made-market 0.4.3 → 0.4.5

package/lib/market.mjs

@@ -29,10 +29,16 @@ export const KINDS = Object.freeze({
   theme: { source: 'themes', target: 'themes', label: '主题', labelEn: 'Theme', icon: 'theme' },
   control: { source: 'control', target: 'plugins', label: '管控', labelEn: 'Control', icon: 'control' },
   agent: { source: 'agents', target: 'plugins', label: 'agent 运行时', labelEn: 'Agent runtime', icon: 'agent' },
+  h5: { source: 'h5', target: 'plugins', label: 'H5 应用', labelEn: 'H5 app', icon: 'grid' },
 });
 
-export const KIND_ORDER = Object.freeze(['theme', 'control', 'agent']);
+export const KIND_ORDER = Object.freeze(['theme', 'control', 'agent', 'h5']);
 export const PLUGIN_KINDS = Object.freeze({ control: 'board-plugin', agent: 'coding-agent' });
+
+/** H5 插件能力白名单（与桥接器 h5-apps.mjs 同名单：桥接器是裁决点，市场只做预检）。 */
+export const H5_CAPABILITIES = Object.freeze([
+  'state.read', 'tasks.read', 'tasks.write', 'sessions.read', 'sessions.write', 'settings.read',
+]);
 const PAYLOAD_IGNORED = new Set(['market.json']);
 
