made-market 0.0.0-stage → 0.1.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 jobop
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,31 @@
-# Temporary Holding Version
+# made-market · 码得插件市场 CLI
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+码得（made）公开插件市场的命令行工具。市场登记与分发主题、管控、agent 运行时三类包，本身不执行插件代码；包装到 `~/made` 后由桥接器自动扫描。
+
+```sh
+npx made-market list              # 列出索引里的全部包
+npx made-market search 日落        # 在包名、简介和标签里搜索
+npx made-market info sunset       # 看一个包的详情
+npx made-market install sunset    # 装到 ~/made/themes/，重启桥接器后生效
+```
+
+## 发布新包
+
+发布需要先登录（下载安装永远匿名，无需账号）：
+
+```sh
+npx made-market register <用户名>
+npx made-market login <用户名>
+npx made-market publish <包目录>
+```
+
+会话有效期 90 天，凭证存放在 `~/made/credentials.json`（权限 0600）。
+
+## 服务地址
+
+- 默认索引：GitHub 上的 `registry/index.json`（离线时回落到包内自带快照）
+- 自建市场：`--server` 指定市场服务地址，或设 `MADE_MARKET_REGISTRY` / `MADE_MARKET_SERVER` 环境变量
+
+## 服务端
+
+本仓库（[github.com/jobop/made-market](https://github.com/jobop/made-market)）同时包含市场服务端（`server/`）与站点（`site/`），它们**不随本 npm 包分发**；`cli/lib` 里的包格式核心库与仓库内服务端共用同一份源码。

package/bin/made-market.mjs

@@ -0,0 +1,301 @@
+#!/usr/bin/env node
+/**
+ * 码得插件市场的命令行入口 —— 供 `npx made-market` 直接使用。
+ *
+ * 市场只做包管理：列出、查询、下载、校验和落盘到一个固定目录，从不执行包代码。
+ * 包装到 <home>/plugins 或 <home>/themes（默认 ~/made），桥接器启动时自己扫。
+ *
+ *   npx made-market list
+ *   npx made-market info sunset
+ *   npx made-market install sunset alarm-clock
+ *   npx made-market install demo-echo --home /tmp/home --dry-run
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { ROOT } from '../lib/market.mjs';
+import { install, loadRegistry, resolveHome, resolveRegistry } from '../src/install.mjs';
+import { publish } from '../src/publish.mjs';
+import { login, logout, register, resolvePassword, whoami } from '../src/account.mjs';
+
+// 版本号读 CLI 自己的 package.json（cli/），发布后即 node_modules/made-market/package.json。
+const CLI_PACKAGE_JSON = fileURLToPath(new URL('../package.json', import.meta.url));
+
+const KIND_LABELS = { theme: '主题', control: '管控', agent: 'agent 运行时' };
+const KIND_ORDER = ['theme', 'control', 'agent'];
+
+const USAGE = `码得 · 插件市场  (made-market)
+
+用法
+  npx made-market <命令> [参数] [选项]
+
+命令
+  list                        列出索引里的全部包
+  search <关键词>              在包名、简介和标签里搜索
+  info <包 ID>                 看一个包的详情：文件、校验和、安装位置、创建人
+  install <包 ID…>             装到包目录，重启桥接器后生效（匿名，无需登录）
+  publish <包目录>             把一个包目录上传到市场服务（需先登录）
+  register <用户名>            注册账号并登录（凭证存 <home>/credentials.json）
+  login <用户名>               登录市场服务（发布的前提；90 天会话）
+  whoami                      看当前登录的账号
+  logout                      退出登录（吊销服务端会话并删除本地凭证）
+  rebuild-from-store           管理命令：从存储 manifests 全量重建 PG 索引
+
+选项
+  --home <目录>                包目录根，默认 $MADE_HOME 或 ~/made
+  --registry <路径|URL>        索引来源。默认优先 $MADE_MARKET_REGISTRY（如市场服务的索引），
+                               不可用或未设置时回落到本包自带的索引（离线可用）
+  --server <URL>              市场服务地址（register/login/publish；默认 $MADE_MARKET_SERVER，
+                               已登录时也可从凭证读取）
+  --token <t>                 发布 token（publish；默认 $MADE_MARKET_TOKEN 或登录凭证）
+  --password <pw>             密码（register/login；缺省在 TTY 下不回显输入）
+  --kind theme|control|agent   只列某一类（list / search）
