@auraindustry/aurajs 0.1.1 → 0.1.5

package/src/publish-command.mjs

@@ -1,14 +1,21 @@
 import { spawn } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
-import { resolve } from 'node:path';
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { basename, join, resolve } from 'node:path';
 
 import { preparePublishPackageSurface } from './external-package-surface.mjs';
 import {
   PACKAGE_INTEGRITY_PUBLISH_FILES,
   writeSignedPackageIntegrityArtifacts,
 } from './package-integrity.mjs';
+import { canPromptInteractively, promptInput, promptSelect } from './terminal-ui.mjs';
 import { resolvePublishEnvExampleSurface } from './publish-env-example.mjs';
 import { validatePublishProject } from './publish-validation.mjs';
+import { formatBytes } from './external-asset-policy.mjs';
+
+const SEMVER_RE = /^v?(\d+)\.(\d+)\.(\d+)(-[0-9A-Za-z-.]+)?$/;
+const SCOPED_PACKAGE_RE = /^@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/;
+const UNSCOPED_PACKAGE_RE = /^[a-z0-9][a-z0-9._-]*$/;
 
 export function isNpmPublishLifecycleInvocation(env = process.env) {
   return env.npm_lifecycle_event === 'publish' && env.npm_command === 'publish';
@@ -18,7 +25,237 @@ export function hasOption(commandArgs, optionName) {
   return commandArgs.some((arg) => arg === optionName || arg.startsWith(`${optionName}=`));
 }
 
