+        'invalid-archive': '压缩包里找不到 package.json，请把插件目录（含 package.json）打成一个 zip。',
+        'name-prefix-required': '插件名必须以 traness- 开头，请修改 package.json 的 name 后重新上传。',
         'invalid-manifest': '包内 package.json 缺少 name 或 version。',
         'identity-unverified': '未认证企业身份，不能发布。',
         'credential-missing': '没有可用的企业令牌。',
@@ -94,8 +96,8 @@ window.__ModuleLoader__.load({
       updated: 'Updated',
       local: 'Published locally',
       uploadHeading: 'Publish a self-built plugin',
-      uploadHint: 'Pick the packed .tgz and publish it to the enterprise npm registry. Your verified name is written into the package metadata so colleagues see the uploader.',
-      chooseFile: 'Choose a .tgz file',
+      uploadHint: 'Pick a .zip or .tgz and publish it to the enterprise npm registry. A zip is unpacked and packed by the host; your verified name is written into the package metadata so colleagues see the uploader.',
+      chooseFile: 'Choose a .zip or .tgz file',
       noFile: 'No file selected',
       namePlaceholder: 'Package name (optional; defaults to the package.json inside)',
       descPlaceholder: 'One-line purpose (optional)',
@@ -552,7 +554,7 @@ window.__ModuleLoader__.load({
                     h('input', {
                       ref: inputRef,
                       type: 'file',
-                      accept: '.tgz,.tar.gz,application/gzip',
+                      accept: '.zip,.tgz,.tar.gz,application/zip,application/gzip',
                       className: 'emk-hidden',
                       onChange: (event) => {
                         setFile(event.target.files?.[0] ?? null)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-enterprise-market",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": false,
   "type": "module",
   "description": "TranESS 企业插件市场：员工把自建插件发布到企业 npm 仓库，市场按企业身份显示上传人姓名，同事可直接下载安装。",

package/src/host/npm.js

@@ -1,7 +1,16 @@
-import { mkdtemp, readFile, rm, writeFile } from 'node:fs/promises'
+import { access, mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { createHash } from 'node:crypto'
+
+const exists = async (path) => {
+  try {
+    await access(path)
+    return true
+  } catch {
+    return false
+  }
+}
 import { findCli, run } from './exec.js'
 
 /** The metadata field the market reads the uploader from. */
@@ -51,6 +60,18 @@ export function isTarballName(fileName) {
   return /\.(tgz|tar\.gz)$/i.test(fileName)
 }
 
+/** Whether the spec names an archive this market can publish: tgz or zip. */
+export function isArchiveName(fileName) {
+  return isTarballName(fileName) || /[.]zip$/i.test(fileName)
+}
+
+/** 企业插件命名硬约束：必须以 traness- 开头，不做自动改名。 */
+export const PLUGIN_NAME_PREFIX = 'traness-'
+
+/** @param {string} name */
+export function nameMatchesPolicy(name) {
+  return typeof name === 'string' && name.startsWith(PLUGIN_NAME_PREFIX) && name.length > PLUGIN_NAME_PREFIX.length
+}
 /**
  * Extract a tarball, inject the uploader metadata and the discovery keyword,
  * and publish the resulting directory with the user's npm. The directory is a
@@ -69,6 +90,25 @@ export function isTarballName(fileName) {
  *   run?: typeof run,
  * }} input
  */
+
+/**
+ * 找到插件根目录：npm tarball 固定在 'package/'；zip 允许根目录直接是插件，
+ * 或只包一层文件夹（两种结构都支持）。
+ *
+ * @param {string} scratch
+ * @param {boolean} isZip
+ */
+async function locatePluginRoot(scratch, isZip) {
+  const direct = join(scratch, isZip ? '' : 'package', 'package.json')
+  if (await exists(direct)) return join(scratch, isZip ? '' : 'package')
+  if (!isZip) return null
+  const entries = await readdir(scratch, { withFileTypes: true })
+  const dirs = entries.filter((entry) => entry.isDirectory())
+  if (dirs.length !== 1) return null
+  const nested = join(scratch, dirs[0].name)
+  if (!(await exists(join(nested, 'package.json')))) return null
+  return nested
+}
 export async function publishTarball(input) {
   const registry = registryBase(input.registry)
   const npm = findCli(input.npmBin ?? 'npm')
@@ -79,14 +119,19 @@ export async function publishTarball(input) {
   let authFile
   try {
     await writeFile(tarballPath, input.tarball, { mode: 0o600 })
-    const extracted = await (input.run ?? run)('tar', ['-xzf', tarballPath, '-C', scratch], {
+    const isZip = /[.]zip$/i.test(input.fileName)
+    const extracted = await (input.run ?? run)('tar', [isZip ? '-xf' : '-xzf', tarballPath, '-C', scratch], {
       timeoutMs: 30_000,
     })
     if (extracted.code !== 0) {
       return { ok: false, reason: 'invalid-tarball', detail: 'tar could not read the uploaded file' }
     }
-    // A packed npm tarball puts everything under one `package/` directory.
-    const pkgDir = join(scratch, 'package')
+    // A packed npm tarball puts everything under one 'package/' directory; a
+    // user zip may put package.json at the root or inside a single top folder.
+    const pkgDir = await locatePluginRoot(scratch, isZip)
+    if (pkgDir === null) {
+      return { ok: false, reason: 'invalid-archive', detail: 'the archive has no package.json at its root' }
+    }
     let manifest
     try {
       manifest = JSON.parse(await readFile(join(pkgDir, 'package.json'), 'utf8'))
@@ -99,6 +144,15 @@ export async function publishTarball(input) {
     if (typeof manifest.version !== 'string' || manifest.version.trim() === '') {
       return { ok: false, reason: 'invalid-manifest', detail: 'package.json has no version' }
     }
+    const requestedName = typeof input.name === 'string' ? input.name.trim() : ''
+    const effectiveName = requestedName !== '' ? requestedName : manifest.name
+    if (!nameMatchesPolicy(effectiveName)) {
+      return {
+        ok: false,
+        reason: 'name-prefix-required',
+        detail: '插件名必须以 ' + PLUGIN_NAME_PREFIX + ' 开头，当前为 ' + effectiveName,
+      }
+    }
     const name = typeof input.name === 'string' && input.name.trim() !== '' ? input.name.trim() : manifest.name
     const description =
       typeof input.description === 'string' && input.description.trim() !== ''