+  --json                       以 JSON 输出
+  --force                      目标目录已存在时覆盖
+  --dry-run                    只校验并列出将要写入的文件
+  -h, --help                   显示帮助
+  -v, --version                显示版本
+
+装好的包在：
+  <home>/plugins/   管控插件与 agent 运行时
+  <home>/themes/    主题包
+
+桥接器每次启动扫描这两个目录，不需要登记，也不需要和配置文件放在一起。`;
+
+function parse(argv) {
+  const options = { command: '', args: [], home: '', registry: '', server: '', token: '', password: '', kind: '', json: false, force: false, dryRun: false, help: false, version: false };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--home') options.home = argv[++i] || '';
+    else if (arg === '--registry') options.registry = argv[++i] || '';
+    else if (arg === '--server') options.server = argv[++i] || '';
+    else if (arg === '--token') options.token = argv[++i] || '';
+    else if (arg === '--password') options.password = argv[++i] || '';
+    else if (arg === '--kind') options.kind = argv[++i] || '';
+    else if (arg === '--json') options.json = true;
+    else if (arg === '--force') options.force = true;
+    else if (arg === '--dry-run') options.dryRun = true;
+    else if (arg === '--help' || arg === '-h') options.help = true;
+    else if (arg === '--version' || arg === '-v') options.version = true;
+    else if (arg.startsWith('-')) throw new Error(`未知参数 ${arg}`);
+    else if (!options.command) options.command = arg;
+    else options.args.push(arg);
+  }
+  return options;
+}
+
+const semverGreater = (a, b) => {
+  const left = String(a).split('.').map(Number);
+  const right = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((left[i] || 0) !== (right[i] || 0)) return (left[i] || 0) > (right[i] || 0);
+  }
+  return false;
+};
+
+/**
+ * API 模式安装：按包直查市场服务的 /api/packages/<id>，不下载全量索引。
+ * 大市场（索引几十 MB）时用这个，归档地址改写成服务上的绝对地址。
+ */
+async function resolveViaApi(ids, server) {
+  const base = String(server).replace(/\/+$/, '');
+  const packages = [];
+  for (const id of ids) {
+    const response = await fetch(`${base}/api/packages/${encodeURIComponent(id)}`, { signal: AbortSignal.timeout(15000) });
+    if (!response.ok) throw new Error(`查询 ${id} 失败：HTTP ${response.status}`);
+    const versions = await response.json();
+    const latest = versions.reduce((best, item) => (!best || semverGreater(item.version, best.version) ? item : best), null);
+    if (!latest) throw new Error(`服务上没有包 ${id}`);
+    packages.push({ ...latest, download: latest.download.startsWith('http') ? latest.download : `${base}/${latest.download}` });
+  }
+  return { packages, base };
+}
+
+const human = (bytes) => (bytes < 1024 ? `${bytes} B` : bytes < 1024 * 1024 ? `${(bytes / 1024).toFixed(1)} KB` : `${(bytes / 1048576).toFixed(2)} MB`);
+const homeOf = (options) => resolveHome(options.home);
+
+function installCommand(entry) {
+  return `npx made-market install ${entry.id}`;
+}
+
+function describe(entry) {
+  return {
+    id: entry.id,
+    kind: entry.kind,
+    version: entry.version,
+    name: entry.name,
+    summary: entry.summary,
+    author: entry.author,
+    license: entry.license,
+    tags: entry.tags,
+    target: entry.target,
+    dir: entry.dir,
+    createdBy: entry.createdBy || '',
+    publishedBy: entry.publishedBy || '',