-export function readProjectPackage(projectRoot = process.cwd()) {
+function stripOption(commandArgs, optionName) {
+  const nextArgs = [];
+  for (let index = 0; index < commandArgs.length; index += 1) {
+    const current = commandArgs[index];
+    if (current === optionName) {
+      index += 1;
+      continue;
+    }
+    if (current.startsWith(`${optionName}=`)) {
+      continue;
+    }
+    nextArgs.push(current);
+  }
+  return nextArgs;
+}
+
+function sanitizePackageSlug(value) {
+  const compact = String(value || '')
+    .trim()
+    .toLowerCase()
+    .replace(/^@[^/]+\//, '')
+    .replace(/\s+/g, '-')
+    .replace(/[^a-z0-9._-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^[-._]+|[-._]+$/g, '');
+  if (!compact) {
+    throw new Error(`Cannot derive package slug from "${value}".`);
+  }
+  return compact;
+}
+
+function buildDefaultPackageName(projectRoot) {
+  return `@aurajs/${sanitizePackageSlug(basename(projectRoot))}`;
+}
+
+function ensureScopedPackageName(value) {
+  const trimmed = String(value || '').trim();
+  if (!trimmed) {
+    throw new Error('Package name cannot be empty.');
+  }
+  if (/^[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*$/.test(trimmed)) {
+    return `@${trimmed}`;
+  }
+  return trimmed;
+}
+
+function isValidPackageName(value) {
+  const normalized = String(value || '').trim();
+  if (!normalized) {
+    return false;
+  }
+  try {
+    const candidate = ensureScopedPackageName(normalized);
+    return SCOPED_PACKAGE_RE.test(candidate) || UNSCOPED_PACKAGE_RE.test(candidate);
+  } catch {
+    return false;
+  }
+}
+
+function validatePackageName(value) {
+  const normalized = ensureScopedPackageName(value);
+  if (!SCOPED_PACKAGE_RE.test(normalized) && !UNSCOPED_PACKAGE_RE.test(normalized)) {
+    throw new Error(`Invalid npm package name "${value}".`);
+  }
+}
+
+function normalizeVersion(value) {
+  return String(value || '').trim().replace(/^v/i, '');
+}
+
+function isValidVersion(value) {
+  return SEMVER_RE.test(String(value || '').trim());
+}
+
+function validateVersion(value) {
+  if (!isValidVersion(value)) {
+    throw new Error(`Invalid version "${value}". Expected semver like 1.2.3 or 1.2.3-beta.1.`);
+  }
+}
+
+function bumpVersion(currentVersion, bumpKind) {
+  const match = normalizeVersion(currentVersion).match(SEMVER_RE);
+  if (!match) {
+    throw new Error(`Current version "${currentVersion}" is not valid semver.`);
+  }
+  const major = Number.parseInt(match[1], 10);
+  const minor = Number.parseInt(match[2], 10);
+  const patch = Number.parseInt(match[3], 10);
+  const prerelease = match[4] || '';
+
+  if (bumpKind === 'major') return `${major + 1}.0.0${prerelease}`;
+  if (bumpKind === 'minor') return `${major}.${minor + 1}.0${prerelease}`;
+  return `${major}.${minor}.${patch + 1}${prerelease}`;
+}
+
+function extractInternalPublishOptions(commandArgs) {
+  const sanitizedArgs = [];
+  let explicitName = null;
+  let explicitVersion = null;
+  let yes = false;
+
+  for (let index = 0; index < commandArgs.length; index += 1) {
+    const current = commandArgs[index];
+    if (current === '--yes' || current === '-y') {
+      yes = true;
+      continue;
+    }
+    if (current === '--name') {
+      explicitName = commandArgs[index + 1] || '';
+      index += 1;
+      continue;
+    }
+    if (current.startsWith('--name=')) {
+      explicitName = current.slice('--name='.length);
+      continue;
+    }
+    if (current === '--version') {
+      explicitVersion = commandArgs[index + 1] || '';
