dsh-plugin-discourse 1.0.0 → 1.0.1

package/README.md

@@ -1,5 +1,8 @@
 # dsh-plugin-discourse
 
+[![npm](https://img.shields.io/npm/v/dsh-plugin-discourse.svg)](https://www.npmjs.com/package/dsh-plugin-discourse)
+[![Publish to npm](https://github.com/AkarinLiu/dsh-plugin-discourse/actions/workflows/publish.yml/badge.svg)](https://github.com/AkarinLiu/dsh-plugin-discourse/actions/workflows/publish.yml)
+
 Discourse administration and agent tools for the [DeepSeek Harness](https://github.com/deepseek-ai).
 
 One Host plugin registers 16 model-facing tools over the Discourse REST API: an agent can search a
@@ -37,27 +40,62 @@ thread search never floods the model context. Results keep ids, so a follow-up c
 ## Install
 
 The bundle is a profile plugin: it is installed into one DSH profile and selected in that profile's
-bundle list.
+bundle list. Install it through the Web UI when you can: DSH's bundle installer replaces an existing
+copy or local link before it writes the package, while the CLI is a thin pnpm wrapper.
 
-**From the Web UI** — open *Settings → Plugins → Install bundle* and give it the package directory
-(for a clone) or a package spec such as `github:AkarinLiu/dsh-plugin-discourse`. DSH installs the
-package, adds it to the profile's bundle list, and activates it.
+**From the Web UI (recommended)** — open *Settings → Plugins → Install bundle* and enter
+`dsh-plugin-discourse` for the npm package, or `github:AkarinLiu/dsh-plugin-discourse`, or a local
+clone path. DSH installs the package, adds it to the profile's bundle list, and activates it.
 
-**From the CLI** — the launcher passes everything after `plugin` to pnpm:
+**From npm on the CLI** — the launcher passes everything after `plugin` to pnpm, so this is a plain
+pnpm install rather than the bundle installer:
 
 ```bash
-gh repo clone AkarinLiu/dsh-plugin-discourse
-dsh plugin --profile desktop add ./dsh-plugin-discourse
+dsh plugin --profile desktop add dsh-plugin-discourse
 ```
 
-That installs the package; select `dsh-plugin-discourse` once in the Plugins page (or through the
+After a CLI install, select `dsh-plugin-discourse` once in the Plugins page (or through the
 `plugin_manager` tool) so the profile records it as a bundle.
 
+**From a clone** — `gh repo clone AkarinLiu/dsh-plugin-discourse`, then
+`dsh plugin --profile desktop add ./dsh-plugin-discourse`. On Windows this creates a directory
+junction in the profile; read the next section before moving that profile to the npm package.
+
 To remove it, uninstall the bundle from the Plugins page, which drops the dependency and the bundle
 entry together.
 
 > The plugin is Host-only: no build step, no dependencies, no client assets.
 
+### Windows: EPERM when replacing a local link
+
+A clone install leaves `node_modules\dsh-plugin-discourse` as a directory junction. pnpm's hoisted
+linker does not always record or prune that junction, so a later npm install cannot replace it and
+Windows refuses the rename:
+
+```text
+[ERR_PNPM_EPERM] [importPackage ...\node_modules\dsh-plugin-discourse]
+EPERM: operation not permitted, rename '...dsh-plugin-discourse_tmp_...' -> '...dsh-plugin-discourse'
+```
+
+The checkout is untouched; only the link is stale. From a clone of this repository, let the bundled
+doctor remove the link and then reinstall:
+
+```bash
+node scripts/doctor.mjs --profile desktop --fix
+dsh plugin --profile desktop add dsh-plugin-discourse
+```
+
+Or delete the junction by hand and retry:
+
+```powershell
+$link = "$env:USERPROFILE\.dsh\profiles\desktop\node_modules\dsh-plugin-discourse"
+if ((Get-Item $link -Force -ErrorAction SilentlyContinue).LinkType -eq 'Junction') {
+  (Get-Item $link -Force).Delete()
+}
+```
+
+Restart the Harness after the package is replaced so the new module generation loads.
+
 ## Configure
 