 export const sha256 = (buffer) => crypto.createHash('sha256').update(buffer).digest('hex');
@@ -162,11 +168,60 @@ function validateSpriteDir(dir, fail, warn) {
   if (!Number.isInteger(sprite.version) || sprite.version < 1) {
     fail('sprite/manifest.json 的 version 必须是 ≥1 的整数（改素材必须递增，否则设备不更新）');
   }
-  if (!Array.isArray(sprite.layers) || !sprite.layers.length) {
-    fail('sprite/manifest.json 的 layers 必须是非空数组');
-  }
+  // 两种素材形态二选一（与桥接器 agent-sprites.mjs validateFramesTable 同规则）：
+  // frames 整帧状态表（新，推荐）— 有它就不需要 layers；layers 分层叠加（老）。
   const pngs = fs.readdirSync(spriteDir).filter((name) => name.endsWith('.png'));
   const referenced = new Set();
+  const FRAME_STATES = new Set(['idle', 'talking', 'running', 'waiting', 'success', 'sad', 'offline', 'blink']);
+  const frameTable = sprite.frames;
+  const isFramesForm = frameTable !== undefined;
+  if (isFramesForm) {
+    if (!frameTable || typeof frameTable !== 'object' || Array.isArray(frameTable)) {
+      fail('sprite/manifest.json 的 frames 必须是对象');
+    } else {
+      let total = 0;
+      const collect = (state, entry) => {
+        let files = null;
+        if (Array.isArray(entry)) {
+          files = entry;
+        } else if (entry && typeof entry === 'object') {
+          if (Object.keys(entry).some((key) => !['frames', 'ms', 'period_ms', 'hold_ms'].includes(key))) {
+            fail(`sprite/manifest.json 的 frames.${state} 含不支持的字段（只允许 frames/ms/period_ms/hold_ms）`);
+          }
+          if (!Array.isArray(entry.frames)) fail(`sprite/manifest.json 的 frames.${state}.frames 必须是数组`);
+          files = entry.frames || [];
+        } else {
+          fail(`sprite/manifest.json 的 frames.${state} 必须是数组或对象`);
+        }
+        for (const file of files || []) {
+          if (typeof file !== 'string') {
+            fail('sprite/manifest.json 的 frames 素材字段必须是字符串');
+            continue;
+          }
+          referenced.add(file);
+          if (!/^[A-Za-z0-9_-]{1,16}\.png$/i.test(file)) {
+            // 固件把素材平铺缓存在 SPIFFS（对象名上限 32 字符），文件名必须短。
+            fail(`sprite/${file} 文件名不合规：1–16 个字母/数字/下划线/连字符 + .png（总长 ≤20）`);
+          }
+          if (!pngs.includes(file)) fail(`sprite/manifest.json 引用了不存在的 ${file}`);
+        }
+        total += (files || []).length;
+        if (total > 12) fail('sprite/manifest.json 的 frames 总帧数超过 12（设备内存上限）');
+      };
+      for (const [state, entry] of Object.entries(frameTable)) {
+        if (!FRAME_STATES.has(state)) fail(`sprite/manifest.json 的 frames 含未知状态：${state}（可用：idle/talking/running/waiting/success/sad/offline/blink）`);
+        collect(state, entry);
+      }
+      if (!Object.keys(frameTable).length || !frameTable.idle) {
+        fail('sprite/manifest.json 的 frames 至少要声明 idle 轨道（未声明的状态回落到它）');
+      }
+      if (sprite.frame_ms !== undefined && (!Number.isInteger(sprite.frame_ms) || sprite.frame_ms < 30 || sprite.frame_ms > 2000)) {
+        fail('sprite/manifest.json 的 frame_ms 范围 30–2000');
+      }
+    }
+  } else if (!Array.isArray(sprite.layers) || !sprite.layers.length) {
+    fail('sprite/manifest.json 的 layers 必须是非空数组（或改用 frames 整帧状态表）');
+  }
   for (const layer of sprite.layers || []) {
     for (const file of layer.frames || (layer.file ? [layer.file] : [])) {
       if (typeof file !== 'string') {
@@ -212,6 +267,48 @@ export function validatePackage(pkg) {  const errors = [];
     entry = 'theme.json';
     checkTheme(pkg.dir, dir, fail, warn);
     if (!fs.existsSync(path.join(pkg.dir, 'theme.json'))) return { ...empty, installDir: dir };
+  } else if (pkg.kind === 'h5') {
+    entry = 'plugin.json';
+    if (pkg.market.pluginId !== undefined) warn('H5 包不应写 pluginId');
+    const manifestPath = path.join(pkg.dir, 'plugin.json');
+    if (!fs.existsSync(manifestPath)) {
+      fail('H5 包缺少 plugin.json');
+      return { ...empty, installDir: dir };
+    }
+    let manifest = null;
+    try {
+      manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    } catch {
+      fail('plugin.json 不是合法 JSON');
+      return { ...empty, installDir: dir };
+    }
+    if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
+      fail('plugin.json 顶层必须是对象');
+      return { ...empty, installDir: dir };
+    }
+    if (Buffer.byteLength(fs.readFileSync(manifestPath)) > 16 * 1024) fail('plugin.json 超过 16KB');
+    if (manifest.kind !== 'h5') fail(`plugin.json 的 kind 必须是 h5，收到 ${manifest.kind ?? '(空)'}`);
+    if (manifest.id !== pkg.id) fail(`plugin.json 的 id (${manifest.id ?? '(空)'}) 与包 ID ${pkg.id} 不一致`);
+    else if (!PACKAGE_DIR.test(manifest.id)) fail(`plugin.json 的 id ${manifest.id} 不符合命名规则`);
+    const www = typeof manifest.www === 'string' && manifest.www
+      ? (manifest.www.endsWith('/') ? manifest.www : `${manifest.www}/`) : 'www/';
+    if (/(^|\/)\.\.(\/|$)/.test(www) || www.includes('\\') || path.isAbsolute(www) || !/^[A-Za-z0-9_][A-Za-z0-9_/-]*$/.test(www)) {
+      fail(`plugin.json 的 www 目录不安全：${www}`);
+    } else if (!fs.existsSync(path.join(pkg.dir, www, 'index.html'))) {
+      fail(`H5 包缺少入口页 ${www}index.html`);
+    }
+    if (manifest.capabilities !== undefined) {
+      if (!Array.isArray(manifest.capabilities) || manifest.capabilities.length > 8
+        || manifest.capabilities.some((name) => !H5_CAPABILITIES.includes(name))) {
+        fail(`plugin.json 的 capabilities 必须是 ${H5_CAPABILITIES.join(' / ')} 的子集（≤8 项）`);
+      }
+    }
+    const extra = Object.keys(manifest).filter((key) => !['id', 'kind', 'name', 'www', 'capabilities', 'settings'].includes(key));
+    if (extra.length) fail(`plugin.json 含不支持的键：${extra.join(', ')}`);
+    if (manifest.settings !== undefined) {
+      // 设置项规范与助手包同一套（桥接器 parseSettingsSpec 是裁决点）；市场侧用同一解析器预检。
+      parseSettingsSpec({ id: manifest.id, settings: manifest.settings }, fail);
+    }
   } else {
     const source = ['plugin.mjs', 'plugin.js'].find((name) => fs.existsSync(path.join(pkg.dir, name)));
     if (!source) {

package/lib/plugin.mjs

@@ -44,8 +44,10 @@ export function isKnownCommand(name, known) {
   return name.startsWith('action.') || known.includes(name);
 }
 