+      index += 1;
+      continue;
+    }
+    if (current.startsWith('--version=')) {
+      explicitVersion = current.slice('--version='.length);
+      continue;
+    }
+    sanitizedArgs.push(current);
+  }
+
+  return {
+    sanitizedArgs,
+    explicitName,
+    explicitVersion,
+    yes,
+  };
+}
+
+export function extractPublishToken(commandArgs, env = process.env) {
+  let explicitToken = null;
+
+  for (let index = 0; index < commandArgs.length; index += 1) {
+    const current = commandArgs[index];
+    if (current === '--token') {
+      explicitToken = commandArgs[index + 1] || '';
+      break;
+    }
+    if (current.startsWith('--token=')) {
+      explicitToken = current.slice('--token='.length);
+      break;
+    }
+  }
+
+  const envToken = typeof env.NODE_AUTH_TOKEN === 'string' && env.NODE_AUTH_TOKEN.trim().length > 0
+    ? env.NODE_AUTH_TOKEN.trim()
+    : null;
+  const normalizedToken = typeof explicitToken === 'string' && explicitToken.trim().length > 0
+    ? explicitToken.trim()
+    : envToken;
+
+  return {
+    publishArgs: stripOption(commandArgs, '--token'),
+    publishEnv: normalizedToken
+      ? {
+        ...env,
+        NODE_AUTH_TOKEN: normalizedToken,
+      }
+      : env,
+    publishToken: normalizedToken,
+  };
+}
+
+function normalizeRegistryUrl(registryValue) {
+  const normalizedValue = String(registryValue || '').trim();
+  if (!normalizedValue) {
+    return 'https://registry.npmjs.org/';
+  }
+
+  try {
+    const registryUrl = new URL(normalizedValue);
+    if (!registryUrl.pathname.endsWith('/')) {
+      registryUrl.pathname = `${registryUrl.pathname}/`;
+    }
+    return registryUrl.toString();
+  } catch {
+    return 'https://registry.npmjs.org/';
+  }
+}
+
+function buildRegistryAuthLine(token, registryUrl) {
+  const parsedUrl = new URL(registryUrl);
+  const registryPath = parsedUrl.pathname === '/' ? '' : parsedUrl.pathname.replace(/\/$/, '');
+  return `//${parsedUrl.host}${registryPath}/:_authToken=${token}`;
+}
+
+function createPublishTokenEnv(token, env = process.env) {
+  if (!token) {
+    return {
+      env,
+      cleanup() {},
+    };
+  }
+
+  const registryUrl = normalizeRegistryUrl(env.npm_config_registry || env.NPM_CONFIG_REGISTRY);
+  const userConfigDir = mkdtempSync(join(tmpdir(), 'aurajs-npm-auth-'));
+  const userConfigPath = join(userConfigDir, '.npmrc');
+  writeFileSync(
+    userConfigPath,
+    [
+      `registry=${registryUrl}`,
+      'always-auth=true',
+      buildRegistryAuthLine(token, registryUrl),
+      '',
+    ].join('\n'),
+    'utf8',
+  );
+
+  return {
+    env: {
+      ...env,
+      NODE_AUTH_TOKEN: token,
+      NPM_CONFIG_USERCONFIG: userConfigPath,
+      npm_config_userconfig: userConfigPath,
+      NPM_CONFIG_REGISTRY: registryUrl,
+      npm_config_registry: registryUrl,
+    },
+    cleanup() {
+      rmSync(userConfigDir, { recursive: true, force: true });
+    },
+  };
+}
+
+function readProjectPackageManifest(projectRoot = process.cwd()) {
   const packagePath = resolve(projectRoot, 'package.json');
   if (!existsSync(packagePath)) {
     throw new Error('aura publish requires a package.json in the current project root.');
@@ -34,9 +271,6 @@ export function readProjectPackage(projectRoot = process.cwd()) {
   const packageName = typeof projectPackage?.name === 'string' && projectPackage.name.trim().length > 0
     ? projectPackage.name.trim()
     : null;
-  if (!packageName) {
-    throw new Error('aura publish requires package.json -> name to be set.');
-  }
 