+    sha256: entry.sha256,
+    archiveBytes: entry.archiveBytes,
+    files: entry.files,
+    install: installCommand(entry),
+  };
+}
+
+function listRows(index, options) {
+  const rows = options.kind ? index.packages.filter((entry) => entry.kind === options.kind) : index.packages;
+  const ordered = KIND_ORDER.flatMap((kind) => rows.filter((entry) => entry.kind === kind));
+  return ordered.length ? ordered : rows;
+}
+
+function printTable(rows) {
+  if (!rows.length) {
+    console.log('没有匹配的包。');
+    return;
+  }
+  const width = Math.max(...rows.map((entry) => entry.id.length), 2);
+  for (const entry of rows) {
+    console.log(`${entry.kind.padEnd(8)} ${entry.id.padEnd(width)}  v${entry.version.padEnd(7)} ${human(entry.archiveBytes).padStart(9)}  ${entry.name}`);
+  }
+  console.log(`\n共 ${rows.length} 个包。安装：npx made-market install <包 ID>`);
+}
+
+async function main() {
+  let options;
+  try {
+    options = parse(process.argv.slice(2));
+  } catch (error) {
+    console.error(error.message);
+    console.error(`\n${USAGE}`);
+    process.exitCode = 1;
+    return;
+  }
+
+  if (options.version) {
+    const pkg = JSON.parse(fs.readFileSync(CLI_PACKAGE_JSON, 'utf8'));
+    console.log(pkg.version);
+    return;
+  }
+  if (options.help || !options.command) {
+    console.log(USAGE);
+    return;
+  }
+
+  // 索引来源按需加载：--registry > $MADE_MARKET_REGISTRY > 包内自带（远端失败自动回落，离线可用）。
+  // rebuild-from-store 与 install --server（API 模式）不依赖全量索引。
+  const loadIndex = () => loadRegistry(resolveRegistry(options.registry));
+
+  if (options.command === 'list') {
+    const rows = listRows((await loadIndex()).index, options);
+    if (options.json) console.log(JSON.stringify(rows.map(describe), null, 2));
+    else printTable(rows);
+    return;
+  }
+
+  if (options.command === 'search') {
+    const query = options.args.join(' ').trim().toLowerCase();
+    if (!query) throw new Error('search 需要一个关键词');
+    const rows = listRows((await loadIndex()).index, options).filter((entry) => [
+      entry.id, entry.name, entry.nameEn, entry.summary, entry.summaryEn, ...(entry.tags || []), ...(entry.highlights || []),
+    ].filter(Boolean).some((field) => String(field).toLowerCase().includes(query)));
+    if (options.json) console.log(JSON.stringify(rows.map(describe), null, 2));
+    else printTable(rows);
+    return;
+  }
+
+  if (options.command === 'info') {
+    const id = options.args[0];
+    if (!id) throw new Error('info 需要一个包 ID');
+    const entry = (await loadIndex()).index.packages.find((item) => item.id === id);
+    if (!entry) throw new Error(`索引里没有包 ${id}`);
+    if (options.json) {
+      console.log(JSON.stringify(describe(entry), null, 2));
+      return;
+    }
+    console.log(`${entry.name}  ·  ${entry.id} v${entry.version}  ·  ${KIND_LABELS[entry.kind] || entry.kind}`);
+    console.log(`${entry.summary}`);
+    if (entry.description) console.log(`\n${entry.description}`);
+    console.log('\n信息');
+    console.log(`  作者      ${entry.author}`);
+    console.log(`  许可      ${entry.license}`);
+    console.log(`  创建人    ${entry.createdBy || '—'}`);
+    console.log(`  最近发布  ${entry.publishedBy || '—'}${entry.publishedAt ? ` · ${entry.publishedAt}` : ''}`);