-/** Event and command names share one shape, mirroring the bridge validator. */
-const NAME = /^[a-z][a-z0-9_]{0,15}(?:\.[a-z][a-z0-9_]{0,15}){0,2}$/;
+/** Event and command names share one shape, mirroring the bridge validator.
+ * Uppercase segments carry the abstract action slots (`action.A1`–`A9`, the
+ * two-level binding model in docs/SPRITES.md); legacy names stay lowercase. */
+const NAME = /^[a-zA-Z][a-zA-Z0-9_]{0,15}(?:\.[a-zA-Z][a-zA-Z0-9_]{0,15}){0,2}$/;
 
 const visible = (value, max) => typeof value === 'string' && value.trim()
   && Buffer.byteLength(value) <= max && !/[\p{Cc}\p{Cf}]/u.test(value);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "made-market",
-  "version": "0.4.3",
+  "version": "0.4.5",
   "description": "码得（made）公开插件市场的命令行工具：列出、搜索、安装主题/管控/agent 包，以及登录后发布新包。市场服务端在 github.com/jobop/made-market 仓库内，不随本包分发。",
   "type": "module",
   "license": "MIT",
@@ -45,4 +45,4 @@
     "prepublishOnly": "cd .. && node tools/validate.mjs && node tools/build.mjs && node --test",
     "prepack": "mkdir -p registry && cp ../registry/index.json registry/index.json"
   }
-}
+}