   return {
     packagePath,
@@ -45,9 +279,162 @@ export function readProjectPackage(projectRoot = process.cwd()) {
   };
 }
 
+export function readProjectPackage(projectRoot = process.cwd()) {
+  const projectPackage = readProjectPackageManifest(projectRoot);
+  if (!projectPackage.packageName) {
+    throw new Error('aura publish requires package.json -> name to be set.');
+  }
+  return projectPackage;
+}
+
+async function resolvePublishPackageName(
+  commandArgs,
+  {
+    projectRoot = process.cwd(),
+    canPromptInteractivelyImpl = canPromptInteractively,
+    promptInputImpl = promptInput,
+  } = {},
+) {
+  const { packagePath, projectPackage, packageName: currentPackageName } = readProjectPackageManifest(projectRoot);
+  const { sanitizedArgs, explicitName, yes } = extractInternalPublishOptions(commandArgs);
+  const defaultPackageName = buildDefaultPackageName(projectRoot);
+  const currentValidPackageName = currentPackageName && isValidPackageName(currentPackageName)
+    ? ensureScopedPackageName(currentPackageName)
+    : null;
+
+  let targetPackageName = currentPackageName;
+
+  if (explicitName !== null) {
+    targetPackageName = ensureScopedPackageName(explicitName);
+    validatePackageName(targetPackageName);
+  } else if (yes) {
+    targetPackageName = currentPackageName || defaultPackageName;
+    validatePackageName(targetPackageName);
+  } else if (canPromptInteractivelyImpl()) {
+    const fallbackPackageName = currentValidPackageName || defaultPackageName;
+    const fallbackDisplay = fallbackPackageName.startsWith('@')
+      ? fallbackPackageName.slice(1)
+      : fallbackPackageName;
+    const input = await promptInputImpl(`  Package name (default: ${fallbackDisplay})`);
+    targetPackageName = ensureScopedPackageName(input || fallbackPackageName);
+    validatePackageName(targetPackageName);
+  }
+
+  if (targetPackageName && projectPackage.name !== targetPackageName) {
+    projectPackage.name = targetPackageName;
+    writeFileSync(packagePath, `${JSON.stringify(projectPackage, null, 2)}\n`, 'utf8');
+  }
+
+  return {
+    publishArgs: sanitizedArgs,
+    packageName: targetPackageName,
+  };
+}
+
+async function resolvePublishVersion(
+  commandArgs,
+  {
+    projectRoot = process.cwd(),
+    canPromptInteractivelyImpl = canPromptInteractively,
+    promptSelectImpl = promptSelect,
+    promptInputImpl = promptInput,
+  } = {},
+) {
+  const { packagePath, projectPackage } = readProjectPackage(projectRoot);
+  const { sanitizedArgs, explicitVersion, yes } = extractInternalPublishOptions(commandArgs);
+  const packageVersion = typeof projectPackage?.version === 'string' && projectPackage.version.trim().length > 0
+    ? normalizeVersion(projectPackage.version)
+    : null;
+  const currentVersion = isValidVersion(packageVersion || '') ? packageVersion : null;
+
+  let targetVersion = packageVersion;
+
+  if (explicitVersion !== null) {
+    const normalized = normalizeVersion(explicitVersion);
+    validateVersion(normalized);
+    targetVersion = normalized;
+  } else if (yes) {
+    if (packageVersion) {
+      validateVersion(packageVersion);
+      targetVersion = packageVersion;
+    } else {
+      targetVersion = '0.1.0';
+    }
+  } else if (canPromptInteractivelyImpl()) {
+    if (currentVersion) {
+      const choice = await promptSelectImpl(
+        '  Version selection',
+        [
+          { value: 'current', label: `Current (${currentVersion})`, aliases: ['c', 'keep'] },
+          { value: 'bump', label: 'Bump version', aliases: ['b'] },
+          { value: 'custom', label: 'Custom version', aliases: ['x'] },
+        ],
+        'current',
+      );
+
+      if (choice === 'bump') {
+        const bumpKind = await promptSelectImpl(
+          '  Bump type',
+          [
+            { value: 'patch', label: `Patch (${bumpVersion(currentVersion, 'patch')})`, aliases: ['p'] },
+            { value: 'minor', label: `Minor (${bumpVersion(currentVersion, 'minor')})`, aliases: ['m'] },
+            { value: 'major', label: `Major (${bumpVersion(currentVersion, 'major')})`, aliases: ['M'] },
+          ],
+          'patch',
+        );
+        targetVersion = bumpVersion(currentVersion, bumpKind);
+      } else if (choice === 'custom') {
+        while (true) {
+          const input = normalizeVersion(await promptInputImpl('  Custom version (semver)'));
+          if (!input) {
+            console.error('  Version is required.');
+            continue;
+          }
+          if (!isValidVersion(input)) {
+            console.error('  Invalid version format. Use semver like 1.2.3 or 1.2.3-beta.1');
+            continue;
+          }
+          targetVersion = input;
+          break;
+        }
+      }
+    } else {
+      const defaultVersion = packageVersion ? '' : '0.1.0';
+      const promptLabel = defaultVersion
+        ? `  Package version (semver, default: ${defaultVersion})`
+        : '  Package version (semver)';
+      while (true) {
+        const input = normalizeVersion(await promptInputImpl(promptLabel));
+        const candidate = input || defaultVersion;
+        if (!candidate) {
+          console.error('  Version is required.');
+          continue;
+        }
+        if (!isValidVersion(candidate)) {
+          console.error('  Invalid version format. Use semver like 1.2.3 or 1.2.3-beta.1');
+          continue;
+        }
+        targetVersion = candidate;
+        break;
+      }
+    }
+  }
+
+  if (targetVersion && projectPackage.version !== targetVersion) {
+    projectPackage.version = targetVersion;
+    writeFileSync(packagePath, `${JSON.stringify(projectPackage, null, 2)}\n`, 'utf8');
+  }
+
+  return {
+    publishArgs: sanitizedArgs,
+    packageVersion: targetVersion,
+  };
+}
+
 export function buildPublishArgs(commandArgs, { packageName } = {}) {
-  const publishArgs = ['publish', ...commandArgs];
-  if (String(packageName || '').startsWith('@') && !hasOption(commandArgs, '--access')) {
+  const sanitizedArgs = stripOption(commandArgs, '--token');
+  const publishArgs = ['publish', ...sanitizedArgs];
+  if (String(packageName || '').startsWith('@') && !hasOption(sanitizedArgs, '--access')) {
     publishArgs.push('--access', 'public');
   }
   return publishArgs;
@@ -68,13 +455,10 @@ function spawnPublish(commandArgs, { projectRoot, env, stdout, stderr }) {
   return new Promise((resolveRun, rejectRun) => {
     const child = spawn(resolveNpmCommand(), commandArgs, {
       cwd: projectRoot,
-      stdio: ['ignore', 'pipe', 'pipe'],
+      stdio: 'inherit',
       env,
     });
 
