just_core_cli 0.1.2

The core of `just` (also `ju`), the Just ecosystem's command-line tool: projects, plugins and hooks, version sets, safe pubspec edits, transactions and downloads.

0.1.2

• Parts of a file. HttpFetcher.get(range: ByteRange(start, end)) (or ByteRange.suffix(n)) asks for part of a file and accepts only a 206 holding exactly that part, as its Content-Range says (FetchResponse.range); a server that sends the whole file instead is refused before its body is read.
• Reading a zip's directory alone. ZipDirectory.fetch reads an archive's end record and central directory through any byte reader — HTTP ranges, say — with every rule of ZipArchive.read that needs only the directory; readContent then fetches and unpacks one file, its local header checked against the directory. ZipNeedsBytes says which bytes are missing. ZipArchive.read is unchanged.
• HashedFiles: files named by their SHA-256 in one folder, checked again on every read; DownloadCache.archives is one.
• getCached's decode may be asynchronous; canonicalJson(pretty: false) writes one line.
• A deadline on every fetch. HttpFetcher.get stops once the whole fetch — retries, their waits and redirects included — takes longer than deadline, by default two minutes plus the limit's size at 32 KiB a second (HttpFetcher.deadlineFor): a server that sends a byte now and then can't hold a download open for ever. ByteRange.length.
• Store plugins aren't checkouts. A path package the Asset Store copied in as a community item (just_store.lock.json doesn't record it official) is a store source, not the ecosystem's, whatever its name: it asks before it runs. When the store's lockfile can't be read, everything in plugins/ and packages/ asks. PluginFinder.storeInstalled.
• PackageGraph has a public constructor.
• Checkouts in several folders. just dev link takes one or more folders (just dev link ../packages ../plugins), and just create --local may be given more than once, so a workspace can keep its pub.dev packages and its store plugins apart. Each folder goes to the kind's create hook as its own --local=…. A package checked out in two of the folders is refused, naming both, before anything changes. DevLinks.scanAll and DevLinkClash are the library side.
• PluginTrust.official no longer lists just_asset_store_editor: the package is retired (the Asset Store's window is part of just_game_engine_editor from 0.1.0-dev.2), and a package published under its name now is asked about like any other.
• PluginTrust.official lists the ecosystem's packages it was missing: just_box_2d, just_editor_core, just_material_editor and just_world_builder_kit. From a local checkout or the ecosystem's repositories they run without asking, as the others do.

0.1.1

• just_asset_store from pub.dev is the ecosystem's own. PluginTrust.onPubDev lists it: just runs the Asset Store's commands from a pub.dev install without asking, as it does just_game_engine_cli's. It is published right after this release.
• PluginTrust.official no longer lists just_graphics_editor: the package is retired (editing 3D graphics is just_game_engine_editor's own), and a package published under its name now is asked about like any other.
• Crash recovery stays in the project. ProjectTransaction.recover refuses a journal that names a file or folder outside the project (or the project folder itself), a backup copy outside its backup/ folder, or a folder waiting aside outside its change's folder: a journal is a file in the project, and whatever could write one could otherwise make the next recovery delete or overwrite what it named. The journal is reported as unreadable, with where its backups are, and nothing is touched.
• Names Windows can't have. PackageNames.idProblem and PackageNames.isCategory refuse Windows's device names (con, prn, aux, nul, com0–com9, lpt0–lpt9): ids and categories become folder names. PackageNames.isWindowsDevice says whether a name is one.
• Pubspecs read in linear time. A dependency written {path: …} is read in one pass: a long line no longer costs the square of its length.

0.1.0

The first release of the core of just (and ju, the same tool for machines where just is another program), the Just ecosystem's command-line tool, for Windows, macOS and Linux. It knows no product of its own; the Just Game Engine's commands come from the just_game_engine_cli plugin.

• Projects: create makes a project of a kind (--kind game, the default): flutter create, just.json, just_core_cli and the kind's plugin as one-line dev dependencies on pub.dev versions (--local writes them all the same, and adds pubspec_overrides.yaml entries pointing every just_* package in that folder at its checkout), then the plugin's create hook fills it in. On a failure the folder is deleted when create made it, or emptied when it was there already, empty. doctor checks the tool on the PATH, Flutter, the tools' versions, just.json, links and git ignores, then runs each plugin's doctor hook; check runs their check hooks, and fails when nothing was checked; dev link|unlink points a project at local checkouts, with each plugin's link hook after a link and before and after an unlink.
• Upgrades: upgrade moves the tools to this release's tool set (2026.10), each plugin's packages through its upgrade hook, with pub get, in one transaction — asking each migrate hook with --check before anything changes and again with the new packages before it commits — then runs the migrations (anything after -- goes to them). Up to date when nothing would move.
• Plugins: packages add commands through just_plugin.json, from the project or installed globally, and hook into create, check, doctor, upgrade, migrate and link. The ecosystem's own run without asking when they come from a local checkout or github.com/just-unknown-dev, and from pub.dev only under the names the ecosystem publishes there (PluginTrust.onPubDev: just_game_engine_cli, published right after this release); any other asks once, the answer kept in the project's just.json or the user's plugins.json (which covers every project), and --yes never allows one. A hook that can't --check exits 2 or 64 and is warned about. With --json, a hook's own document is part of the result; upgrade hooks always get --json. Options reach hooks before any --, values as --name=value. just help <a plugin's command> is the plugin's own help.
• Pinning: a global just hands a run to the version the project pins in its dev dependencies.
• Scripts: every command takes --json, --yes, --verbose and --project (before any --). Exit codes: 0 done; 1 failed — a change is rolled back first, and a rollback that fails itself is named and finished by the next change; a failed migration after upgrade, or a failed link hook after dev link|unlink, exits 1 with the change kept; 2 called wrongly. A plugin's command, or a run handed to the pinned just, exits with that process's code (128 + the signal for one a signal ended).
• Every platform: the toolkit in package:just_core_cli/just_core_cli.dart — JSON, versions, SHA-256, ZIP read and write in memory, pubspec edits, templates, version sets, just.json, plugin manifests — runs on the web too, as JavaScript and as WebAssembly; there the library holds only the toolkit, and the command framework is exported everywhere else. project.dart and fetch.dart need dart:io.
• The toolkit plugins build on: the command framework, runTrustedPlugin, Finding and PluginManifest; just.json, which keeps every key it doesn't know as it was; PackageSet and the ToolSet; template filling (TemplateRenderer, ProjectNames, GitIgnores); pubspec edits that keep every other byte, inside the block each tool names (PubspecEditor, ManagedBlock, PubspecConstraints); all-or-nothing project changes that keep permissions and symbolic links (and never write through one that leads out of the project), with a lock (taken over at once from a crashed process on the same machine and system) and crash recovery, whose trash is .just_trash/<tool>/ unless the tool names its own; pub and the Flutter SDK (FLUTTER_ROOT first, then the project's last, then flutter on the PATH, a snap's included); HTTPS-only downloads (redirects included) pinned by size and SHA-256; ZIP reading that refuses unsafe archives, and reproducible ZIP writing.