package/registry/index.json

@@ -7,15 +7,17 @@
   "packageHome": "~/made",
   "packageHomeEnv": "MADE_HOME",
   "counts": {
-    "total": 11,
+    "total": 12,
     "theme": 4,
     "control": 4,
-    "agent": 3
+    "agent": 3,
+    "h5": 1
   },
   "installTargets": {
     "theme": "~/made/themes/",
     "control": "~/made/plugins/",
-    "agent": "~/made/plugins/"
+    "agent": "~/made/plugins/",
+    "h5": "~/made/plugins/"
   },
   "packages": [
     {
@@ -80,7 +82,7 @@
       ],
       "payloadBytes": 209717,
       "archiveBytes": 39822,
-      "sha256": "f99ab016bda97781fba979cf5d31ffec18edf1ea91a2339c1d7e4cf63f36a0a7",
+      "sha256": "b656724a6be3466c0ad52010bfa9f2a3b043595b6b7b6bed90a01bdfcca3ba95",
       "download": "packages/sunset-1.0.0.tar.gz",
       "swatch": [
         "#e0834a",
@@ -153,7 +155,7 @@
       ],
       "payloadBytes": 212917,
       "archiveBytes": 44910,
-      "sha256": "a48c12c45c83185041a25ea0f408f8ce15a1632d4473440a0a1fbc7b5f674cd1",
+      "sha256": "3894aadcfdba77eb351abc4381d3b76141ed0d6a15d8b75a982a64092e1300fa",
       "download": "packages/ocean-1.0.0.tar.gz",
       "swatch": [
         "#2fa3b8",
@@ -226,7 +228,7 @@
       ],
       "payloadBytes": 198517,
       "archiveBytes": 31125,
-      "sha256": "9dd6037414f9303ecc507c4348380baeaf8dd2a97c98c58748410c18b37c014e",
+      "sha256": "ff66fd400882e4ce3017b32782825aca59e60e5a407c793b175d2c4500c1cb97",
       "download": "packages/graphite-1.0.0.tar.gz",
       "swatch": [
         "#8e9aa6",
@@ -299,7 +301,7 @@
       ],
       "payloadBytes": 206517,
       "archiveBytes": 34163,
-      "sha256": "76095ce19587f8e0bc7ba5aeb7ca62f1e622bc8ef14847fdb3479dbf0ea87b29",
+      "sha256": "24dbf64bb96520a16efbfbb553ccff91190ae4fde5b18444f3c6a7ee97b0993f",
       "download": "packages/bamboo-1.0.0.tar.gz",
       "swatch": [
         "#5aa85e",
@@ -367,7 +369,7 @@
       ],
       "payloadBytes": 1576,
       "archiveBytes": 1067,
-      "sha256": "35c4768f607bb936b2e263e972895920c66cce74a8829d944cd86c6d2e5b0030",
+      "sha256": "c3f6afae9ef5f47b622c74c2faf7174ba2ba38a9db2d19651a992874fd6f5f9a",
       "download": "packages/theme-cycler-1.0.0.tar.gz",
       "sourcePath": "packages/control/theme-cycler"
     },
@@ -430,7 +432,7 @@
       ],
       "payloadBytes": 3023,
       "archiveBytes": 1808,
-      "sha256": "0c7c6453b78a76c327282dfd62f6d023e90dc12a2c7458a67b1b43e5e20e15ba",
+      "sha256": "ab7acdc88895a391596182fa9425e1e81d0b7ec5de73c035b9fe0ee2a7a3a123",
       "download": "packages/webhook-notify-1.0.0.tar.gz",
       "sourcePath": "packages/control/webhook-notify"
     },
@@ -492,7 +494,7 @@
       ],
       "payloadBytes": 2370,
       "archiveBytes": 1450,
-      "sha256": "cea53eedab0232272ed6f5ebd5c6b8a7250ff08240fb2d754b16b1e7c9088d7a",
+      "sha256": "43512f16e9559f5984ab9cf827b9b8e0e7c5671bc1cd1cf211adc0b0344e9f37",
       "download": "packages/key-chime-1.0.0.tar.gz",
       "sourcePath": "packages/control/key-chime"
     },
@@ -554,7 +556,7 @@
       ],
       "payloadBytes": 3940,
       "archiveBytes": 1959,
-      "sha256": "bd4c7ae744be6a99dacaf663a0624e61e568f8da5e83566eb104127d39ddf11d",
+      "sha256": "c131b7a0e67a9e0a1e4ab23b9dcf5ec05f7bb73c8b43621fe849c6762009c4e0",
       "download": "packages/alarm-clock-1.0.0.tar.gz",
       "sourcePath": "packages/control/alarm-clock"
     },
@@ -621,7 +623,7 @@
       ],
       "payloadBytes": 3793,
       "archiveBytes": 1612,
-      "sha256": "aaf99b7ab9af49712f9ff5da37695c4d41cf89e09ae6ec5168057dede7075546",
+      "sha256": "7f3d1045be427b2d4cbe0b070cb63ca0fc1fe127c63201f9423f23970d37f736",
       "download": "packages/demo-echo-1.0.0.tar.gz",
       "icon": {
         "format": "indexed4",
@@ -702,7 +704,7 @@
       ],
       "payloadBytes": 6098,
       "archiveBytes": 2672,
-      "sha256": "8da05c474aa4b0d3d8913e16109b0ed887a4bab2d1d136527bb85bd798860cff",
+      "sha256": "0a33b62f6f186a80d370012ddd146f9c504daf182503cc23cb4c13bd9c7e35d3",
       "download": "packages/ollama-agent-1.0.0.tar.gz",
       "icon": {
         "format": "indexed4",
@@ -786,7 +788,7 @@
       ],
       "payloadBytes": 5814,
       "archiveBytes": 2456,
-      "sha256": "12de415fa0bb0bfaa3eb119c5e0930b3d3239836d184eab781dc1b36be93d06a",
+      "sha256": "541eef0c992b636cfe5d0b8f1f03dffa15a58b414f061ed392971bd3723a6c0f",
       "download": "packages/shell-agent-1.0.0.tar.gz",
       "icon": {
         "format": "indexed4",
@@ -807,6 +809,58 @@
         "accent": "#7fe6c4"
       },
       "sourcePath": "packages/agents/shell-agent"
+    },
+    {
+      "id": "demo-hello",
+      "kind": "h5",
+      "version": "1.0.0",
+      "name": "H5 示例页",
+      "nameEn": "H5 hello demo",
+      "summary": "纯静态 H5 插件最小示例：零能力声明，装完在手机上打开一个页面。",
+      "summaryEn": "Minimal static H5 plugin: no capabilities, just a page you open on the phone.",
+      "author": "jobop",
+      "license": "MIT",
+      "tags": [
+        "示例",
+        "H5"
+      ],
+      "glyph": "grid",
+      "highlights": [
+        "零能力声明：不调任何桥接器接口",
+        "H5 插件最小结构参考（market.json + plugin.json + www/）"
+      ],
+      "requires": {
+        "apiVersion": 1
+      },
+      "publishedAt": "2026-11-04",
+      "changelog": [
+        {
+          "version": "1.0.0",
+          "notes": "首个版本",
+          "notesEn": "First release"
+        }
+      ],
+      "dir": "demo-hello",
+      "target": "plugins",
+      "source": "packages/h5/demo-hello",
+      "entry": "plugin.json",
+      "files": [
+        {
+          "path": "plugin.json",
+          "size": 41,
+          "sha256": "a7df7b90150a8b135eecdd5464731a2db0766179a668d514046ab2027438f9aa"
+        },
+        {
+          "path": "www/index.html",
+          "size": 1262,
+          "sha256": "4f375a90122f64a026036de61ce7d71392bc281b81fbf367197876b5694dab7e"
+        }
+      ],
+      "payloadBytes": 1303,
+      "archiveBytes": 1024,
+      "sha256": "537767ee43397e7a7374c952a4d6cc1ade383569a4c0874671b7fa4e5ff0aed1",
+      "download": "packages/demo-hello-1.0.0.tar.gz",
+      "sourcePath": "packages/h5/demo-hello"
     }
   ]
 }

package/src/publish.mjs

@@ -34,7 +34,7 @@ export async function publish(dir, options = {}) {
     throw new Error(`market.json 无法解析：${error.message}`);
   }
   const { kind, id } = market;
-  if (!KINDS[kind]) throw new Error(`market.json 的 kind 必须是 theme / control / agent 之一`);
+  if (!KINDS[kind]) throw new Error(`market.json 的 kind 必须是 theme / control / agent / h5 之一`);
   const pkg = { id, kind, dir: root, market, parseError: '' };
   const validation = validatePackage(pkg);
   if (validation.errors.length) {