made-market 0.4.4 → 0.4.6

package/lib/market.mjs

@@ -29,10 +29,16 @@ export const KINDS = Object.freeze({
   theme: { source: 'themes', target: 'themes', label: '主题', labelEn: 'Theme', icon: 'theme' },
   control: { source: 'control', target: 'plugins', label: '管控', labelEn: 'Control', icon: 'control' },
   agent: { source: 'agents', target: 'plugins', label: 'agent 运行时', labelEn: 'Agent runtime', icon: 'agent' },
+  h5: { source: 'h5', target: 'plugins', label: 'H5 应用', labelEn: 'H5 app', icon: 'grid' },
 });
 
-export const KIND_ORDER = Object.freeze(['theme', 'control', 'agent']);
+export const KIND_ORDER = Object.freeze(['theme', 'control', 'agent', 'h5']);
 export const PLUGIN_KINDS = Object.freeze({ control: 'board-plugin', agent: 'coding-agent' });
+
+/** H5 插件能力白名单（与桥接器 h5-apps.mjs 同名单：桥接器是裁决点，市场只做预检）。 */
+export const H5_CAPABILITIES = Object.freeze([
+  'state.read', 'tasks.read', 'tasks.write', 'sessions.read', 'sessions.write', 'settings.read',
+]);
 const PAYLOAD_IGNORED = new Set(['market.json']);
 