 The bundle ships its defaults in `cordis.patch.yml`, which DSH applies as the bundle layer. To point
@@ -121,18 +159,58 @@ Row config wins over the environment when both are present.
 The package is plain ESM with no runtime dependencies; `index.js` is the whole plugin.
 
 ```bash
-node --check index.js          # syntax
-node scripts/smoke.mjs         # register every tool and validate definitions offline
-node scripts/smoke.mjs --live  # additionally call read-only tools against the configured forum
+node --check index.js                          # syntax
+npm test                                      # register every tool and validate definitions offline
+node scripts/smoke.mjs --live                 # additionally call read-only tools against the forum
+npm run verify                                # build the npm tarball and check its file list
+node scripts/doctor.mjs --profile desktop     # inspect a profile for a stale local link
 ```
 
 `scripts/smoke.mjs` drives `apply()` with a stub context, so it exercises the real registration path
-without starting a Harness.
+without starting a Harness. `scripts/verify-package.mjs` packs the package with `npm pack` and fails
+when a runtime file is missing from `files`, when the manifest loses `dsh.bundle`, or when a locale
+loses its display metadata. `prepack` runs the smoke test, so a broken package cannot be published.
+
+## Release
+
+Releases are automated by [`.github/workflows/publish.yml`](.github/workflows/publish.yml): every
+push to `main` or a `v*` tag, and every pull request, verifies the package, and a `v*` tag publishes it to
+[npmjs.com](https://www.npmjs.com/package/dsh-plugin-discourse) with
+[provenance](https://docs.npmjs.com/generating-provenance-statements).
+
+1. Bump `version` in `package.json` (the tag must match it exactly).
+2. Commit, then tag and push:
+
+   ```bash
+   git tag -a v1.0.1 -m "dsh-plugin-discourse 1.0.1"
+   git push origin main --follow-tags
+   ```
+
+3. The workflow runs on Node 24, verifies the tarball, checks `v<version>`, and publishes with
+   `--provenance --access public`.
+
+Before the first release, add a **Trusted Publisher** on npmjs.com (package page → *Settings* →
+*Trusted Publishing* → *GitHub Actions*):
+
+| Field | Value |
+|---|---|
+| Repository | `AkarinLiu/dsh-plugin-discourse` |
+| Workflow file | `publish.yml` |
+| Environment | *(leave empty)* |
+| Allowed action | `npm publish` |
+
+No `NPM_TOKEN` secret is needed: the workflow exchanges the GitHub OIDC token
+(`id-token: write`) for publish rights and attaches provenance. npm now requires an interactive 2FA
+challenge for token and trusted-publisher management, so this one-time setup happens in the browser;
+after it, tagged releases are fully automatic.
 
 ## 中文说明
 
 - 这是一个 **Host 插件**，向 DSH 智能体提供 16 个 Discourse 工具（读取 / 发帖 / 版主 / 管理员）。
-- 安装：在 DSH Web UI 的 *设置 → 插件 → 安装 bundle* 中选择本仓库目录，或填入 `github:AkarinLiu/dsh-plugin-discourse`。
+- 安装：优先用 Web UI 的 *设置 → 插件 → 安装 bundle*，填入 `dsh-plugin-discourse`（npm）或 `github:AkarinLiu/dsh-plugin-discourse`；安装器会先替换旧的本地链接。
+- 命令行：`dsh plugin --profile desktop add dsh-plugin-discourse` 只是把参数转交给 pnpm，安装后还需在插件页选中该 bundle。
+- Windows 从本地克隆切到 npm 时报 `ERR_PNPM_EPERM ... rename ...dsh-plugin-discourse...`：这是 profile 里遗留的目录联接；运行 `node scripts/doctor.mjs --profile desktop --fix` 后再安装（脚本只删链接，不动源码），然后重启 Harness。
+- 发布：推送 `v*` 标签会触发 `.github/workflows/publish.yml`。首次发布前在 npmjs.com 的包设置 → *Trusted Publishing* 添加 GitHub Actions（仓库 `AkarinLiu/dsh-plugin-discourse`、工作流 `publish.yml`、环境留空、允许 `npm publish`），之后不需要 `NPM_TOKEN`，由 OIDC 发布并生成 provenance。
 - 配置：在 profile 的 `cordis.patch.yml` 中加一条 `id: discourse` 的覆盖，把 `baseUrl` 改成你的论坛并填入 `apiKey`（覆盖会整体替换 `config`，请把其它键一并写全）。
 - 不需要 API Key 即可试用只读工具（默认指向 `https://meta.discourse.org`）。
 - 密钥建议通过环境变量 `DISCOURSE_API_KEY` / `DISCOURSE_API_USERNAME` 提供，避免写进配置文件。