+    console.log(`  标签      ${(entry.tags || []).join('、') || '—'}`);
+    console.log(`  安装到    ${homeOf(options)}/${entry.target}/${entry.dir}/`);
+    console.log(`  归档      ${human(entry.archiveBytes)}  sha256 ${entry.sha256}`);
+    console.log('\n文件与校验和');
+    for (const file of entry.files || []) console.log(`  ${file.path.padEnd(14)} ${human(file.size).padStart(9)}  ${file.sha256.slice(0, 16)}`);
+    if (entry.highlights?.length) {
+      console.log('\n要点');
+      for (const item of entry.highlights) console.log(`  · ${item}`);
+    }
+    console.log(`\n安装：${installCommand(entry)}`);
+    return;
+  }
+
+  if (options.command === 'install') {
+    if (!options.args.length) throw new Error('install 需要至少一个包 ID');
+    // 配了 --server / $MADE_MARKET_SERVER：按包直查 API，不拉全量索引（大市场友好）。
+    if (options.server || process.env.MADE_MARKET_SERVER) {
+      const { packages, base } = await resolveViaApi(options.args, options.server || process.env.MADE_MARKET_SERVER);
+      await install(options.args, { home: options.home, registry: base, index: { packages }, force: options.force, dryRun: options.dryRun });
+      return;
+    }
+    // 归档从索引所在的位置取：远端索引配远端归档，自带索引配包内归档，可离线。
+    const { source, index } = await loadIndex();
+    await install(options.args, { home: options.home, registry: source, index, force: options.force, dryRun: options.dryRun });
+    return;
+  }
+
+  if (options.command === 'publish') {
+    const dir = options.args[0];
+    if (!dir) throw new Error('publish 需要一个包目录');
+    await publish(dir, { server: options.server, token: options.token, home: options.home });
+    return;
+  }
+
+  if (options.command === 'register' || options.command === 'login') {
+    const name = options.args[0];
+    if (!name) throw new Error(`${options.command} 需要一个用户名`);
+    const server = options.server || process.env.MADE_MARKET_SERVER;
+    const password = await resolvePassword({ ...options, name });
+    const run = options.command === 'register' ? register : login;
+    const result = await run({ server, name, password, home: options.home });
+    const who = result.user || { name };
+    console.log(`${options.command === 'register' ? '注册' : '登录'}成功：${who.name}${who.displayName && who.displayName !== who.name ? `（${who.displayName}）` : ''}`);
+    console.log(`  服务 ${server}`);
+    console.log(`  凭证已存 ${resolveHome(options.home)}/credentials.json（0600），publish 直接可用`);
+    return;
+  }
+
+  if (options.command === 'whoami') {
+    const result = await whoami({ server: options.server, home: options.home, token: options.token });
+    console.log(`已登录：${result.user}${result.server ? ` @ ${result.server}` : ''}`);
+    return;
+  }
+
+  if (options.command === 'logout') {
+    await logout({ home: options.home, token: options.token });
+    console.log('已退出登录（服务端会话已吊销，本地凭证已删除）。');
+    return;
+  }
+
+  if (options.command === 'rebuild-from-store') {
+    const { createPool, initSchema, rebuildFromStore } = await import('../server/db.mjs');
+    const { createStore } = await import('../server/store.mjs');
+    if (!process.env.DATABASE_URL) throw new Error('rebuild-from-store 需要 DATABASE_URL 指向 PG 索引库');
+    const db = createPool(process.env.DATABASE_URL);
+    try {
+      await initSchema(db);
