0.3.0 teaches the provider to report where a game is installed. Each exported
entry now carries `detect: { install_dir }` when Playnite knows one, which is
what lets the host recognize a title's process after Playnite's launcher hands
off and exits — the case where the host would otherwise lose the game the
moment the shim returns, and end the session with it.
The published delta is exactly that, and nothing else:
* `installDir` added to the exported-game schema (nullable, defaults null),
threaded into the entry as `detect.install_dir` when non-blank.
* `@punktfunk/plugin-kit` ^0.1.4 -> ^0.2.0.
* The version bump, embedded in both bundles.
The console UI rebuilt because plugin-kit moved, but did not change: the diff
against 0.2.0's chunk is minifier identifier churn (`Rt`->`kt`, `ar`->`lr`)
with zero prose added or removed, so there is no new user-visible text and no
new behaviour. Fonts and CSS are byte-identical.
No new outbound hosts. Every absolute URL in the tarball is a schema/XML
namespace, the plugin's own homepage and registry, or an effect/react error-doc
link — no telemetry, no beaconing. No install lifecycle scripts (`prepublishOnly`
is author-side and unchanged). No `eval`, `new Function`, or `child_process` in
any bundle.
minHost stays 0.15.0. The new `detect` key is additive and optional on the host
side (`#[serde(default)]`, and the host denies no unknown fields), so 0.3.0 on a
pre-`detect` host simply behaves like 0.2.0 rather than failing to ingest.
Integrity was fetched from the registry and independently recomputed from the
downloaded tarball; both agree.
Both entries were stale — the index still pinned rom-manager 0.3.1 and
playnite 0.1.1 while the registry had moved on.
rom-manager 0.3.2 is a bug-fix release: the API encoded absent optional fields
as `null`, which the UI's own decoder then rejected, so the Overview page broke
on a never-synced host and the Emulators page's Detect button broke on any box
with an emulator installed. The published delta is exactly that fix plus the
version bump — no new files, no new outbound hosts.
playnite 0.2.0 is a ground-up rewrite onto @punktfunk/plugin-kit: three
workspaces, a three-page console UI, per-game include/exclude overrides, and an
allow-listed cover-art proxy. Behaviour that matters is preserved verbatim — the
ingest inbox is still read first, the art modes are unchanged, and launches
still hand back to Playnite. The bundled C# exporter is untouched (same wire
schema), so an installed .pext keeps working.
Also: playnite's card icon now matches the icon the plugin registers for its own
console nav entry (`library-big`), and both descriptions mention the console UI.
minHost stays 0.15.0 for both — neither release needs anything newer from the
host than the plugin-UI surface and the ingest inbox already provide.
The catalog the Punktfunk plugin store fetches. Served straight out of this
repository over Gitea's anonymous raw endpoint:
https://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.jsonhttps://git.unom.io/unom/punktfunk-plugin-index/raw/branch/main/v1/index.json.sig
Hosts verify the ed25519 signature against a compiled-in public key and only
then parse. Verified that the raw endpoint serves blobs byte-for-byte, which
the signature depends on; .gitattributes pins LF so a Windows checkout cannot
break it from the other direction.
Entries pin one exact version plus that version's registry tarball integrity
hash -- no ranges, no "latest". A plugin author publishing a new version
changes nothing for users; the new version becomes installable only when a
reviewer works the checklist and lands a new pinned entry here. That data
shape is what makes "verified on every release" enforceable rather than a
promise.
Seeded with the two first-party plugins, both integrity hashes confirmed
against the live registry:
- @punktfunk/plugin-rom-manager 0.3.1 (linux, windows)
- @punktfunk/plugin-playnite 0.1.1 (windows)
Tooling (bun + TypeScript, node builtins only):
- validate: every field rule the host enforces, plus a live registry
cross-check that the pinned version exists and its dist.integrity matches
the pin. Strict on unknown keys, since the host silently drops entries
that fail validation -- a `min_host` typo would otherwise ship as a
missing version floor with no error anywhere.
- sign / verify / keygen: ed25519 over the exact bytes of index.json.
keygen never prints the private key; verify defaults to the host-pinned
public key so an index can be audited with no arguments.
CI splits by trust: pull requests run validate only and hold no secrets, so a
fork PR can never reach the signing key or a token that can write to main.
Publishing from main validates, signs, self-verifies, then commits the
signature back. The loop guard is a paths-ignore filter on v1/index.json.sig,
with a [skip ci] marker as a second line of defence; ed25519 determinism means
an unchanged index re-signs to identical bytes and commits nothing at all.
CI signs after the merge, so there is a brief window where index.json is newer
than its signature. It fails closed -- hosts reject the document and keep
their last good cached catalog -- and is documented as such in the README.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
enricobuehler
enricobuehlerandClaude Fable 5