package/index.js

@@ -165,14 +165,16 @@ function day(value) {
 function readConfig(raw) {
   const source = raw !== null && typeof raw === 'object' ? raw : {}
   const declared = optionalString(source.baseUrl) ?? DEFAULT_BASE_URL
-  let baseUrl
+  let parsed
   try {
-    const parsed = new URL(declared)
-    if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') fail('unsupported protocol')
-    baseUrl = `${parsed.origin}${parsed.pathname.replace(/\/+$/, '')}`
+    parsed = new URL(declared)
   } catch {
     fail(`invalid config: \`baseUrl\` must be an http(s) URL, got ${JSON.stringify(declared)}`)
   }
+  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+    fail(`invalid config: \`baseUrl\` must be an http(s) URL, got ${JSON.stringify(declared)}`)
+  }
+  const baseUrl = `${parsed.origin}${parsed.pathname.replace(/\/+$/, '')}`
   const envKey = typeof process !== 'undefined' ? process.env?.DISCOURSE_API_KEY : undefined
   const envUser = typeof process !== 'undefined' ? process.env?.DISCOURSE_API_USERNAME : undefined
   const apiKey = optionalString(source.apiKey) ?? optionalString(envKey) ?? ''

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-plugin-discourse",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "Discourse administration and agent tools for the DeepSeek Harness: 16 tools for reading, posting, moderating, and administering a Discourse forum.",
   "license": "MIT",
   "author": "AkarinLiu",
@@ -30,6 +30,12 @@
     "registry": "https://registry.npmjs.org",
     "access": "public"
   },
+  "scripts": {
+    "test": "node scripts/smoke.mjs",
+    "verify": "node scripts/verify-package.mjs",
+    "doctor": "node scripts/doctor.mjs",
+    "prepack": "node scripts/smoke.mjs"
+  },
   "exports": {
     ".": "./index.js",
     "./locale/*.json": "./locale/*.json",