+      const count = await rebuildFromStore(db, createStore(), { log: (key) => console.log(`  同步 ${key}`) });
+      console.log(`索引重建完成：${count} 条版本事实。`);
+    } finally {
+      await db.close();
+    }
+    return;
+  }
+
+  throw new Error(`未知命令 ${options.command}\n\n${USAGE}`);
+}
+
+main().catch((error) => {
+  console.error(error.message);
+  process.exitCode = 1;
+});

package/lib/glyphs.mjs

@@ -0,0 +1,25 @@
+/** Site glyph names. `tools/build.mjs` writes them into `site/glyphs.js` so the
+ * page and the validator share one source of truth. Paths use a 24×24 viewBox. */
+export const GLYPHS = {
+  sun: '<circle cx="12" cy="12" r="4"/><path d="M12 2v3M12 19v3M2 12h3M19 12h3M4.9 4.9 7 7M17 17l2.1 2.1M19.1 4.9 17 7M7 17l-2.1 2.1"/>',
+  wave: '<path d="M2 13c2 0 3-3.5 5-3.5s3 3.5 5 3.5 3-3.5 5-3.5 3 3.5 5 3.5"/>',
+  leaf: '<path d="M20 4c0 8-5 12-11 12H5c0-7 5-12 11-12h4z"/><path d="M5 20c2-5 5-8 9-10"/>',
+  moon: '<path d="M20 14.5A8 8 0 0 1 9.5 4 8 8 0 1 0 20 14.5z"/>',
+  bell: '<path d="M18 15V10a6 6 0 1 0-12 0v5l-2 3h16l-2-3z"/><path d="M10 21h4"/>',
+  clock: '<circle cx="12" cy="12" r="8"/><path d="M12 7v5l3.5 2"/>',
+  bolt: '<path d="M13 2 5 13h6l-1 9 8-11h-6l1-9z"/>',
+  link: '<path d="M9.5 14.5 14.5 9.5"/><path d="M10.5 6.5 13 4a4 4 0 0 1 6 6l-2.5 2.5"/><path d="M13.5 17.5 11 20a4 4 0 0 1-6-6l2.5-2.5"/>',
+  terminal: '<rect x="3" y="4" width="18" height="16" rx="3"/><path d="M7 9l3 3-3 3M13 15h4"/>',
+  chat: '<path d="M20 12a7 7 0 0 1-7 7H8l-4 3v-5.5A7 7 0 0 1 6.5 5h6.5a7 7 0 0 1 7 7z"/>',
+  spark: '<path d="M12 3l2 6 6 2-6 2-2 6-2-6-6-2 6-2 2-6z"/>',
+  box: '<path d="M12 3l8 4.5v9L12 21l-8-4.5v-9L12 3z"/><path d="M4 7.5 12 12l8-4.5M12 12v9"/>',
+  shield: '<path d="M12 3l7 3v6c0 4-3 7.5-7 9-4-1.5-7-5-7-9V6l7-3z"/>',
+  palette: '<path d="M12 3a9 9 0 1 0 0 18c1.4 0 2-1 2-2s-.6-2-2-2h-1a2 2 0 0 1 0-4h6a4 4 0 0 0 4-4c0-3.5-4-6-9-6z"/><circle cx="8" cy="10" r="1.1"/><circle cx="12" cy="7.5" r="1.1"/><circle cx="16" cy="10" r="1.1"/>',
+  grid: '<rect x="3" y="3" width="7" height="7" rx="2"/><rect x="14" y="3" width="7" height="7" rx="2"/><rect x="3" y="14" width="7" height="7" rx="2"/><rect x="14" y="14" width="7" height="7" rx="2"/>',
+  mic: '<rect x="9" y="3" width="6" height="10" rx="3"/><path d="M5 11a7 7 0 0 0 14 0M12 18v3"/>',
+  volume: '<path d="M11 5 6 9H3v6h3l5 4V5z"/><path d="M15 9a4 4 0 0 1 0 6M18 6.5a8 8 0 0 1 0 11"/>',
+  gift: '<rect x="3" y="9" width="18" height="12" rx="2"/><path d="M3 13h18M12 9v12"/><path d="M12 9S10 3 7 3.5 7 9 12 9zM12 9s2-6 5-5.5S17 9 12 9z"/>',
+  wand: '<path d="M4 20 15 9"/><path d="M17 3l1 2.5L20.5 6.5 18 8l-1 2.5L16 8 13.5 6.5 16 5.5 17 3z"/><path d="M5.5 5.5 6.5 8 9 9l-2.5 1L5.5 12.5 4.5 10 2 9l2.5-1L5.5 5.5z"/>',
+};
+
+export const GLYPH_NAMES = Object.freeze(Object.keys(GLYPHS));

package/lib/icon.mjs

@@ -0,0 +1,110 @@
+/**
+ * The `indexed4` agent-avatar protocol, kept byte-for-byte compatible with the
+ * bridge (`bridge/src/agent-icons.mjs` in the made repository).
+ *
+ * Pixels are row-major 4-bit palette indices, high nibble first, no row
+ * padding. There are no image URLs and no executable SVG on the wire, so the
+ * market can hand the same pixels to the web page and to the device.
