字节码文件后缀 .bin 改为 .jsb（tinyui 0.9.0）

[HarlonWang]

与 tiny-ui/tinyui#29 同步：manifest 派生的页面文件路径由 <files[module]>.bin 改为 <files[module]>.jsb，上传校验、发布前核对、测试与 README 随之。

• 已存储的旧版本按路径原样投递，不受影响
• 部署后只有 tinyui-cli 0.9 起能发新包；旧 CLI 上传的 .bin 会被判为缺文件
• pnpm typecheck 与 pnpm test（22 个用例）全绿

🤖 Generated with Claude Code

Summary by Sourcery

Adopt the .jsb suffix for manifest-derived page bytecode assets while preserving delivery of previously stored versions.

Enhancements:

• Change manifest-derived page asset paths from the .bin suffix to .jsb throughout validation, upload, publication checks, and delivery.

Documentation:

• Update English and Chinese README path documentation to describe page assets with the .jsb suffix.

Tests:

• Update publishing and delivery tests and fixtures to cover .jsb page assets.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

本 PR 将 manifest 派生的页面字节码文件后缀从 .bin 迁移为 .qjsb，同步更新服务端路径派生与校验、发布测试夹具及中英文文档；旧版本已存储对象仍按原路径兼容投递，而新包发布要求上传 .qjsb 文件。

Sequence diagram for qjsb package publishing and legacy delivery

sequenceDiagram
    participant CLI as tinyui-cli
    participant Server as PackageServer
    participant Storage as ObjectStorage

    CLI->>Server: upload .qjsb page files
    Server->>Server: parseManifest
    Server->>Server: payload
    Server->>Server: isObjectPath
    Server->>Storage: store new version with .qjsb paths
    Note over Storage,Server: Existing versions keep their stored .bin paths
    CLI->>Server: request published version
    Server->>Storage: deliver stored paths unchanged
    Storage-->>CLI: page bytecode

Loading

File-Level Changes

Change	Details	Files
将 manifest 派生的页面字节码路径统一从 .bin 切换为 .qjsb。	更新 payload 生成和 manifest 路径校验逻辑，使页面文件使用 .qjsb。 保留已存储旧版本的原始路径投递行为；新版本发布校验仅接受 manifest 派生的 .qjsb 文件。	src/manifest.ts src/ids.ts
同步测试夹具与发布流程测试，覆盖新后缀下的上传、校验、发布、读取和路径安全行为。	将测试包默认文件、哈希计算、上传请求及断言全部迁移至 .qjsb。 继续验证缺文件、篡改、幂等上传、不可变性、大小限制、并发竞争和路径穿越等行为。	test/helpers.ts test/publish.test.ts
更新中英文文档中的不可变包内容路径说明。	将页面文件示例从 pages/**/*.bin 改为 pages/**/*.qjsb。	README.md README.zh-CN.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 139b7b88-0b68-43a3-abbb-136a466e20cd

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codeseerbot]

CodeSeer 审查

结论：批准

摘要

本次改动将由 manifest 的 files 派生出的页面产物后缀统一从 .bin 切换为 .qjsb，并同步更新了校验、测试辅助代码和中英文文档。现有代码中发布前完整性核对通过 payload() 使用新后缀，而内容读取仍按请求路径进行，不会改变已存储对象的路径。给出的改动范围内未发现会导致错误行为的问题。

_{整个 PR 至 375d00d · gpt-5.6-terra}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	tinyui-updates	cfd8f9c	Oct 07 2026, 04:15 AM

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="test/publish.test.ts" line_range="96" />
<code_context>
         expect(again.status).toBe(200);
         expect(await again.json()).toMatchObject({ existing: true });
-        const other = await request(`/${app}/${pkg}/1/${p.version}/pages/home.bin`, { method: "PUT", token, body: "something else" });
+        const other = await request(`/${app}/${pkg}/1/${p.version}/pages/home.qjsb`, { method: "PUT", token, body: "something else" });
         expect(other.status).toBe(409);
-        const tooBig = await request(`/${app}/${pkg}/1/${p.version}/pages/big.bin`, { method: "PUT", token, body: new Uint8Array(1048577) as BodyInit });
</code_context>
<issue_to_address>
**Unauthenticated uploads fail assertions**

When the test reaches the two PUT requests, `keeps a version immutable` sends the PUTs at lines 96 and 98 without a token, so the upload route returns 401 before checking immutable content or size; the test expects 409 and 413, and fails.

Pass `token` in both request options so the route reaches the immutability and size checks.

Also at `test/publish.test.ts:99`.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 1 finding to address first, and changing the artifact suffix changes the package protocol: clients or tooling still requesting .bin will fail to fetch newly published pages, while .qjsb objects and caches can outlive a revert. The impact is bounded and can be repaired by republishing compatible artifacts or clearing affected versions, but reverting alone does not undo already uploaded or cached files.

Blocking findings: test/publish.test.ts:96

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[codeseerbot]

CodeSeer 审查

结论：批准

摘要

本次增量将 manifest 派生的页面产物后缀从 .qjsb 统一改为 .jsb，并同步更新了路径校验、测试辅助代码、发布/投递测试及双语 README。payload()、manifest 路径校验和测试生成的文件名保持一致，未发现由此次增量引入的逻辑或兼容性问题。

_{增量 375d00d..cfd8f9c · gpt-5.6-terra}