package/scripts/doctor.mjs

@@ -0,0 +1,159 @@
+#!/usr/bin/env node
+/**
+ * Diagnose (and with --fix, remove) the Windows install trap where a stale
+ * directory junction for this bundle blocks a registry install:
+ *
+ *   [ERR_PNPM_EPERM] [importPackage ...\node_modules\dsh-plugin-discourse]
+ *   EPERM: operation not permitted, rename '..._tmp_...' -> '...dsh-plugin-discourse'
+ *
+ * A local-clone install (dsh plugin add ./dsh-plugin-discourse) creates that
+ * junction. pnpm's hoisted linker does not always record or prune it, so a
+ * later npm install cannot replace it. Removing the junction removes only the
+ * link; the checkout it points at is left untouched.
+ *
+ *   node scripts/doctor.mjs --profile desktop
+ *   node scripts/doctor.mjs --profile desktop --fix
+ */
+
+import { readFileSync, existsSync, lstatSync, realpathSync, unlinkSync, rmdirSync } from 'node:fs'
+import { homedir } from 'node:os'
+import { basename, dirname, join, resolve } from 'node:path'
+
+const PACKAGE = 'dsh-plugin-discourse'
+
+const argv = process.argv.slice(2)
+const profileIndex = argv.indexOf('--profile')
+const profile = profileIndex >= 0 ? argv[profileIndex + 1] : 'desktop'
+const fix = argv.includes('--fix')
+
+if (profileIndex >= 0 && (profile === undefined || profile.startsWith('--'))) {
+  console.error('usage: node scripts/doctor.mjs [--profile <name>] [--fix]')
+  process.exit(2)
+}
+
+const dshHome = process.env.DSH_HOME ?? join(homedir(), '.dsh')
+const profileDir = join(dshHome, 'profiles', profile)
+const manifestPath = join(profileDir, 'package.json')
+const linkPath = join(profileDir, 'node_modules', PACKAGE)
+
+if (!existsSync(manifestPath)) {
+  console.error(`no DSH profile at ${profileDir}: open DeepSeek Harness once for that profile, then retry`)
+  process.exit(2)
+}
+
+/** Read JSON that a Windows editor or PowerShell may have prefixed with a BOM. */
+function readJson(path) {
+  return JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''))
+}
+
+/** The spec the profile records for this bundle, when it records one. */
+function dependencySpec() {
+  try {
+    const manifest = readJson(manifestPath)
+    for (const field of ['dependencies', 'devDependencies', 'optionalDependencies']) {
+      const spec = manifest?.[field]?.[PACKAGE]
+      if (typeof spec === 'string' && spec.length > 0) return spec
+    }
+  } catch (error) {
+    console.error(`could not read ${manifestPath}: ${error.message}`)
+    process.exit(2)
+  }
+  return undefined
+}
+
+/**
+ * Inspect one node_modules entry. A junction (or symlink) resolves to a
+ * different path than the lexical entry; a normal package directory does not.
+ */
+function inspectEntry(path) {
+  let stats
+  try {
+    stats = lstatSync(path)
+  } catch {
+    return undefined
+  }
+  let target
+  try {
+    target = realpathSync.native(path)
+  } catch {
+    target = undefined
+  }
+  let expected = resolve(path)
+  try {
+    expected = join(realpathSync.native(dirname(path)), basename(path))
+  } catch {
+    // The parent is always readable when lstat succeeded; keep the lexical form.
+  }
+  const same = target !== undefined && (process.platform === 'win32'
+    ? target.toLowerCase() === expected.toLowerCase()
+    : target === expected)
+  return { target, isLink: stats.isSymbolicLink() || !same }
+}
+
+/** Remove a link without ever recursing into its target. */
+function removeLink(path) {
+  try {
+    unlinkSync(path)
+    return
+  } catch (error) {
+    if (!['EPERM', 'EISDIR', 'ENOTDIR', 'EACCES'].includes(error.code)) throw error
+  }
+  // On Windows rmdir deletes the junction's reparse point, not the target.
+  rmdirSync(path)
+}
+
+const entry = inspectEntry(linkPath)
+
+if (entry === undefined) {
+  console.log(`ok: no stale ${PACKAGE} entry in ${profileDir}; run "dsh plugin --profile ${profile} add ${PACKAGE}" to install it`)
+  process.exit(0)
+}
+
+if (!entry.isLink) {
+  if (existsSync(join(linkPath, 'package.json'))) {
+    console.log(`ok: ${PACKAGE} is installed as a normal directory in ${profileDir}`)
+    process.exit(0)
+  }
+  console.error(`${linkPath} exists but is not a package and not a link; inspect it by hand`)
+  process.exit(1)
+}
+
+const spec = dependencySpec()
+const target = entry.target ?? '(unresolvable)'
+const localSpec = spec !== undefined && (spec.startsWith('link:') || spec.startsWith('file:'))
+
+console.log(`found a directory link for ${PACKAGE}:`)
+console.log(`  link:       ${linkPath}`)
+console.log(`  target:     ${target}`)
+console.log(`  dependency: ${spec ?? '(not recorded)'}`)
+console.log(localSpec
+  ? 'The profile records a local spec, so this link is expected while the checkout is installed directly.'
+  : 'The profile records a registry spec, so this link is a leftover from an earlier local install.')
+
+if (!fix) {
+  if (localSpec) {
+    console.log('ok: this is a local development install; rerun with --fix only when switching the profile to the npm package.')
+    process.exit(0)
+  }
+  console.error('stale link blocks "pnpm install"; re-run with --fix to remove the link only, then install again:')
+  console.error(`  node scripts/doctor.mjs --profile ${profile} --fix`)
+  console.error(`  dsh plugin --profile ${profile} add ${PACKAGE}`)
+  process.exit(1)
+}
+
+try {
+  removeLink(linkPath)
+} catch (error) {
+  console.error(`could not remove ${linkPath}: ${error.message}`)
+  console.error('close DeepSeek Harness, then retry, or delete the junction in Explorer.')
+  process.exit(1)
+}
+
+if (existsSync(linkPath) || inspectEntry(linkPath) !== undefined) {
+  console.error(`${linkPath} still exists after removal`)
+  process.exit(1)
+}
+
+console.log(`removed the link; ${target === '(unresolvable)' ? 'the target' : target} was left untouched.`)
+console.log('now install the bundle:')
+console.log(`  dsh plugin --profile ${profile} add ${PACKAGE}`)