-    pipeChildStream(child.stdout, stdout);
-    pipeChildStream(child.stderr, stderr);
-
     child.on('error', (error) => {
       rejectRun(error);
     });
@@ -107,6 +491,9 @@ export async function runPublishCommand(
     stdout = process.stdout,
     stderr = process.stderr,
     validateProject = validatePublishProject,
+    canPromptInteractivelyImpl = canPromptInteractively,
+    promptSelectImpl = promptSelect,
+    promptInputImpl = promptInput,
   } = {},
 ) {
   if (isNpmPublishLifecycleInvocation(env)) {
@@ -121,6 +508,19 @@ export async function runPublishCommand(
     };
   }
 
+  await resolvePublishPackageName(commandArgs, {
+    projectRoot,
+    canPromptInteractivelyImpl,
+    promptInputImpl,
+  });
+
+  const publishVersionResolution = await resolvePublishVersion(commandArgs, {
+    projectRoot,
+    canPromptInteractivelyImpl,
+    promptSelectImpl,
+    promptInputImpl,
+  });
+
   let validation;
   try {
     validation = await validateProject({
@@ -134,9 +534,13 @@ export async function runPublishCommand(
       const assetBytes = Number.isFinite(error?.details?.assetBytes) ? error.details.assetBytes : null;
       const thresholdBytes = Number.isFinite(error?.details?.thresholdBytes) ? error.details.thresholdBytes : null;
       if (assetBytes !== null && thresholdBytes !== null) {
-        stdout?.write(`  Asset payload: ${assetBytes} bytes (threshold ${thresholdBytes})\n`);
+        stdout?.write(`  Asset payload: ${formatBytes(assetBytes)} (${assetBytes} bytes)\n`);
+        stdout?.write(`  Threshold: ${formatBytes(thresholdBytes)} (${thresholdBytes} bytes)\n`);
       }
-      stdout?.write('  Next step: upload the heavy assets to a public HTTPS host like Cloudflare R2 or S3, generate the external asset config, then retry publish.\n');
+      stdout?.write('  This package is too large for npm-first publish.\n');
+      stdout?.write('  Self-host for now: upload the heavy assets to your own public HTTPS host, then generate the external asset config.\n');
+      stdout?.write('  Command: auramaxx external-assets generate --public-base-url https://cdn.example.com/my-game\n');
+      stdout?.write('  Docs: https://www.aurajs.gg/docs/publishing-and-large-assets\n');
     }
     if (error?.reportPath) {
       stdout?.write(`  Validation report: ${error.reportPath}\n\n`);
@@ -146,8 +550,13 @@ export async function runPublishCommand(
 
   const packageName = validation.packageName;
   const { projectPackage } = readProjectPackage(projectRoot);
-  const publishArgs = buildPublishArgs(commandArgs, { packageName });
-  const dryRun = hasOption(commandArgs, '--dry-run');
+  const { publishArgs: sanitizedCommandArgs, publishEnv, publishToken } = extractPublishToken(
+    publishVersionResolution.publishArgs,
+    env,
+  );
+  const publishArgs = buildPublishArgs(sanitizedCommandArgs, { packageName });
+  const publishTokenEnv = createPublishTokenEnv(publishToken, publishEnv);
+  const dryRun = hasOption(sanitizedCommandArgs, '--dry-run');
   const envExampleSurface = resolvePublishEnvExampleSurface({ projectRoot });
   const packageSurface = preparePublishPackageSurface({
     projectRoot,
@@ -162,9 +571,15 @@ export async function runPublishCommand(
     packageRoot: packageSurface.publishRoot,
     signerProjectRoot: projectRoot,
     buildMetadata: validation?.report?.validation?.build || null,
+    includedRelativePaths: Array.isArray(validation?.report?.validation?.pack?.files)
+      ? validation.report.validation.pack.files.map((entry) => entry?.path).filter(Boolean)
+      : null,
   });
   stdout?.write(`\n  aura publish: ${dryRun ? 'dry-run' : 'npm-first publish'}\n`);
   stdout?.write(`  Package: ${packageName}\n`);
+  if (publishVersionResolution.packageVersion) {
+    stdout?.write(`  Version: ${publishVersionResolution.packageVersion}\n`);
+  }
   stdout?.write(`  Validation report: ${validation.reportPath}\n`);
   if (Number.isFinite(validation?.report?.validation?.assets?.assetBytes)) {
     const assets = validation.report.validation.assets;
@@ -176,11 +591,12 @@ export async function runPublishCommand(
   try {
     await spawnPublish(publishArgs, {
       projectRoot: packageSurface.publishRoot,
-      env,
+      env: publishTokenEnv.env,
       stdout,
       stderr,
     });
   } finally {
+    publishTokenEnv.cleanup();
     packageSurface.cleanup();
   }
 