+ */
+export const MAX_SIZE = 48;
+export const MAX_JSON_BYTES = 2048;
+const RGBA = /^[0-9a-f]{8}$/i;
+const RGB = /^#[0-9a-f]{6}$/i;
+const FIELDS = new Set(['format', 'width', 'height', 'palette', 'data', 'background', 'accent']);
+const B64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/;
+
+export function validateIcon(icon) {
+  if (!icon || typeof icon !== 'object' || Array.isArray(icon) || icon.format !== 'indexed4') {
+    throw new Error('图标必须为 indexed4 像素对象');
+  }
+  if (Object.keys(icon).some((key) => !FIELDS.has(key))) throw new Error('图标包含不支持的字段');
+  for (const key of ['width', 'height']) {
+    const value = icon[key];
+    if (!Number.isInteger(value) || value < 1 || value > MAX_SIZE) throw new Error(`图标尺寸必须为 1–${MAX_SIZE} 像素`);
+  }
+  if (!Array.isArray(icon.palette) || icon.palette.length < 1 || icon.palette.length > 16
+    || icon.palette.some((color) => typeof color !== 'string' || !RGBA.test(color))) {
+    throw new Error('图标 palette 需要 1–16 个 RRGGBBAA 颜色');
+  }
+  if (!RGB.test(icon.background || '') || !RGB.test(icon.accent || '')) throw new Error('图标背景与强调色必须为 #RRGGBB');
+  const pixels = icon.width * icon.height;
+  const bytes = Math.ceil(pixels / 2);
+  if (typeof icon.data !== 'string' || icon.data.length !== Math.ceil(bytes / 3) * 4 || !B64.test(icon.data)) {
+    throw new Error('图标 data 的 Base64 长度或格式无效');
+  }
+  const packed = Buffer.from(icon.data, 'base64');
+  if (packed.length !== bytes || packed.toString('base64') !== icon.data) throw new Error('图标 data 必须使用标准 Base64 编码');
+  for (let i = 0; i < pixels; i++) {
+    const index = i % 2 ? packed[i >> 1] & 15 : packed[i >> 1] >> 4;
+    if (index >= icon.palette.length) throw new Error('图标像素引用了不存在的 palette 颜色');
+  }
+  if (pixels % 2 && (packed.at(-1) & 15)) throw new Error('图标最后一个未使用的低半字节必须为零');
+  if (Buffer.byteLength(JSON.stringify(icon)) > MAX_JSON_BYTES) throw new Error('图标数据超过 2 KB');
+  return icon;
+}
+
+export function normalizeIcon(icon) {
+  return {
+    format: 'indexed4',
+    width: icon.width,
+    height: icon.height,
+    palette: icon.palette.map((color) => color.toLowerCase()),
+    data: icon.data,
+    background: icon.background.toLowerCase(),
+    accent: icon.accent.toLowerCase(),
+  };
+}
+
+const clamp = (value, min, max) => Math.min(Math.max(value, min), max);
+
+/**
+ * Draw rounded rectangles on a 42-unit canvas scaled to 48×48, exactly like the
+ * bridge renders its built-in animals, then quantise to an `indexed4` palette.
+ *
+ * @param {{background: string, accent: string, shapes: [number, number, number, number, string, number?][]}} art
+ */
+export function renderIcon(art) {
+  const size = MAX_SIZE;
+  const pixels = new Uint8Array(size * size * 4);
+  for (const [x, y, width, height, fill, round = 0] of art.shapes) {
+    const rx = Math.min(round, width / 2);
+    const ry = Math.min(round, height / 2);
+    const color = [1, 3, 5].map((offset) => parseInt(fill.slice(offset, offset + 2), 16));
+    for (let py = 0; py < size; py++) {
+      for (let px = 0; px < size; px++) {
+        const dx = ((px + 0.5) * 42) / size - x;
+        const dy = ((py + 0.5) * 42) / size - y;
+        if (dx < 0 || dy < 0 || dx >= width || dy >= height) continue;
+        const cx = Math.max(rx - dx, dx - (width - rx), 0);
+        const cy = Math.max(ry - dy, dy - (height - ry), 0);
+        if (cx && cy && (cx / rx) ** 2 + (cy / ry) ** 2 > 1) continue;
+        pixels.set([...color, 255], (py * size + px) * 4);
+      }
+    }
+  }
+  const order = [];
+  const palette = new Map();
+  for (let i = 0; i < size * size; i++) {
+    const rgba = pixels[i * 4 + 3] === 0 ? [0, 0, 0, 0] : [...pixels.subarray(i * 4, i * 4 + 4)];
+    const key = rgba.join(',');
+    if (!palette.has(key)) {
+      if (order.length === 16) throw new Error('图标超过 16 种颜色，请减少图形数量或颜色');
+      palette.set(key, order.length);
+      order.push(rgba);
+    }
+  }
+  const packed = Buffer.alloc(Math.ceil(size * size / 2));
+  for (let i = 0; i < size * size; i++) {
+    const rgba = pixels[i * 4 + 3] === 0 ? [0, 0, 0, 0] : [...pixels.subarray(i * 4, i * 4 + 4)];
+    packed[i >> 1] |= palette.get(rgba.join(',')) << (i % 2 ? 0 : 4);
+  }
+  return validateIcon(normalizeIcon({
+    format: 'indexed4',
+    width: size,
+    height: size,
+    palette: order.map((rgba) => rgba.map((value) => clamp(value, 0, 255).toString(16).padStart(2, '0')).join('')),
+    data: packed.toString('base64'),
+    background: art.background,
+    accent: art.accent,
+  }));
+}