package/scripts/smoke.mjs

@@ -74,6 +74,18 @@ for (const [name, tool] of registry) {
   }
 }
 
+// A malformed forum URL must fail at activation with a usable diagnostic,
+// before any tool is registered.
+try {
+  apply({
+    tools: { register() { problems.push('invalid baseUrl registered a tool') } },
+    effect(callback) { callback() },
+  }, { baseUrl: 'ftp://forum.example.com' })
+  problems.push('invalid baseUrl was accepted')
+} catch (error) {
+  if (!/http\(s\) URL/.test(error.message)) problems.push(`invalid baseUrl diagnostic is unhelpful: ${error.message}`)
+}
+
 const describe = (value) => {
   const rendered = value.map((block) => block.text ?? `[${block.type}]`).join('\n')
   return rendered.length > 700 ? `${rendered.slice(0, 700)}…` : rendered

package/scripts/verify-package.mjs

@@ -0,0 +1,154 @@
+#!/usr/bin/env node
+/**
+ * Verify that the published tarball contains every runtime asset the DeepSeek
+ * Harness needs: the Host entry, the bundle patch, both locales, the icon, and
+ * the manifest. Run before a release or from CI.
+ *
+ *   node scripts/verify-package.mjs
+ */
+
+import { spawnSync } from 'node:child_process'
+import { closeSync, existsSync, mkdtempSync, openSync, readFileSync, rmSync, statSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { dirname, join, resolve } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..')
+/** Read JSON that may carry a UTF-8 BOM from a Windows editor. */
+const readJson = (path) => JSON.parse(readFileSync(path, 'utf8').replace(/^\uFEFF/, ''))
+const manifest = readJson(join(root, 'package.json'))
+const problems = []
+
+/** Record one packaging violation. */
+function check(condition, message) {
+  if (!condition) problems.push(message)
+}
+
+// --- Manifest --------------------------------------------------------------
+
+check(manifest.private !== true, 'package.json must not set "private": true, or npm refuses to publish it')
+check(typeof manifest.name === 'string' && manifest.name.length > 0, 'package.json needs a name')
+check(/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(manifest.version ?? ''), `package.json version is not semver: ${JSON.stringify(manifest.version)}`)
+check(manifest.type === 'module', 'package.json must stay "type": "module"')
+check(manifest.publishConfig?.access === 'public', 'publishConfig.access must be "public"')
+check(manifest.publishConfig?.registry === 'https://registry.npmjs.org', 'publishConfig.registry must name npmjs.com')
+check(manifest.engines?.node === '>=20', 'engines.node must stay ">=20"')
+
+const patch = manifest.dsh?.bundle?.patch
+check(typeof patch === 'string' && patch.length > 0, 'package.json must declare dsh.bundle.patch')
+if (typeof patch === 'string') {
+  check(existsSync(join(root, patch)), `dsh.bundle.patch points at a missing file: ${patch}`)
+}
+
+for (const [subpath, target] of Object.entries(manifest.exports ?? {})) {
+  if (typeof target !== 'string' || target.includes('*')) continue
+  check(existsSync(join(root, target)), `exports["${subpath}"] points at a missing file: ${target}`)
+}
+
+// --- Local assets ----------------------------------------------------------
+
+const required = [
+  'index.js',
+  'cordis.patch.yml',
+  'README.md',
+  'LICENSE',
+  'locale/en.json',
+  'locale/zh.json',
+  'icon.svg',
+  'scripts/smoke.mjs',
+  'scripts/doctor.mjs',
+  'scripts/verify-package.mjs',
+]
+for (const relative of required) check(existsSync(join(root, relative)), `missing required file: ${relative}`)
+
+for (const locale of ['locale/en.json', 'locale/zh.json']) {
+  const file = join(root, locale)
+  if (!existsSync(file)) continue
+  try {
+    const value = readJson(file)
+    check(typeof value?.meta?.title === 'string' && value.meta.title.length > 0, `${locale} needs meta.title`)