@@ -189,6 +605,7 @@ export async function runPublishCommand(
     skipped: false,
     reasonCode: dryRun ? 'publish_dry_run_ok' : 'publish_ok',
     packageName,
+    packageVersion: publishVersionResolution.packageVersion || validation.packageVersion || null,
     reportPath: validation.reportPath,
     publishArgs,
   };

package/src/publish-validation.mjs

@@ -401,12 +401,16 @@ export async function validatePublishProject(
       );
     }
 
+    const expectedAurajsVersion = typeof projectPackage?.dependencies?.['@auraindustry/aurajs'] === 'string'
+      ? projectPackage.dependencies['@auraindustry/aurajs'].trim()
+      : null;
+
     const binIntegrity = assertProjectBinIntegrity({
       projectRoot,
       projectPackage,
       packageName,
       aurajsPackageRoot: DEFAULT_AURAJS_PACKAGE_ROOT,
-      expectedAurajsVersion: AURAJS_PACKAGE_VERSION,
+      expectedAurajsVersion,
       enforceExactAurajsDependency: true,
     });
     report.validation.binIntegrity = {
@@ -566,20 +570,11 @@ export async function validatePublishProject(
       );
     }
 
-    const packageIntegrity = writeSignedPackageIntegrityArtifacts({
+    let packageIntegrity = writeSignedPackageIntegrityArtifacts({
       packageRoot: packageSurface.publishRoot,
       signerProjectRoot: projectRoot,
       buildMetadata,
     });
-    report.validation.packageIntegrity = {
-      reasonCode: 'publish_package_integrity_ok',
-      manifestPath: packageIntegrity.manifestPath,
-      signaturePath: packageIntegrity.signaturePath,
-      schema: packageIntegrity.schema,
-      fileCount: packageIntegrity.fileCount,
-      signerFingerprint: packageIntegrity.signerFingerprint,
-      publishedMetadata: packageIntegrity.publishedMetadata,
-    };
 
     assetThresholdRecord.packageSurfaceMode = packageSurface.mode;
     assetThresholdRecord.assetPackaging = packageSurface.mode === SELF_HOSTED_PACKAGE_SURFACE_MODE
@@ -664,6 +659,22 @@ export async function validatePublishProject(
       files: packFiles,
     };
 
+    packageIntegrity = writeSignedPackageIntegrityArtifacts({
+      packageRoot: packageSurface.publishRoot,
+      signerProjectRoot: projectRoot,
+      buildMetadata,
+      includedRelativePaths: packFiles.map((entry) => entry.path),
+    });
+    report.validation.packageIntegrity = {
+      reasonCode: 'publish_package_integrity_ok',
+      manifestPath: packageIntegrity.manifestPath,
+      signaturePath: packageIntegrity.signaturePath,
+      schema: packageIntegrity.schema,
+      fileCount: packageIntegrity.fileCount,
+      signerFingerprint: packageIntegrity.signerFingerprint,
+      publishedMetadata: packageIntegrity.publishedMetadata,
+    };
+
     report.summary = {
       pass: true,
       reasonCode: 'publish_validation_ok',