 export const sha256 = (buffer) => crypto.createHash('sha256').update(buffer).digest('hex');
@@ -162,11 +168,60 @@ function validateSpriteDir(dir, fail, warn) {
   if (!Number.isInteger(sprite.version) || sprite.version < 1) {
     fail('sprite/manifest.json 的 version 必须是 ≥1 的整数（改素材必须递增，否则设备不更新）');
   }
-  if (!Array.isArray(sprite.layers) || !sprite.layers.length) {
-    fail('sprite/manifest.json 的 layers 必须是非空数组');
-  }
+  // 两种素材形态二选一（与桥接器 agent-sprites.mjs validateFramesTable 同规则）：
+  // frames 整帧状态表（新，推荐）— 有它就不需要 layers；layers 分层叠加（老）。
   const pngs = fs.readdirSync(spriteDir).filter((name) => name.endsWith('.png'));
   const referenced = new Set();
+  const FRAME_STATES = new Set(['idle', 'talking', 'running', 'waiting', 'success', 'sad', 'offline', 'blink']);
+  const frameTable = sprite.frames;
+  const isFramesForm = frameTable !== undefined;
+  if (isFramesForm) {
+    if (!frameTable || typeof frameTable !== 'object' || Array.isArray(frameTable)) {
+      fail('sprite/manifest.json 的 frames 必须是对象');
+    } else {
+      let total = 0;
+      const collect = (state, entry) => {
+        let files = null;
+        if (Array.isArray(entry)) {
+          files = entry;
+        } else if (entry && typeof entry === 'object') {
+          if (Object.keys(entry).some((key) => !['frames', 'ms', 'period_ms', 'hold_ms'].includes(key))) {
+            fail(`sprite/manifest.json 的 frames.${state} 含不支持的字段（只允许 frames/ms/period_ms/hold_ms）`);
+          }
+          if (!Array.isArray(entry.frames)) fail(`sprite/manifest.json 的 frames.${state}.frames 必须是数组`);
+          files = entry.frames || [];
+        } else {
+          fail(`sprite/manifest.json 的 frames.${state} 必须是数组或对象`);
+        }
+        for (const file of files || []) {
+          if (typeof file !== 'string') {
+            fail('sprite/manifest.json 的 frames 素材字段必须是字符串');
+            continue;
+          }
+          referenced.add(file);
+          if (!/^[A-Za-z0-9_-]{1,16}\.png$/i.test(file)) {
+            // 固件把素材平铺缓存在 SPIFFS（对象名上限 32 字符），文件名必须短。
+            fail(`sprite/${file} 文件名不合规：1–16 个字母/数字/下划线/连字符 + .png（总长 ≤20）`);
+          }
+          if (!pngs.includes(file)) fail(`sprite/manifest.json 引用了不存在的 ${file}`);
+        }
+        total += (files || []).length;
+        if (total > 12) fail('sprite/manifest.json 的 frames 总帧数超过 12（设备内存上限）');
+      };
+      for (const [state, entry] of Object.entries(frameTable)) {
+        if (!FRAME_STATES.has(state)) fail(`sprite/manifest.json 的 frames 含未知状态：${state}（可用：idle/talking/running/waiting/success/sad/offline/blink）`);
+        collect(state, entry);
+      }
+      if (!Object.keys(frameTable).length || !frameTable.idle) {
+        fail('sprite/manifest.json 的 frames 至少要声明 idle 轨道（未声明的状态回落到它）');
+      }
+      if (sprite.frame_ms !== undefined && (!Number.isInteger(sprite.frame_ms) || sprite.frame_ms < 30 || sprite.frame_ms > 2000)) {
+        fail('sprite/manifest.json 的 frame_ms 范围 30–2000');
+      }
+    }
+  } else if (!Array.isArray(sprite.layers) || !sprite.layers.length) {
+    fail('sprite/manifest.json 的 layers 必须是非空数组（或改用 frames 整帧状态表）');
+  }
   for (const layer of sprite.layers || []) {
     for (const file of layer.frames || (layer.file ? [layer.file] : [])) {
       if (typeof file !== 'string') {
@@ -212,6 +267,48 @@ export function validatePackage(pkg) {  const errors = [];
     entry = 'theme.json';
     checkTheme(pkg.dir, dir, fail, warn);
     if (!fs.existsSync(path.join(pkg.dir, 'theme.json'))) return { ...empty, installDir: dir };
+  } else if (pkg.kind === 'h5') {
+    entry = 'plugin.json';
+    if (pkg.market.pluginId !== undefined) warn('H5 包不应写 pluginId');
+    const manifestPath = path.join(pkg.dir, 'plugin.json');
+    if (!fs.existsSync(manifestPath)) {
+      fail('H5 包缺少 plugin.json');
+      return { ...empty, installDir: dir };
+    }
+    let manifest = null;
+    try {
+      manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
+    } catch {
+      fail('plugin.json 不是合法 JSON');
+      return { ...empty, installDir: dir };
+    }
+    if (!manifest || typeof manifest !== 'object' || Array.isArray(manifest)) {
+      fail('plugin.json 顶层必须是对象');
+      return { ...empty, installDir: dir };
+    }
+    if (Buffer.byteLength(fs.readFileSync(manifestPath)) > 16 * 1024) fail('plugin.json 超过 16KB');
+    if (manifest.kind !== 'h5') fail(`plugin.json 的 kind 必须是 h5，收到 ${manifest.kind ?? '(空)'}`);
+    if (manifest.id !== pkg.id) fail(`plugin.json 的 id (${manifest.id ?? '(空)'}) 与包 ID ${pkg.id} 不一致`);
+    else if (!PACKAGE_DIR.test(manifest.id)) fail(`plugin.json 的 id ${manifest.id} 不符合命名规则`);
+    const www = typeof manifest.www === 'string' && manifest.www
+      ? (manifest.www.endsWith('/') ? manifest.www : `${manifest.www}/`) : 'www/';
+    if (/(^|\/)\.\.(\/|$)/.test(www) || www.includes('\\') || path.isAbsolute(www) || !/^[A-Za-z0-9_][A-Za-z0-9_/-]*$/.test(www)) {
+      fail(`plugin.json 的 www 目录不安全：${www}`);
+    } else if (!fs.existsSync(path.join(pkg.dir, www, 'index.html'))) {
+      fail(`H5 包缺少入口页 ${www}index.html`);
+    }
+    if (manifest.capabilities !== undefined) {
+      if (!Array.isArray(manifest.capabilities) || manifest.capabilities.length > 8
+        || manifest.capabilities.some((name) => !H5_CAPABILITIES.includes(name))) {
+        fail(`plugin.json 的 capabilities 必须是 ${H5_CAPABILITIES.join(' / ')} 的子集（≤8 项）`);
+      }
+    }
+    const extra = Object.keys(manifest).filter((key) => !['id', 'kind', 'name', 'www', 'capabilities', 'settings'].includes(key));
+    if (extra.length) fail(`plugin.json 含不支持的键：${extra.join(', ')}`);
+    if (manifest.settings !== undefined) {
+      // 设置项规范与助手包同一套（桥接器 parseSettingsSpec 是裁决点）；市场侧用同一解析器预检。
+      parseSettingsSpec({ id: manifest.id, settings: manifest.settings }, fail);
+    }
   } else {
     const source = ['plugin.mjs', 'plugin.js'].find((name) => fs.existsSync(path.join(pkg.dir, name)));
     if (!source) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "made-market",
-  "version": "0.4.4",
+  "version": "0.4.6",
   "description": "码得（made）公开插件市场的命令行工具：列出、搜索、安装主题/管控/agent 包，以及登录后发布新包。市场服务端在 github.com/jobop/made-market 仓库内，不随本包分发。",
   "type": "module",
   "license": "MIT",