+    check(typeof value?.meta?.description === 'string' && value.meta.description.length > 0, `${locale} needs meta.description`)
+  } catch (error) {
+    problems.push(`${locale} is not valid JSON: ${error.message}`)
+  }
+}
+
+const icon = join(root, 'icon.svg')
+if (existsSync(icon)) {
+  const size = statSync(icon).size
+  check(size > 0 && size <= 256 * 1024, `icon.svg must be between 1 byte and 256 KiB, got ${size} bytes`)
+  check(readFileSync(icon, 'utf8').includes('<svg'), 'icon.svg does not look like an SVG document')
+}
+
+// --- Packed file list ------------------------------------------------------
+
+// Run npm with its stdout attached to a real file descriptor instead of a pipe:
+// on Windows the Harness sandbox denies piped stdio, and a pipe cannot deadlock
+// a large pack listing when it is a file handle.
+/** Locate npm's JavaScript entry so it can run without a command shell. */
+function findNpmCli() {
+  const candidates = []
+  if (typeof process.env.npm_execpath === 'string') candidates.push(process.env.npm_execpath)
+  const nodeDir = dirname(process.execPath)
+  candidates.push(
+    join(nodeDir, 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    join(nodeDir, '..', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+    join(nodeDir, '..', 'libexec', 'lib', 'node_modules', 'npm', 'bin', 'npm-cli.js'),
+  )
+  return candidates.find((candidate) => /npm-cli\.js$/i.test(candidate) && existsSync(candidate))
+}
+
+const npmCli = findNpmCli()
+const useNpmCli = npmCli !== undefined
+const command = useNpmCli ? process.execPath : process.platform === 'win32' ? 'npm.cmd' : 'npm'
+const args = [...(useNpmCli ? [npmCli] : []), 'pack', '--dry-run', '--json', '--ignore-scripts']
+const tempDir = mkdtempSync(join(tmpdir(), 'dsh-plugin-package-'))
+const packFile = join(tempDir, 'pack.json')
+let packOutput
+let fd
+try {
+  fd = openSync(packFile, 'w')
+  const result = spawnSync(command, args, {
+    cwd: root,
+    // Keep npm's cache inside this throwaway directory: the Harness sandbox
+    // cannot write the user-level cache, and CI should not depend on it either.
+    env: { ...process.env, npm_config_cache: join(tempDir, 'npm-cache') },
+    stdio: ['ignore', fd, 'inherit'],
+    shell: !useNpmCli && process.platform === 'win32',
+  })
+  closeSync(fd)
+  fd = undefined
+  if (result.error) problems.push(`npm pack failed: ${result.error.message}`)
+  else if (result.status !== 0) problems.push(`npm pack exited with status ${String(result.status)}`)
+  else packOutput = readFileSync(packFile, 'utf8')
+} finally {
+  if (fd !== undefined) closeSync(fd)
+  rmSync(tempDir, { recursive: true, force: true })
+}
+
+let packed = []
+if (packOutput) {
+  try {
+    const [info] = JSON.parse(packOutput)
+    packed = Array.isArray(info?.files) ? info.files.map((file) => file.path) : []
+  } catch (error) {
+    problems.push(`could not parse npm pack --json output: ${error.message}`)
+  }
+}
+
+if (packed.length > 0) {
+  const present = new Set(packed)
+  for (const relative of required) {
+    check(present.has(relative), `the packed tarball omits ${relative}; add it to package.json "files"`)
+  }
+  const forbidden = packed.filter((path) => path.startsWith('node_modules/') || path.startsWith('.git/') || path.includes('.tmp') || path.endsWith('.log'))
+  check(forbidden.length === 0, `the packed tarball contains development files: ${forbidden.join(', ')}`)
+}
+
+if (problems.length > 0) {
+  console.error('package verification failed:')
+  for (const problem of problems) console.error(`  - ${problem}`)
+  process.exit(1)
+}
+
+console.log(`ok: ${manifest.name}@${manifest.version} packs ${packed.length} files with every required asset`)