[niekcandaele]

Closes #67
Part of gettakaro/takaro#4616

Summary

Turns this repository into a working module registry. A validator and a build produce registry/registry.json and append-only registry/<module>/<version>.json files, CI validates every PR, and merging to main publishes them to GitHub Pages at https://gettakaro.github.io/modules. This reworks #41. Ten modules are published at 1.0.0; the rest are unlisted.

What Changed

• Build and validator (src/registry/*, src/scripts/registry.ts): a pure planRegistry core with thin fs/git loaders. npm run registry:build is all-or-nothing; registry:check [--base <ref>] writes nothing. --root <dir> lets community registries validate their own checkout.
• Formats (schema/*.schema.json, docs/registry-format.md): schemas for module.json, registry.config.json, registry.json and version files. module.json gains optional defaultSystemConfig (now emitted), summary and minTakaroVersion.
• Published tree (registry/): committed, generated. 10 modules at 1.0.0: afk-kick, community-fund, discord-status-bridge-7d2d, kill-tracker, mini-games, playtime-buff-rewards, referral-program, server-toolkit (was utils), vote-restart, zombie-racing.
• Unlisted (registry.config.json): hello-world (example), teleports, lottery, daily-rewards, server-messages (superseded), casino, buff-manager (held until tested).
• Renames/metadata: test- prefixes dropped, versions set to 1.0.0, utils -> server-toolkit (from Turn this repo into the first subscribable Takaro module registry #41), discord-7d2d-status-bridge -> discord-status-bridge-7d2d, BuffManager -> buff-manager (role UUID replaced by <role-id>), mini-games documents its opentdb.com dependency, zombie-racing gets a summary.
• CI: ci.yml runs registry:check with the base comparison; new publish.yml deploys registry/ and schema/ to Pages on push to main. No secrets.
• module-to-json is now a thin CLI over buildModuleExport; validateEntityName throws instead of exiting.

Contract for takaro#4622 / #4624 / #4625

registry.json keeps versions: string[] (current Takaro validates it and strips unknown keys) and adds a sibling versionDetails[] per version: sha256, optional minTakaroVersion, requiredCapabilities (informational). sha256 is the SHA-256 of the exact served bytes of the version file, so Takaro must hash the raw response body. Entries are frozen once published. Manifest descriptions are at most 500 characters (module summary else description).

{ "schemaVersion": 1, "name": "Takaro Official Registry",
  "modules": [ { "name": "afk-kick", "description": "...", "latestVersion": "1.0.0",
    "versions": ["1.0.0"],
    "versionDetails": [ { "version": "1.0.0", "sha256": "<64 hex>", "requiredCapabilities": ["chat.send", "moderation.kick"] } ] } ] }

Reviewer Guide

• Start here: src/registry/plan.ts (the rules), then docs/registry-format.md.
• Pay attention to: append-only enforcement (source vs published bytes, plus --base comparison in compare-base.ts); the publish.yml Pages actions use the newest majors (configure-pages@v6, upload-pages-artifact@v5, deploy-pages@v5), which can only be exercised by a push to main.
• Design decision: the committed registry/ is the history. CI only verifies and deploys; it never writes back, so no tokens are needed and fork PRs work.
• Deviation from the plan: .gitattributes marks images under modules/ binary (modules/** text eol=lf would renormalize a screenshot) and pins test/fixtures/** to LF. The mini-games description was tightened to fit the 500 character limit instead of adding a summary.

Testing Plan

Happy Path

• npm ci && npm run build && npm run typecheck && npm test passes (69 tests).
• npm run registry:check -- --base origin/main exits 0; npm run registry:build prints "Nothing to add".
• jq -r '.modules[].name' registry/registry.json lists exactly the 10 modules above.
• After merge, curl -sSfI https://gettakaro.github.io/modules/registry.json returns 200 with no redirect, and the sha256 of afk-kick/1.0.0.json equals the manifest value.

Edge Cases

• Edit a line in modules/afk-kick/src/** without bumping: registry:build fails naming afk-kick@1.0.0 and writes nothing.
• Bump to 1.0.1 and rebuild: registry/afk-kick/1.0.1.json is added, 1.0.0.json is unchanged.
• Hand-edit a published file: registry:check fails on the sha256, and --base reports the modified file.

Regression Checks

• npm run module:to-json -- modules/zombie-racing still works and now includes defaultSystemConfig, tag 1.0.0.
• git grep -n 'secrets\.' .github prints nothing.

Not covered here

• GitHub Pages was enabled for this repo (build source: GitHub Actions) with gh api -X POST repos/gettakaro/modules/pages -f build_type=workflow. No CNAME (takaro#4635).
• The live Takaro dev-environment subscribe/install check and the post-merge checks (Publish run, URL, installing afk-kick) are still to do. Turn this repo into the first subscribable Takaro module registry #41 should be closed after merge.
• repository_dispatch on publish is takaro#4630 / static-sites#29.
• Follow-up: mark the repo as a GitHub template (a repo setting, not changed here).
• Once registry.takaro.io is the Pages custom domain, gettakaro.github.io/modules redirects, and Takaro (maxRedirects: 0) must subscribe to the custom domain (takaro#4623, #4635).