package/registry/index.json

@@ -7,15 +7,17 @@
   "packageHome": "~/made",
   "packageHomeEnv": "MADE_HOME",
   "counts": {
-    "total": 11,
+    "total": 12,
     "theme": 4,
     "control": 4,
-    "agent": 3
+    "agent": 3,
+    "h5": 1
   },
   "installTargets": {
     "theme": "~/made/themes/",
     "control": "~/made/plugins/",
-    "agent": "~/made/plugins/"
+    "agent": "~/made/plugins/",
+    "h5": "~/made/plugins/"
   },
   "packages": [
     {
@@ -807,6 +809,58 @@
         "accent": "#7fe6c4"
       },
       "sourcePath": "packages/agents/shell-agent"
+    },
+    {
+      "id": "demo-hello",
+      "kind": "h5",
+      "version": "1.0.0",
+      "name": "H5 示例页",
+      "nameEn": "H5 hello demo",
+      "summary": "纯静态 H5 插件最小示例：零能力声明，装完在手机上打开一个页面。",
+      "summaryEn": "Minimal static H5 plugin: no capabilities, just a page you open on the phone.",
+      "author": "jobop",
+      "license": "MIT",
+      "tags": [
+        "示例",
+        "H5"
+      ],
+      "glyph": "grid",
+      "highlights": [
+        "零能力声明：不调任何桥接器接口",
+        "H5 插件最小结构参考（market.json + plugin.json + www/）"
+      ],
+      "requires": {
+        "apiVersion": 1
+      },
+      "publishedAt": "2026-11-04",
+      "changelog": [
+        {
+          "version": "1.0.0",
+          "notes": "首个版本",
+          "notesEn": "First release"
+        }
+      ],
+      "dir": "demo-hello",
+      "target": "plugins",
+      "source": "packages/h5/demo-hello",
+      "entry": "plugin.json",
+      "files": [
+        {
+          "path": "plugin.json",
+          "size": 41,
+          "sha256": "a7df7b90150a8b135eecdd5464731a2db0766179a668d514046ab2027438f9aa"
+        },
+        {
+          "path": "www/index.html",
+          "size": 1262,
+          "sha256": "4f375a90122f64a026036de61ce7d71392bc281b81fbf367197876b5694dab7e"
+        }
+      ],
+      "payloadBytes": 1303,
+      "archiveBytes": 1024,
+      "sha256": "537767ee43397e7a7374c952a4d6cc1ade383569a4c0874671b7fa4e5ff0aed1",
+      "download": "packages/demo-hello-1.0.0.tar.gz",
+      "sourcePath": "packages/h5/demo-hello"
     }
   ]
 }

package/src/account.mjs

@@ -83,8 +83,8 @@ export async function login({ server, name, password, home = '' }) {
 
 export async function whoami({ server, home = '', token = '' } = {}) {
   const creds = loadCredentials(home);
-  const base = (server || creds?.server || '').replace(/\/+$/, '');
-  const bearer = token || creds?.token || '';
+  const base = (server || process.env.MADE_MARKET_SERVER || creds?.server || '').replace(/\/+$/, '');
+  const bearer = token || process.env.MADE_MARKET_TOKEN || creds?.token || '';
   if (!base || !bearer) throw new Error('还没登录过：先 npx made-market login <用户名> --server <服务地址>');
   const response = await fetch(`${base}/api/me`, { headers: { authorization: `Bearer ${bearer}` }, signal: AbortSignal.timeout(15000) });
   const data = await response.json().catch(() => ({}));

package/src/publish.mjs

@@ -34,7 +34,7 @@ export async function publish(dir, options = {}) {
     throw new Error(`market.json 无法解析：${error.message}`);
   }
   const { kind, id } = market;
-  if (!KINDS[kind]) throw new Error(`market.json 的 kind 必须是 theme / control / agent 之一`);
+  if (!KINDS[kind]) throw new Error(`market.json 的 kind 必须是 theme / control / agent / h5 之一`);
   const pkg = { id, kind, dir: root, market, parseError: '' };
   const validation = validatePackage(pkg);
   if (validation.errors.length) {