It depends on what "safe" means. If you're including API keys to paid services then no, storing them in any local file or localStorage is not good practice and is very insecure even if encrypted, but if by "safe" you're asking if a malicious actor could harm the user in any way if they could access and decrypt your license key the short answer is no. At most, all that would happen is a lazily cracked version of your extension might be available online -- but if I wanted to do that, I'd just strip out the code in your extension that checks for licensing to begin with then resign and redistribute it as a ZXP to skip the licensing part entirely and unfortunately, no amount of security measures would prevent that due to how relaxed CEP is with self-signed certificates.   If I were a malicious actor looking to redistribute your extension with extra code that modifies the user filesystem then your manner of licensing is completely irrelevant regardless of the depth of your security measures from code visibility alone. All it would take is someone who knows what they're doing committing to the time and effort it would take to just erase whatever lines of code you're using to authenticate a license or make requests to bypass this issue, and though it's not an inevitably that's going to happen, taking too many steps trying to prevent it will end up being a sunken cost in my opinion. Either they have the skill (and you can't stop them anyway) or they don't, and either something like this will happen or it won't. Have decent SEO to appear above any redistribution on search engine results and that catches 99% of potential users finding that redistributed version to begin with. As someone who's made a variety of CEP extensions some of which for large clients with a combined userbase of over 20K licenses, it's never happened to mine, at least that I know of.   There are plenty of online resources about "API key provisioning" (exact phrase for ease of googling for you) that address and discuss this along with best practices for security, but it becomes a manner of scale and if I'm honest, I don't think any CEP extension merits the college education level of knowledge needed for perfect security. The Goldilocks Zone between simple and secure is something like this:   A handshake with an external broker like AWS Secrets Manager under a whitelisted domain/source, or in your case a License Manager with a very similar flow using "forward secrecy" concepts (key exchanges are based on temporary keys which lead to a sensitive key) -- your extension is the whitelisted source, the key is stored externally on the server of the manager, extension makes a request with some manner of token, if that request is validated correctly the manager sends the license key in request response, your extension now knows it's legitimately licensed via response. You'd be storing tokens in localStorage instead of license keys directly and can set these to expire after arbitrary lengths, but details on tokens themselves / how to generate or validate would depend on the specific manager or platform. Using Proof Key for Code Exchange (PKCE) or equivalent in requests that require API access with paid rates when possible.   In my opinion, any obstacle is enough to discourage 90%. SHA-256 with some hidden salt could be plenty to store your license in localStorage since most likely will never get beyond that point. If it's your first extension or your first serious extension, it's hard not to have ideas like this -- "I want to prevent people from stealing my work", "I don't want to miss out on any paying customers" -- and so on, but the market is small and niche. Your target market are professional artists who are used to paying for SaaS solutions and other means of improving their production. Focusing too much on things like this can just be a distraction from a worried and anxious inner mind and in reality, won't make much meaningful difference unless your extension is successful enough to sell several hundreds or thousands of licenses to begin with. If the extension isn't 100% done in every other aspect, then there's more pressing work to attend to. ... View more

If you're familiar with Node, try nexe.   Realistically anything that can move a file from one place to another specified directory is a basic installer. That can be through Node, Autohotkey, Python, or anything you prefer. ... View more

There seems to be a bit of confusion here, so to lay it out explicitly:   "Adobe SDK" = The software developer kit published by Adobe for making AIP extensions and plugins using C++ "AIHostAdapter.aip" = A plugin built in C++ to allow Javascript to communicate with the host app "AIHostAdapter.js" = The sibling Javascript file which you'd use with the above plugin   To use AIHostAdapter, you don't use or touch the SDK. It doesn't require you open Visual Community and download their SDK or anything of that sort. To use AIHostAdapter, you simply place the AIP plugin into the user's "Plugins" folder, which does require admin access and would either need to be done via installer or command line if not asking the user to do it yourself.   You cannot use AIHostAdapter without installing the AIHostAdapter.aip plugin, no. You can use AIHostAdapter without installing the SDK because it doesn't have anything to do with the SDK, it's already a standalone plugin and there'd be no need to extend it via the SDK and add new functionality unless you were specifically looking to do just that. ... View more

You can only communicate via strings between the environments, even if this is JSON that you parse once loaded. CEP extensions have plenty of utilities for handling files especially via NodeJS, but this depends entirely on what you're intending to do. If you want to display images created in app in some CEP extension, you're better off exporting the file from JSX, returning filepaths to CEP, then reading the filepaths in CEP as something like base64 and assigning it to an img src attribute like here. ... View more

This might look like a lot, but it really isn't once you look past the polyfills at the beginning and just look through the copyColorsToClipboard function. I took what you did and refactored it a bit:   Object.prototype.keys = function (obj) { var keys = []; for (var key in obj) keys.push(key); return keys; }; Array.prototype.map = function (callback) { var mappedParam = []; for (var i = 0; i < this.length; i++) mappedParam.push(callback(this[i], i, this)); return mappedParam; }; Array.prototype.indexOf = function (item) { for (var i = 0; i < this.length; i++) if (this[i] == item) return i; return -1; }; Array.prototype.filter = function (callback) { var filtered = []; for (var i = 0; i < this.length; i++) if (callback(this[i], i, this)) filtered.push(this[i]); return filtered; }; RGBColor.prototype.getString = CMYKColor.prototype.getString = SpotColor.prototype.getString = LabColor.prototype.getString = function () { var result = this.typename.replace(/color$/i, "").toUpperCase() + "="; var self = this; // Prevent namespace conflicts from scoping if (this.spot) return this.spot.name else result += Object.keys(self) .filter(function (key) { return !/typename|getString/.test(key); }) .map(function (key) { // Color keys are always in order, so just return them rounded: return Math.round(self[key]); }) .join(","); return result; }; function get(type, parent, deep) { if (arguments.length == 1 || !parent) { parent = app.activeDocument; deep = true; } var result = []; if (!parent[type]) return []; for (var i = 0; i < parent[type].length; i++) { result.push(parent[type][i]); if (parent[type][i][type] && deep) result = [].concat(result, get(type, parent[type][i], deep)); } return result; } function setClipboard(str) { var prev = get('selection'); selection = null; var idoc = app.activeDocument; var tlayer = idoc.layers.add(); var tframe = tlayer.textFrames.add(); // Had faulty unicode whitespace characters showing, so strip them: tframe.contents = str.replace(/^\s*||\s*$/, ""); tframe.translate(10); tframe.selected = true; app.copy(); tlayer.remove(); app.selection = prev; } function copyColorsToClipboard() { try { // Get selection as real array instead of Array-like var list = get("selection"); // Compile array of all fills and strokes var colors = [] .concat( list.map(function (item) { return item.filled ? item.fillColor : null; }), list.map(function (item) { return item.stroked ? item.strokeColor : null; }) ).filter(function (color) { return !!color; // Remove any null values }).map(function (color) { return color.getString(); // Replace values with string in form [TYPE]=[VALUES] }).filter(function (colorString, index, arr) { return arr.indexOf(colorString) == index; // Remove duplicates }) setClipboard(colors.join(", ")) } catch (err) { alert(err); } } copyColorsToClipboard(); In the above, these are identical colors in value but the left is a Spot color swatch named PMS 186 C whereas the right is a pure RGB. ... View more